trackfw 6.5.0 → 6.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackfw",
-  "version": "6.5.0",
+  "version": "6.5.1",
   "description": "Governance CLI for AI-native software delivery and AI coding agents. Enforces traceability: ADR → REQ → ROADMAP → kanban. Native support for Codex, Claude Code, Gemini CLI, Cursor, Copilot, Windsurf, Amazon Q, OpenCode, and Kiro.",
   "keywords": [
     "cli",

package/src/commands/update-harness.js

@@ -6,7 +6,7 @@ const path = require('path')
 const identityStore = require('../identity')
 const { catalog, buildPlans, IntegrationManager, globalGroupPath } = require('../integrations')
 const { tildeify, validateTargets, buildDocument, humanReport, silenceConsole } = require('../lib/update-engine')
-const { mergeClaudeHookArray, mergeSimpleCommandArray, mergeCopilotHookArray } = require('../generators/hooks')
+const { mergeClaudeHookArray, mergeSimpleCommandArray, mergeCopilotHookArray, generateGlobalCredentialGuardScript } = require('../generators/hooks')
 
 // `trackfw update harness` is the global counterpart to `trackfw update` —
 // see docs/cli-parity.md, "`trackfw update` vs `trackfw update harness`".
@@ -581,6 +581,19 @@ function run(options) {
   const dryRun = Boolean(options.dryRun)
   const installMissing = Boolean(options.installMissing)
 
+  // The per-CLI *-credential-guard targets below only wire hook entries that
+  // point at ~/.trackfw/scripts/trackfw-credential-guard.sh — none of them
+  // write the script itself (ADR-2026-08-06, decision #2/#3). Without this
+  // call the wiring is installed but every hook invocation fails with
+  // "No such file or directory" because the script never exists.
+  if (!dryRun) {
+    if (options.json) {
+      silenceConsole(() => generateGlobalCredentialGuardScript(homeRoot))
+    } else {
+      generateGlobalCredentialGuardScript(homeRoot)
+    }
+  }
+
   // Identidade resolvida do disco antes de buildPlans — pular esta etapa
   // reverteria silenciosamente os nomes customizados para os defaults
   // neutros (mesma justificativa de npm/src/integrations/index.js:execute).

package/src/generators/codex.js

@@ -1,10 +1,5 @@
 'use strict'
 
-const fs = require('fs')
-const path = require('path')
-const { injectCodexHooks } = require('./hooks')
-const { injectRulesForTool } = require('./init')
-
 const skills = {
   'trackfw-governance': `---
 name: trackfw-governance
@@ -81,23 +76,4 @@ Review the branch as an owner. Return findings first, ordered by severity, with
 `,
 }
 
-function installCodex(cwd) {
-  const root = cwd || process.cwd()
-  const { execute } = require('../integrations')
-  execute('agents', 'install', { targets: ['codex'], scope: 'project' }, { projectRoot: root })
-  execute('skills', 'install', { targets: ['codex'], scope: 'project' }, { projectRoot: root })
-  injectRulesForTool('codex', root)
-
-  const configPath = path.join(root, '.codex', 'config.toml')
-  fs.mkdirSync(path.dirname(configPath), { recursive: true })
-  let config = fs.existsSync(configPath) ? fs.readFileSync(configPath, 'utf8') : ''
-  if (!/^\[agents\]\s*$/m.test(config)) {
-    config = config.replace(/\s*$/, '') + '\n\n[agents]\nmax_threads = 6\nmax_depth = 1\n'
-    fs.writeFileSync(configPath, config, 'utf8')
-  }
-
-  injectCodexHooks(root)
-  console.log('  ✓ Codex: AGENTS.md, skills, custom agents and hooks')
-}
-
-module.exports = { installCodex, legacyCodexFixtures: { skills, agents } }
+module.exports = { legacyCodexFixtures: { skills, agents } }