simt-dev 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to this package are recorded here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.1] — 2026-10-11
+
+### A foreign hook on an event this repo does not gate is chained
+
+`0.1.0` chained the wrong set of hooks and is worth replacing rather than
+recommending. It chained on the event *vocabulary* — anything that was not
+`pre-commit` or `pre-push` — when the question worth asking is whether **this
+repository** declares a gate for that event.
+
+The difference is `simt-app`, whose `pre-push` is `git-lfs`. `pre-push` is an
+event this tool gates in general, so `0.1.0` displaced that hook; and because
+`simt-app` declares no `pre-push` gate there was no shim for the event either, so
+git would have found no `pre-push` hook at all. LFS objects would have stopped
+being uploaded, with nothing to notice it — the exact silent failure chaining
+exists to prevent, reached by fixing the wrong half of it.
+
+`0.1.1` asks the manifest. An event the repo declares a gate for is left to
+`gates.commands`, where the hook runs as a gate and its verdict appears in the
+report; every other foreign hook is chained. That also picks up
+`simt-landing`'s Lighthouse pre-push, which declares no gates at all.
+*(ADR-018, as amended)*
+
+Upgrade with `npm i -D simt-dev@0.1.1`, then `simt hooks install --yes`. Any
+repository already routed with `0.1.0` should re-run it: the shims it writes
+will differ where a gated event was previously displaced.
+
 ## [0.1.0] — 2026-10-11
 
 The first release with real contents in it. `1.0.0` was an empty reservation of the name
@@ -100,4 +126,5 @@ never ran `simt hooks install` again will find nothing until the dependency is r
 and `simt hooks install --yes` is re-run. That is a real upgrade step and it is called out
 here rather than discovered.
 
+[0.1.1]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.1.1
 [0.1.0]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.1.0

package/README.md

@@ -23,13 +23,13 @@ Requires **Node >= 22.20.0**.
 
 ```sh
 # pinned, per repository - what CI and a teammate both get
-npm i -D simt-dev@0.1.0
+npm i -D simt-dev@0.1.1
 
 # or globally, if you would rather not add a dependency
-npm i -g simt-dev@0.1.0
+npm i -g simt-dev@0.1.1
 
 # or with no install at all, for a one-off
-npx -y simt-dev@0.1.0 check
+npx -y simt-dev@0.1.1 check
 ```
 
 Pin the version. The tool writes a content digest into the files it generates, and an

package/docs/decisions/ADR-018-an-unset-hooks-path-is-not-an-absent-hook.md

@@ -121,13 +121,23 @@ question, which is why fixing the shared one changed nothing visible.
    hook is not there at all, the shim refuses and names the path — a hook that
    silently stops running is the exact outcome this ruling exists to prevent.
 
-   A gate-type foreign hook is deliberately **not** chained. `pre-commit` and
-   `pre-push` are events this tool gates, so the hook belongs in the manifest under
-   `gates.commands` and its verdict belongs in the gate report. Chaining it would
-   run it *after* the gates passed, outside anything the author sees. The install
-   note now says which of the two happened, because "stopped running" was wrong
-   about a hook that was carried across and would have pushed an operator to restore
-   a hook that was already running for them.
+   A gate-type foreign hook is deliberately **not** chained — *when this repository
+   declares a gate for that event*. The dispatcher replaces the hook there by design, the
+   hook's real place is `gates.commands`, and its verdict belongs in the gate report next
+   to the others. Chaining it would run it *after* the gates had already passed, outside
+   anything the author sees.
+
+   "Does this tool gate it" is a fact about the manifest, not about the event vocabulary,
+   and reading it the second way cost `simt-app` its `pre-push`. That hook is git-lfs.
+   `pre-push` is an event this tool gates *in general*, so a vocabulary check displaced it
+   — and because `simt-app` declares no `pre-push` gate there is no shim for that event
+   either, so git would have found no `pre-push` hook at all. LFS objects would have
+   stopped being uploaded, with nothing to notice it: the same silent failure this ruling
+   exists to prevent, reached by fixing the wrong half of it. The test asks the manifest.
+
+   The install note says which of the two happened, because "stopped running" was wrong
+   about a carried hook and would have pushed an operator to restore a hook that was
+   already running for them.
 
 ## Consequences
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "simt-dev",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Shared agent rules, skills and git hooks for a repository: one command adopts a repo, and every gate it declares is probed before it is written.",
   "license": "Apache-2.0",
   "author": "Said Elimam",
@@ -39,7 +39,5 @@
   "scripts": {
     "test": "node --test test/*.test.mjs",
     "lint": "node bin/simt-dev.mjs doctor"
-  },
-  "dependencies": {},
-  "devDependencies": {}
-}
+  }
+}

package/src/commands/hooks.mjs

@@ -169,19 +169,33 @@ async function installHooks(root, flags) {
   // stop running - and they stop running silently, which is why they are planned here
   // rather than left to the operator to notice (ADR-018, as amended).
   //
-  // A gate-type foreign hook is deliberately NOT chained: it belongs in the manifest
-  // as a declared command, so the dispatcher runs it and its verdict is visible in the
-  // gate output. Chaining it would run it after a gate passed, outside the report.
+  // "Does not gate" is a fact about THIS repository: `gateCount` asks what its manifest
+  // declares for that event, so an event outside the known vocabulary (post-commit) and
+  // an event the repo simply leaves empty (a pre-push with no gates) are both chained,
+  // while an event the repo does gate is left to the manifest's gates.commands - there
+  // the hook runs as a gate and its verdict appears in the report beside the others,
+  // rather than after the gates passed where an author cannot see it.
+  //
+  // Keying this on the event vocabulary instead of on the manifest cost simt-app its
+  // git-lfs hook: pre-push is a gated event in general, but this repo declares no
+  // pre-push gate, so nothing replaces its hook and routing would have dropped it.
   const chained = [
     // Already chained by an earlier install, read back off disk: re-rendered from the
     // file's own contents so the bytes cannot drift on a second run.
     ...(await Promise.all(
       state.chained.map(async (c) => ({ event: c.event, target: await relativeTarget(root, c.target) })),
     )),
-    // Newly found foreign hooks on events this tool does not gate.
+    // Foreign hooks on events THIS repo has no gate for.
+    //
+    // Per repository, not per event vocabulary - and the difference is not academic.
+    // simt-app declares no pre-push gate, and its pre-push is git-lfs: routing without a
+    // shim for that event means git finds no pre-push hook at all and LFS objects stop
+    // being uploaded, silently, with nothing to notice it. An event this repo gates is
+    // different: the dispatcher replaces the hook there by design, and the hook's real
+    // place is gates.commands.
     ...(await Promise.all(
       state.foreign
-        .filter((f) => !EVENTS.includes(f.event))
+        .filter((f) => gateCount(manifest, f.event) === 0)
         .map(async (f) => ({ event: f.event, target: await relativeTarget(root, f.path) })),
     )),
   ].reduce((all, c) => (all.some((x) => x.event === c.event) ? all : [...all, c]), []);