voidforge-build 23.21.0 → 23.22.0

package/dist/CHANGELOG.md

@@ -6,6 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ---
 
+## [23.22.0] - 2026-06-24
+
+### `update` now auto-activates `/contextmeter` (matches `init`)
+
+- **Fixed** — `npx voidforge-build update` now wires the `/contextmeter` status line + `UserPromptSubmit` awareness hook into `.claude/settings.json`, the same default-on way `init` does. Previously `update` copied `scripts/statusline/` but left the meter inactive until you ran `/contextmeter` by hand. `mergeStatuslineSettings` is now shared by `init` and `update`; it stays idempotent and **non-clobbering** — never overwrites a project's own `statusLine`, never duplicates the awareness hook. `--dry-run` / diff now reports the pending `.claude/settings.json` change honestly (reading the snippet from the source so it's accurate even before the scripts are copied). +3 updater tests (suite 1420→1423).
+
+Both packages bumped in lockstep (version-consistency gate). Dep `^23.21.0` → `^23.22.0`.
+
 ## [23.21.0] - 2026-06-24
 
 ### Triaged field reports #382 / #383 / #384 → `/seal`-hardening + DevOps/QA/orchestration fixes + a pattern-distribution gap

package/dist/VERSION.md

@@ -1,6 +1,6 @@
 # Version
 
-**Current:** 23.21.0
+**Current:** 23.22.0
 
 ## Versioning Scheme
 
@@ -14,6 +14,7 @@ This project uses [Semantic Versioning](https://semver.org/):
 
 | Version | Date | Summary |
 |---------|------|---------|
+| 23.22.0 | 2026-06-24 | **`update` now auto-activates `/contextmeter` (matches `init`).** `npx voidforge-build update` wires the context-meter status line + `UserPromptSubmit` awareness hook into `.claude/settings.json` the same default-on way `init` does — previously `update` copied `scripts/statusline/` but left the meter inactive until a manual `/contextmeter` run. `mergeStatuslineSettings` is now shared by init + update, idempotent + non-clobbering (never overwrites a project's own `statusLine`, never duplicates the hook); `--dry-run` reports the pending `.claude/settings.json` change. +3 updater tests (1420→1423). Dep `^23.21.0` → `^23.22.0`. |
 | 23.21.0 | 2026-06-24 | **Triaged field reports #382 / #383 / #384 → `/seal`-hardening + DevOps/QA/orchestration fixes + a pattern-distribution gap.** **#384:** release Step 0 unrelated/pre-existing-change detection (`/git`, `/seal`, `RELEASE_MANAGER.md`) — split session-authored vs out-of-scope changes, dependency-manifest scrutiny, never `git add -A` (the `vercel` near-miss, mechanized); creation-time native-collision gate (`BUILD_PROTOCOL.md`, `NATIVE_CAPABILITIES.md`) — check a new command's name + add its row at creation, not release re-audit; `bypass.sh` stale-pointer self-repair via `CLAUDE_CODE_SESSION_ID` (repoints a dead-session pointer on the first try, no re-run; +4 tests, gate 27→31). **#382:** DevOps ACL-traverse enumeration + post-lock prod-FE 200 check; new `egress-sandbox.sh` pattern (`systemd-run --uid/--gid`, uid-independent egress); SUB_AGENTS spend ceiling reserves in-flight child budget; QA coverage-fidelity honesty + per-lane ledger; headless-OAuth bootstrap note. **Distribution:** `prepack.sh`/`copy-assets.sh` now ship every `docs/patterns/` file regardless of extension (`.sh`/`.py`/`.conf` were silently dropped — LRN-11 gap). #383 closed as already-shipped. Build clean, suite 1420. Dep `^23.20.0` → `^23.21.0`. |
 | 23.20.0 | 2026-06-23 | **Triaged 12 upstream field reports (#364–#378) → methodology hardening, + `/seal` and `/contextmeter`.** Applied every accepted fix across ~41 method docs / agents / patterns / commands (throughput/scale gates, ADR concurrency verification, deny-list discipline, runtime-path tracers, render-gate coverage, OAuth/external-claim verification, HTTP two-principal isolation, dall-e→gpt-image-1 currency, `/debrief` gate-gap docs) + 2 new patterns (`post-deploy-probe.sh`, `exclusion-set-invariant.md`); implemented the two wizard reports — non-destructive CLAUDE.md `update` merge (#368) + legacy-marker detection (#369). **New `/seal`** — session closeout (git → debrief → vault → handoff). **New `/contextmeter`** — context-budget meter + `UserPromptSubmit` awareness hook, default-on (warn 80% / crit 92%), `scripts/statusline/` wired through all four distribution paths + npm `files`. Build clean, suite 1392→1420. Dep `^23.19.0` → `^23.20.0`. |
 | 23.19.0 | 2026-06-13 | **Gauntlet acceptance test → 14 fixes (the ADR-067 re-platform, validated by running it on itself).** Ran the new `gauntlet.workflow.js` live on the v23.13–v23.18 platform code (10-agent Surfer roster → 347 agents → 99 distinct claims → 66 confirmed + 24 crossfire, 0 Critical) and fixed the 3-lens-confirmed findings. **Gate (security):** `_paths.sh` reap was missing `-mindepth 1` → could `rm -rf` the entire `sessions/` tree (every live roster/bypass); the reaper now refreshes `$SESSION_DIR` mtime on activity + threshold raised above the TTL, closing the documented reap-vs-fresh-roster/bypass race; `shasum`→`sha256sum` fallback (gate silently broke on Alpine); `bypass.sh` run before the first hook fire now records a repo-scoped *pending* bypass that `check.sh` promotes (was a silent no-op). **Workflows:** strike no longer re-runs the same ≤5-agent roster twice; crossfire `survives:true+REFUTED` verdicts no longer vanish into no bucket (logged in `crossfireRefutedLog`); dedup keeps the **highest** severity + `raisedBy` (was first-write-wins); guarded `JSON.parse(args)`; undefined-domain prompt guard. **Distribution:** `npx voidforge-build init` now copies `.claude/workflows/` + `AGENT_CLASSIFICATION.md`; `update` now propagates `.claude/workflows` + `scripts/surfer-gate` (both were stranded). **Validation:** new `scripts/validate-workflows.sh` (wraps the runtime shape, then `node --check`) wired into `pretest` — corrects the false "scripts pass `node --check`" claim and gates syntax errors from shipping. **Docs:** `WORKFLOWS.md` example `agentType: a.id`→`a.name` + new gotchas; stale `/tmp/voidforge-*` paths fixed in gate README + CLAUDE.md (ADR-060). **CI:** `recover-partial` derives the version from `package.json` not `github.ref_name` (broke on dispatch); Playwright cache key off the committed manifests not the regenerated lockfile. Gate suite 23→27, full suite 1390→1392. Deferred (field-report candidates): concurrent same-repo pointer collision, `workflow_dispatch` branch guard. Dep `^23.18.0` → `^23.19.0`. |

