safeword 0.30.3 → 0.32.0

package/dist/{check-VBN3JZIG.js → check-PNWSVUZG.js}

@@ -6,7 +6,7 @@ import {
   createProjectContext,
   getMissingPacks,
   reconcile
-} from "./chunk-A52DHYLS.js";
+} from "./chunk-UPAH2FHH.js";
 import "./chunk-YVZL7WO5.js";
 import {
   VERSION
@@ -189,4 +189,4 @@ async function check(options) {
 export {
   check
 };
-//# sourceMappingURL=check-VBN3JZIG.js.map
+//# sourceMappingURL=check-PNWSVUZG.js.map

package/dist/{chunk-BKF5HT4X.js → chunk-DSPWQAEB.js}

@@ -3,7 +3,7 @@ import {
   addInstalledPack,
   isGitRepo,
   isPackInstalled
-} from "./chunk-A52DHYLS.js";
+} from "./chunk-UPAH2FHH.js";
 
 // src/packs/install.ts
 function installPack(packId, cwd) {
@@ -21,4 +21,4 @@ function installPack(packId, cwd) {
 export {
   installPack
 };
-//# sourceMappingURL=chunk-BKF5HT4X.js.map
+//# sourceMappingURL=chunk-DSPWQAEB.js.map

package/dist/{chunk-A52DHYLS.js → chunk-UPAH2FHH.js}

@@ -33,6 +33,7 @@ function setupGoTooling() {
 
 // src/packs/config.ts
 import nodePath from "path";
+import process2 from "process";
 var CONFIG_PATH = ".safeword/config.json";
 function readConfig(cwd) {
   const configPath = nodePath.join(cwd, CONFIG_PATH);
@@ -533,17 +534,6 @@ function planOwnedFileWrites(files, ctx) {
 function planManagedFileWrites(files, ctx) {
   return planFileWrites(files, ctx, (filePath, c) => exists(nodePath7.join(c.cwd, filePath)));
 }
-function planTextPatchesWithCreation(patches, ctx) {
-  const actions = planTextPatches(patches, ctx.isGitRepo);
-  const created = [];
-  for (const [filePath, definition] of Object.entries(patches)) {
-    if (shouldSkipForNonGit(filePath, ctx.isGitRepo)) continue;
-    if (definition.createIfMissing && !exists(nodePath7.join(ctx.cwd, filePath))) {
-      created.push(filePath);
-    }
-  }
-  return { actions, created };
-}
 function planExistingDirectoriesRemoval(directories, cwd) {
   const actions = [];
   const removed = [];
@@ -638,9 +628,13 @@ function computeInstallPlan(schema, ctx) {
   for (const [filePath, definition] of Object.entries(schema.jsonMerges)) {
     actions.push({ type: "json-merge", path: filePath, definition });
   }
-  const patches = planTextPatchesWithCreation(schema.textPatches, ctx);
-  actions.push(...patches.actions);
-  wouldCreate.push(...patches.created);
+  const textPatchActions = planTextPatches(schema.textPatches, ctx.isGitRepo);
+  actions.push(...textPatchActions);
+  for (const action of textPatchActions) {
+    if (action.type === "text-patch" && !exists(nodePath7.join(ctx.cwd, action.path))) {
+      wouldCreate.push(action.path);
+    }
+  }
   const packagesToInstall = computePackagesToInstall(
     schema,
     ctx.projectType,
@@ -1460,7 +1454,7 @@ var rustManagedFiles = {
