sawbuck 0.1.37 → 0.1.38

package/contract-cmd.mjs

@@ -3,6 +3,7 @@
 // here, adds your tests and tripwires if there is none, then the supply-chain protections and the architecture
 // lock. Zero-LLM. Re-running changes nothing. Protected product code (auth, billing) is suggested, never added:
 // freezing those is a person's decision.
+import { ensureExcluded } from './exclude.mjs';
 import { execFileSync } from 'node:child_process';
 import { readFileSync, writeFileSync, existsSync, mkdtempSync, rmSync, cpSync, mkdirSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
@@ -48,6 +49,7 @@ try {
       const next = text.replace(/^\.promptwheel\/?[ \t]*$/gm, '.promptwheel/*\n!.promptwheel/packs/');
       if (next !== text) writeFileSync(f, next);
     }
+    ensureExcluded(repo);
     const locked = existsSync(join(repo, 'promptwheel.lock.json'));
     if (!locked) run([join(pack, 'lock.mjs'), 'write', repo], repo);
     const added = (cfg.mandates.length - before.m) + (cfg.metrics.length - before.g);

package/exclude.mjs

@@ -0,0 +1,24 @@
+// Keep sawbuck's own record out of git status, before anything is written: signed files are the person's to
+// commit, the record is not, and an untracked .sawbuck/ would trip the rule that protects it.
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+const sh = (r, ...a) => { try { return execFileSync('git', ['-C', r, ...a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { return ''; } };
+
+export function ensureExcluded(r) {
+  try {
+    // the repository's own exclude file, wherever its git dir is (a worktree or submodule keeps it elsewhere)
+    const rel = sh(r, 'rev-parse', '--git-path', 'info/exclude');
+    if (!rel) return;
+    const f = resolve(r, rel);
+    // the record dirs + the logbook's root ledger cache (events.jsonl). Rewrite the block to
+    // the CURRENT set rather than bail on presence, so a grown set retrofits existing repos.
+    const WANT = '# >>> sawbuck >>>\n.sawbuck/\n.promptwheel/*\n!.promptwheel/packs/\nevents.jsonl\nannotations.jsonl\nannotation-reviews.jsonl\ndecision-cards.jsonl\nLOGBOOK.md\nJOURNEY.md\n.claude/settings.local.json\n# <<< sawbuck <<<\n';
+    const body = existsSync(f) ? readFileSync(f, 'utf8') : '';
+    const stripped = body.replace(/# >>> sawbuck >>>[\s\S]*?# <<< sawbuck <<<\n?/g, '');
+    const next = (stripped && !stripped.endsWith('\n') ? stripped + '\n' : stripped) + WANT;
+    if (next === body) return;
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, next);
+  } catch {}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sawbuck",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "description": "Sign your agent to a contract: a deterministic, zero-LLM check re-proves each win from the agent's source edits alone, so a test that went green by editing the test, grader, or config is sent back. For Claude Code, with Codex support in beta.",
   "type": "module",
   "license": "Apache-2.0",
@@ -39,6 +39,7 @@
   "files": [
     "sawbuck.mjs",
     "rewrites.mjs",
+    "exclude.mjs",
     "contract-cmd.mjs",
     "bins.mjs",
     "contract.mjs",

package/sawbuck-hook.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { ensureExcluded } from './exclude.mjs';
 // sawbuck-hook.mjs: the Sawbuck Claude Code Stop-hook entry.
 // Each turn: if a new commit landed, run reflect on it; then render the dispatch
 // on a fresh catch OR every N turns (config). State in .sawbuck/state.json.
@@ -202,20 +203,3 @@ saveState();
 // dirties the worktree, including under `attach --user`, which is global and cannot
 // set this up per-repo at attach time. Idempotent; markers match the CLI's so a
 // per-repo `detach` removes them.
-function ensureExcluded(r) {
-  try {
-    // the repository's own exclude file, wherever its git dir is (a worktree or submodule keeps it elsewhere)
-    const rel = sh(r, 'rev-parse', '--git-path', 'info/exclude');
-    if (!rel) return;
-    const f = resolve(r, rel);
-    // the record dirs + the logbook's root ledger cache (events.jsonl). Rewrite the block to
-    // the CURRENT set rather than bail on presence, so a grown set retrofits existing repos.
-    const WANT = '# >>> sawbuck >>>\n.sawbuck/\n.promptwheel/*\n!.promptwheel/packs/\nevents.jsonl\nannotations.jsonl\nannotation-reviews.jsonl\ndecision-cards.jsonl\nLOGBOOK.md\nJOURNEY.md\n.claude/settings.local.json\n# <<< sawbuck <<<\n';
-    const body = existsSync(f) ? readFileSync(f, 'utf8') : '';
-    const stripped = body.replace(/# >>> sawbuck >>>[\s\S]*?# <<< sawbuck <<<\n?/g, '');
-    const next = (stripped && !stripped.endsWith('\n') ? stripped + '\n' : stripped) + WANT;
-    if (next === body) return;
-    mkdirSync(dirname(f), { recursive: true });
-    writeFileSync(f, next);
-  } catch {}
-}

package/sawbuck.mjs

@@ -14,6 +14,7 @@
 
 import { execFileSync } from 'node:child_process';
 import { erasedBlock } from './rewrites.mjs';
+import { ensureExcluded } from './exclude.mjs';
 import { readFileSync, writeFileSync, existsSync, chmodSync, mkdirSync, unlinkSync, rmdirSync, rmSync, readdirSync } from 'node:fs';
 import { basename, join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -244,6 +245,7 @@ switch (cmd) {
     if (flags.has('--hook') && !process.stdin.isTTY) { try { hookEvent = String(JSON.parse(readFileSync(0, 'utf8') || '{}').hook_event_name || ''); } catch {} }
     if (hookEvent === 'UserPromptSubmit' && top) {
       try {
+        ensureExcluded(repo);   // before the first write: under user-level hooks nothing else has done it yet
         const stDir = join(repo, '.sawbuck'); const stPath = join(stDir, 'state.json');
         let st = {}; try { st = JSON.parse(readFileSync(stPath, 'utf8')); } catch {}
         const now = new Date().toISOString();