package/dist/wizard/lib/project-init.d.ts

@@ -21,4 +21,21 @@ export interface ProjectResult {
     markerId: string;
     filesCreated: number;
 }
+/**
+ * Wire the /contextmeter status line + awareness hook into settings.json (default-on).
+ * Mirrors mergeSettingsHook: set `statusLine` only when the project doesn't already have
+ * one (never clobber a user's), and append the UserPromptSubmit awareness hook unless an
+ * equivalent is already present (idempotent). Defaults (warn 80 / crit 92) live in the
+ * scripts, so the wired commands carry no env prefix.
+ *
+ * Shared by `init` (copyMethodology) and `update` (applyUpdate) so `update` auto-activates
+ * the meter the same way `init` does (#384 follow-up). Returns `true` when it makes — or,
+ * under `{ dryRun: true }`, WOULD make — a change, so the updater can report the pending
+ * settings edit and decide `applied`. `snippetDir` lets the dry-run read the snippet from
+ * the methodology SOURCE before the scripts have been copied into the project.
+ */
+export declare function mergeStatuslineSettings(projectDir: string, opts?: {
+    dryRun?: boolean;
+    snippetDir?: string;
+}): Promise<boolean>;
 export declare function createProject(config: ProjectConfig): Promise<ProjectResult>;