 // src/packs/sql/dialect.ts
 import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
 import nodePath11 from "path";
-import process2 from "process";
+import process3 from "process";
 import YAML2 from "yaml";
 var ADAPTER_TO_DIALECT = {
   postgres: "postgres",
@@ -1556,7 +1550,7 @@ function detectFromProfiles(cwd) {
     const candidates = [
       nodePath11.join(dbtProjectDirectory, "profiles.yml"),
       nodePath11.join(dbtProjectDirectory, "dbt", "profiles.yml"),
-      nodePath11.join(process2.env.HOME ?? "", ".dbt", "profiles.yml")
+      nodePath11.join(process3.env.HOME ?? "", ".dbt", "profiles.yml")
     ];
     for (const profilesPath of candidates) {
       const adapterType = resolveProfileType(profilesPath, profileName);
@@ -1927,17 +1921,28 @@ var HOOKS_DIR = '"$CLAUDE_PROJECT_DIR"/.safeword/hooks';
 function hook(command) {
   return { hooks: [{ type: "command", command }] };
 }
+function asyncHook(command) {
+  return { hooks: [{ type: "command", command, async: true }] };
+}
 function matchedHook(matcher, command) {
   return { matcher, hooks: [{ type: "command", command }] };
 }
+function matchedHookWithIf(matcher, ifRule, command) {
+  return {
+    matcher,
+    hooks: [{ type: "command", if: ifRule, command }]
+  };
+}
 var EDIT_TOOLS = "Edit|Write|MultiEdit|NotebookEdit";
 var SETTINGS_HOOKS = {
   SessionStart: [
     hook(`bash ${HOOKS_DIR}/session-bun-check.sh`),
+    hook(`bun ${HOOKS_DIR}/session-auto-upgrade.ts`),
     hook(`bun ${HOOKS_DIR}/session-verify-agents.ts`),
     hook(`bun ${HOOKS_DIR}/session-version.ts`),
     hook(`bun ${HOOKS_DIR}/session-lint-check.ts`),
-    matchedHook("compact", `bun ${HOOKS_DIR}/session-compact-context.ts`)
+    matchedHook("compact", `bun ${HOOKS_DIR}/session-compact-context.ts`),
+    asyncHook(`bun ${HOOKS_DIR}/session-update-check.ts`)
   ],
   UserPromptSubmit: [
     hook(`bun ${HOOKS_DIR}/prompt-timestamp.ts`),
@@ -1946,7 +1951,11 @@ var SETTINGS_HOOKS = {
   Stop: [hook(`bun ${HOOKS_DIR}/stop-quality.ts`)],
   PreToolUse: [
     matchedHook(EDIT_TOOLS, `bun ${HOOKS_DIR}/pre-tool-quality.ts`),
-    matchedHook(EDIT_TOOLS, `bun ${HOOKS_DIR}/pre-tool-config-guard.ts`)
+    matchedHook(EDIT_TOOLS, `bun ${HOOKS_DIR}/pre-tool-config-guard.ts`),
+    // Defends ad-hoc git ops against Claude Code's parallel-worktree
+    // core.bare=true race (anthropics/claude-code#58345). `if` filters at the
+    // config level so non-git Bash calls incur zero hook-process spawn.
+    matchedHookWithIf("Bash", "Bash(git *)", `bash ${HOOKS_DIR}/pre-tool-git-bare-fix.sh`)
   ],
   PostToolUse: [
     matchedHook(EDIT_TOOLS, `bun ${HOOKS_DIR}/post-tool-lint.ts`),
@@ -2268,6 +2277,62 @@ var typescriptPackages = {
   }
 };
 