package/dist/wizard/lib/project-init.js

@@ -206,17 +206,30 @@ async function mergeSettingsHook(projectDir) {
  * one (never clobber a user's), and append the UserPromptSubmit awareness hook unless an
  * equivalent is already present (idempotent). Defaults (warn 80 / crit 92) live in the
  * scripts, so the wired commands carry no env prefix.
+ *
+ * Shared by `init` (copyMethodology) and `update` (applyUpdate) so `update` auto-activates
+ * the meter the same way `init` does (#384 follow-up). Returns `true` when it makes — or,
+ * under `{ dryRun: true }`, WOULD make — a change, so the updater can report the pending
+ * settings edit and decide `applied`. `snippetDir` lets the dry-run read the snippet from
+ * the methodology SOURCE before the scripts have been copied into the project.
  */
-async function mergeStatuslineSettings(projectDir) {
-    const snippetPath = join(projectDir, 'scripts', 'statusline', 'settings-snippet.json');
+export async function mergeStatuslineSettings(projectDir, opts = {}) {
+    const snippetDir = opts.snippetDir ?? join(projectDir, 'scripts', 'statusline');
+    const snippetPath = join(snippetDir, 'settings-snippet.json');
     const settingsPath = join(projectDir, '.claude', 'settings.json');
     if (!existsSync(snippetPath))
-        return;
-    const snippet = JSON.parse(await readFile(snippetPath, 'utf-8'));
+        return false;
+    let snippet;
+    try {
+        snippet = JSON.parse(await readFile(snippetPath, 'utf-8'));
+    }
+    catch {
+        return false;
+    }
     const snippetStatusLine = snippet?.statusLine;
     const snippetUserPrompt = (snippet?.hooks?.UserPromptSubmit ?? []);
     if (!snippetStatusLine && snippetUserPrompt.length === 0)
-        return;
+        return false;
     let settings = {};
     if (existsSync(settingsPath)) {
         try {
@@ -224,15 +237,15 @@ async function mergeStatuslineSettings(projectDir) {
         }
         catch {
             // Existing settings.json is unreadable — leave it alone.
-            return;
+            return false;
         }
     }
-    else {
-        await mkdir(join(projectDir, '.claude'), { recursive: true });
-    }
+    let changed = false;
     // statusLine: never clobber a project's existing one.
     if (snippetStatusLine && !settings.statusLine) {
-        settings.statusLine = snippetStatusLine;
+        if (!opts.dryRun)
+            settings.statusLine = snippetStatusLine;
+        changed = true;
     }
     // UserPromptSubmit: append the awareness hook unless an equivalent is already present.
     const existingHooks = (settings.hooks ?? {});
@@ -242,12 +255,19 @@ async function mergeStatuslineSettings(projectDir) {
         return hooks.some((h) => typeof h?.command === 'string' && h.command.includes('context-awareness-hook'));
     });
     if (!alreadyHasMeter && snippetUserPrompt.length > 0) {
-        settings.hooks = {
-            ...existingHooks,
-            UserPromptSubmit: [...existingUserPrompt, ...snippetUserPrompt],
-        };
+        if (!opts.dryRun) {
+            settings.hooks = {
+                ...existingHooks,
+                UserPromptSubmit: [...existingUserPrompt, ...snippetUserPrompt],
+            };
+        }
+        changed = true;
     }
-    await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
+    if (changed && !opts.dryRun) {
+        await mkdir(join(projectDir, '.claude'), { recursive: true });
+        await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
+    }
+    return changed;
 }
 // ── Identity Injection ───────────────────────────────────
 async function injectIdentity(projectDir, config) {