+// src/owned-paths.ts
+function computeSafewordPathPrefixes(schema) {
+  const allPaths = [
+    ...Object.keys(schema.ownedFiles),
+    ...Object.keys(schema.managedFiles),
+    ...Object.keys(schema.jsonMerges),
+    ...Object.keys(schema.textPatches)
+  ];
+  const prefixes = /* @__PURE__ */ new Set();
+  for (const path2 of allPaths) {
+    const slashIndex = path2.indexOf("/");
+    prefixes.add(slashIndex === -1 ? path2 : path2.slice(0, slashIndex + 1));
+  }
+  return [...prefixes].toSorted((a, b) => a.localeCompare(b));
+}
+function generateOwnedPathsModule(schema) {
+  const prefixes = computeSafewordPathPrefixes(schema);
+  const entries = prefixes.map((prefix) => `  '${prefix}',`).join("\n");
+  return `// Auto-generated by safeword from SAFEWORD_SCHEMA. Do not edit by hand.
+// Source: ownedFiles \u222A managedFiles \u222A jsonMerges \u222A textPatches \u2192 top-level prefixes.
+// Regenerated on every \`safeword setup\` and \`safeword upgrade\`.
+
+export const SAFEWORD_PATHS: readonly string[] = [
+${entries}
+];
+
+/**
+ * Match a file path against the safeword-managed set. Directory prefixes
+ * (entries ending in \`/\`) match by \`startsWith\`; bare file paths must
+ * match exactly so e.g. \`package.json.bak\` does not match \`package.json\`.
+ */
+export function isSafewordPath(file: string): boolean {
+  for (const prefix of SAFEWORD_PATHS) {
+    if (prefix.endsWith('/')) {
+      if (file.startsWith(prefix)) return true;
+    } else if (file === prefix) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Pick the safeword-managed subset of files reported by \`git diff --name-only\`
+ * (changed) and \`git ls-files --others --exclude-standard\` (untracked).
+ * Used by the auto-upgrade hook to decide what to stage after \`safeword upgrade\`.
+ */
+export function filterSafewordFiles(
+  changedFiles: readonly string[],
+  untrackedFiles: readonly string[],
+): readonly string[] {
+  return [...changedFiles, ...untrackedFiles].filter(f => isSafewordPath(f));
+}
+`;
+}
+
 // src/templates/content.ts
 var AGENTS_MD_LINK = `**\u26A0\uFE0F ALWAYS READ FIRST:** \`.safeword/SAFEWORD.md\`
 
@@ -2493,8 +2558,18 @@ var SAFEWORD_SCHEMA = {
     ".safeword/hooks/lib/lint.ts": { template: "hooks/lib/lint.ts" },
     ".safeword/hooks/lib/quality.ts": { template: "hooks/lib/quality.ts" },
     ".safeword/hooks/lib/quality-state.ts": { template: "hooks/lib/quality-state.ts" },
+    ".safeword/hooks/lib/skill-invocation-log.ts": {
+      template: "hooks/lib/skill-invocation-log.ts"
+    },
     ".safeword/hooks/lib/scenario-format.ts": { template: "hooks/lib/scenario-format.ts" },
     ".safeword/hooks/lib/test-runner.ts": { template: "hooks/lib/test-runner.ts" },
+    ".safeword/hooks/lib/update-cache.ts": { template: "hooks/lib/update-cache.ts" },
+    ".safeword/hooks/lib/version.ts": { template: "hooks/lib/version.ts" },
+    // Generated at setup/upgrade from SAFEWORD_SCHEMA itself — the prefix list
+    // the auto-upgrade hook uses to decide which files to stage. See owned-paths.ts.
+    ".safeword/hooks/lib/owned-paths.ts": {
+      generator: () => generateOwnedPathsModule(SAFEWORD_SCHEMA)
+    },
     // Hooks - TypeScript with Bun runtime
     ".safeword/hooks/session-verify-agents.ts": {
       template: "hooks/session-verify-agents.ts"
@@ -2529,6 +2604,15 @@ var SAFEWORD_SCHEMA = {
     ".safeword/hooks/pre-tool-config-guard.ts": {
       template: "hooks/pre-tool-config-guard.ts"
     },
+    ".safeword/hooks/pre-tool-git-bare-fix.sh": {
+      template: "hooks/pre-tool-git-bare-fix.sh"
+    },
+    ".safeword/hooks/session-auto-upgrade.ts": {
+      template: "hooks/session-auto-upgrade.ts"
+    },
+    ".safeword/hooks/session-update-check.ts": {
+      template: "hooks/session-update-check.ts"
+    },
     ".safeword/hooks/session-cleanup-quality.ts": {
       template: "hooks/session-cleanup-quality.ts"
     },
@@ -2652,6 +2736,9 @@ var SAFEWORD_SCHEMA = {
     ".claude/skills/brainstorm/SKILL.md": {
       template: "skills/brainstorm/SKILL.md"
     },
+    ".claude/skills/elicit/SKILL.md": {
+      template: "skills/elicit/SKILL.md"
+    },
     ".claude/skills/tdd-review/SKILL.md": {
       template: "skills/tdd-review/SKILL.md"
     },
@@ -2659,15 +2746,24 @@ var SAFEWORD_SCHEMA = {
     ".cursor/rules/safeword-core.mdc": {
       template: "cursor/rules/safeword-core.mdc"
     },
+    ".cursor/rules/safeword-brainstorming.mdc": {
+      template: "cursor/rules/safeword-brainstorming.mdc"
+    },
     ".cursor/rules/safeword-debugging.mdc": {
       template: "cursor/rules/safeword-debugging.mdc"
     },
+    ".cursor/rules/safeword-elicitation.mdc": {
+      template: "cursor/rules/safeword-elicitation.mdc"
+    },
     ".cursor/rules/safeword-quality-reviewing.mdc": {
       template: "cursor/rules/safeword-quality-reviewing.mdc"
     },
     ".cursor/rules/safeword-refactoring.mdc": {
       template: "cursor/rules/safeword-refactoring.mdc"
     },
+    ".cursor/rules/safeword-tdd-review.mdc": {
+      template: "cursor/rules/safeword-tdd-review.mdc"
+    },
     ".cursor/rules/safeword-testing.mdc": {
       template: "cursor/rules/safeword-testing.mdc"
     },
@@ -2800,8 +2896,7 @@ var SAFEWORD_SCHEMA = {
     "AGENTS.md": {
       operation: "prepend",
       content: AGENTS_MD_LINK,
-      marker: ".safeword/SAFEWORD.md",
-      createIfMissing: true
+      marker: ".safeword/SAFEWORD.md"
     },
     "CLAUDE.md": {
       operation: "prepend",
@@ -2814,9 +2909,27 @@ var SAFEWORD_SCHEMA = {
       // backticks) still trigger prepending the new `@` import block on top.
       // Existing prose lingers harmlessly — agents skim it; only the import
       // is functionally load-bearing.
-      marker: "@./.safeword/SAFEWORD.md",
-      createIfMissing: false
-      // Only patch if exists, don't create (AGENTS.md is primary)
+      marker: "@./.safeword/SAFEWORD.md"
+    },
+    ".gitignore": {
+      operation: "append",
+      content: "\n# Safeword - Local cache and transient state\n.safeword/.update-cache.json\n.safeword-project/quality-state*.json\n",
+      marker: ".safeword/.update-cache.json"
+    }
+  },
+  // Content predicate parity — files that must contain specific strings.
+  // Different from ownedFiles (which requires byte equality between two files):
+  // contracts assert one-way "this file must include these tokens" invariants.
+  // Used by runParity() in src/parity.ts for both release tests and pre-commit
+  // (see ticket 144). Path key = file relative to repo root.
+  contracts: {
+    "packages/cli/templates/hooks/lib/quality.ts": {
+      // Cursor's stop hook imports QUALITY_REVIEW_MESSAGE. The export must exist
+      // or Cursor users get a broken hook. The four marker strings (CONFIDENT,
+      // BLOCKED, Tried:, Need:) define the binary-terminal shape from ticket 143.
+      // Removing any of them would silently regress the prompt back to legacy
+      // free-form review.
+      requires: ["QUALITY_REVIEW_MESSAGE", "CONFIDENT", "BLOCKED", "Tried:", "Need:"]
     }
   },
   // NPM packages to install (JS/TS specific packages from typescript pack)
@@ -3018,4 +3131,4 @@ export {
   detectLanguages2,
   createProjectContext
 };
-//# sourceMappingURL=chunk-A52DHYLS.js.map
+//# sourceMappingURL=chunk-UPAH2FHH.js.map