package/dist/wizard/lib/updater.js

@@ -8,6 +8,7 @@ import { join } from 'node:path';
 import { execSync } from 'node:child_process';
 import { readMarker, writeMarker, DEFAULT_CLAUDE_MD_STRATEGY } from './marker.js';
 import { planClaudeMdUpdate, UPSTREAM_SUFFIX } from './claude-md-strategy.js';
+import { mergeStatuslineSettings } from './project-init.js';
 /**
  * Decide which `update` mode the given argv selects. Pure — no I/O, no exit.
  *
@@ -103,8 +104,9 @@ export async function diffMethodology(projectDir) {
         { src: 'docs/patterns', dest: 'docs/patterns' },
         { src: 'scripts/thumper', dest: 'scripts/thumper' },
         { src: 'scripts/surfer-gate', dest: 'scripts/surfer-gate' },
-        // Context-meter status line + awareness hook (/contextmeter). Scripts propagate on
-        // update; activation (statusLine + UserPromptSubmit hook in settings.json) stays opt-in.
+        // Context-meter status line + awareness hook (/contextmeter). Scripts propagate here;
+        // activation (statusLine + UserPromptSubmit hook in settings.json) is wired below the
+        // same way `init` does it, so `update` auto-activates the meter too (#384 follow-up).
         { src: 'scripts/statusline', dest: 'scripts/statusline' },
     ];
     // CLAUDE.md is handled via the non-destructive strategy mechanism (issue #368)
@@ -179,6 +181,22 @@ export async function diffMethodology(projectDir) {
             }
         }
     }
+    // /contextmeter activation (#384 follow-up): `update` now wires the statusLine +
+    // awareness hook into .claude/settings.json the same way `init` does. Report the pending
+    // settings change here so `--dry-run` shows it. The snippet is read from the SOURCE — the
+    // project may not have the statusline scripts yet on this update — and the check is
+    // idempotent + non-clobbering (it returns false once the meter is wired, or when the
+    // project already has its own statusLine).
+    const statuslineNeedsWiring = await mergeStatuslineSettings(projectDir, {
+        dryRun: true,
+        snippetDir: join(sourceRoot, 'scripts', 'statusline'),
+    });
+    if (statuslineNeedsWiring) {
+        const settingsEntry = '.claude/settings.json';
+        if (!plan.modified.includes(settingsEntry) && !plan.added.includes(settingsEntry)) {
+            plan.modified.push(settingsEntry);
+        }
+    }
     return plan;
 }
 // ── Apply Update ─────────────────────────────────────────
@@ -214,13 +232,20 @@ export async function applyUpdate(projectDir) {
             await writeFile(`${claudeMdDestPath}${UPSTREAM_SUFFIX}`, claudeMdPlan.sideFileContent, 'utf-8');
         }
     }
-    // The CLAUDE.md plan entries are handled above — exclude them from the
-    // generic verbatim copy loop so we don't double-write or clobber.
-    const claudeMdEntries = new Set(['CLAUDE.md', `CLAUDE.md${UPSTREAM_SUFFIX}`]);
+    // Skip from the generic verbatim copy loop:
+    //  - CLAUDE.md entries: handled above by the non-destructive strategy.
+    //  - .claude/settings.json: wired below by mergeStatuslineSettings, not copied verbatim
+    //    (the methodology source carries no project settings.json — copying it would throw,
+    //    or in dev clobber the project with the methodology repo's own dogfood settings).
+    const skipVerbatim = new Set([
+        'CLAUDE.md',
+        `CLAUDE.md${UPSTREAM_SUFFIX}`,
+        '.claude/settings.json',
+    ]);
     // Copy added + modified files
     const { mkdir } = await import('node:fs/promises');
     for (const file of [...plan.added, ...plan.modified]) {
-        if (claudeMdEntries.has(file))
+        if (skipVerbatim.has(file))
             continue;
         const srcPath = join(sourceRoot, file);
         const destPath = join(projectDir, file);
@@ -228,6 +253,12 @@ export async function applyUpdate(projectDir) {
         await mkdir(destDir, { recursive: true });
         await cp(srcPath, destPath);
     }
+    // /contextmeter activation (#384 follow-up): wire the statusLine + awareness hook into
+    // .claude/settings.json so `update` matches `init`'s default-on behavior. The scripts
+    // were copied above; this turns the meter on. Idempotent + non-clobbering — it never
+    // overwrites a user's own statusLine and never duplicates the awareness hook, so it is
+    // safe to run on every update.
+    await mergeStatuslineSettings(projectDir);
     // Update marker version
     const marker = await readMarker(projectDir);
     if (marker) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "voidforge-build",
-  "version": "23.21.0",
+  "version": "23.22.0",
   "description": "From nothing, everything. A methodology framework for building with Claude Code.",
   "type": "module",
   "engines": {
@@ -45,7 +45,7 @@
     "@aws-sdk/client-rds": "^3.700.0",
     "@aws-sdk/client-s3": "^3.700.0",
     "@aws-sdk/client-sts": "^3.700.0",
-    "voidforge-build-methodology": "^23.21.0",
+    "voidforge-build-methodology": "^23.22.0",
     "node-pty": "^1.2.0-beta.12",
     "ws": "^8.19.0"
   },