xtrm-tools 2.4.2 → 2.4.3

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xtrm-cli",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "Claude Code tools installer (skills, hooks, MCP servers)",
   "main": "./dist/index.js",
   "type": "module",

package/hooks/beads-claim-sync.mjs

@@ -197,20 +197,25 @@ function main() {
     }
   }
 
-  // Auto-clear: bd close <id> — remove the kv claim so commit gate unblocks
+  // On bd close: mark as closed-this-session for memory gate (don't clear claim yet)
+  // Memory gate will clear the claim after user acknowledges memory prompt
   if (/\bbd\s+close\b/.test(command) && commandSucceeded(input)) {
-    const result = spawnSync('bd', ['kv', 'clear', `claimed:${sessionId}`], {
-      cwd,
-      stdio: ['pipe', 'pipe', 'pipe'],
-      timeout: 5000,
-    });
-
-    if (result.status === 0) {
-      process.stdout.write(JSON.stringify({
-        additionalContext: `\n🔓 **Beads**: Session claim cleared. Ready to commit.`,
-      }));
-      process.stdout.write('\n');
+    const match = command.match(/\bbd\s+close\s+(\S+)/);
+    const closedIssueId = match?.[1];
+    
+    // Mark this issue as closed this session (memory gate reads this)
+    if (closedIssueId) {
+      spawnSync('bd', ['kv', 'set', `closed-this-session:${sessionId}`, closedIssueId], {
+        cwd,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        timeout: 5000,
+      });
     }
+
+    process.stdout.write(JSON.stringify({
+      additionalContext: `\n🔓 **Beads**: Issue closed. Memory gate will prompt on session end.`,
+    }));
+    process.stdout.write('\n');
     process.exit(0);
   }
 

package/hooks/beads-memory-gate.mjs

@@ -11,7 +11,7 @@ import { execSync } from 'node:child_process';
 import { existsSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { readHookInput } from './beads-gate-core.mjs';
-import { resolveCwd, isBeadsProject, getSessionClaim } from './beads-gate-utils.mjs';
+import { resolveCwd, isBeadsProject, getSessionClaim, clearSessionClaim } from './beads-gate-utils.mjs';
 import { memoryPromptMessage } from './beads-gate-messages.mjs';
 
 const input = readHookInput();
@@ -20,35 +20,43 @@ if (!input) process.exit(0);
 const cwd = resolveCwd(input);
 if (!cwd || !isBeadsProject(cwd)) process.exit(0);
 
+const sessionId = input.session_id ?? null;
+if (!sessionId) process.exit(0);
+
 // Agent signals evaluation complete by touching this marker, then stops again
 const marker = join(cwd, '.beads', '.memory-gate-done');
 if (existsSync(marker)) {
   try { unlinkSync(marker); } catch { /* ignore */ }
+  // Clear the claim and closed-this-session marker
+  clearSessionClaim(sessionId, cwd);
+  try {
+    execSync(`bd kv clear "closed-this-session:${sessionId}"`, {
+      cwd,
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 5000,
+    });
+  } catch { /* ignore */ }
   process.exit(0);
 }
 
-// Only fire if this session had an active claim that is now closed
-const sessionId = input.session_id ?? null;
-if (!sessionId) process.exit(0);
-
-const claimId = getSessionClaim(sessionId, cwd);
-if (!claimId) process.exit(0); // no claim this session → no work to persist
-
-// Check if the claimed issue was closed this session
-let claimClosed = false;
+// Check if an issue was closed this session (set by beads-claim-sync on bd close)
+let closedIssueId = null;
 try {
-  const out = execSync('bd list --status=closed', {
+  closedIssueId = execSync(`bd kv get "closed-this-session:${sessionId}"`, {
     encoding: 'utf8',
     cwd,
     stdio: ['pipe', 'pipe', 'pipe'],
-    timeout: 8000,
-  });
-  claimClosed = out.includes(claimId);
-} catch {
+    timeout: 5000,
+  }).trim();
+} catch (err) {
+  if (err.status === 1) {
+    // No closed-this-session marker → nothing to prompt about
+    process.exit(0);
+  }
   process.exit(0); // fail open
 }
 
-if (!claimClosed) process.exit(0);
+if (!closedIssueId) process.exit(0);
 
 process.stderr.write(memoryPromptMessage());
 process.exit(2);

package/hooks/guard-rules.mjs

@@ -46,6 +46,7 @@ export const DANGEROUS_BASH_PATTERNS = [
 ];
 
 export const SAFE_BASH_PREFIXES = [
+  // Git read-only
   'git status',
   'git log',
   'git diff',
@@ -60,10 +61,40 @@ export const SAFE_BASH_PREFIXES = [
   'git worktree',
   'git checkout -b',
   'git switch -c',
+  // Tools
   'gh',
   'bd',
-  'touch .beads/',
   'npx gitnexus',
+  // Read-only filesystem
+  'cat',
+  'ls',
+  'head',
+  'tail',
+  'pwd',
+  'which',
+  'type',
+  'env',
+  'printenv',
+  'find',
+  'grep',
+  'rg',
+  'fd',
+  'wc',
+  'sort',
+  'uniq',
+  'cut',
+  'awk',
+  'jq',
+  'yq',
+  'bat',
+  'less',
+  'more',
+  'file',
+  'stat',
+  'du',
+  'tree',
+  // Allowed writes (specific paths)
+  'touch .beads/',
 ];
 
 export const NATIVE_TEAM_TOOLS = [

package/hooks/main-guard.mjs

@@ -5,7 +5,8 @@
 // Installed by: xtrm install
 
 import { execSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { WRITE_TOOLS, SAFE_BASH_PREFIXES } from './guard-rules.mjs';
 
 let branch = '';
@@ -35,6 +36,7 @@ try {
 
 const tool = input.tool_name ?? '';
 const hookEventName = input.hook_event_name ?? 'PreToolUse';
+const cwd = input.cwd || process.cwd();
 
 function deny(reason) {
   process.stdout.write(JSON.stringify({
@@ -45,7 +47,23 @@ function deny(reason) {
   process.exit(0);
 }
 
+// Check for existing worktree/session state
+function getSessionState(cwd) {
+  const statePath = join(cwd, '.xtrm-session-state.json');
+  if (!existsSync(statePath)) return null;
+  try {
+    return JSON.parse(readFileSync(statePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
 if (WRITE_TOOLS.includes(tool)) {
+  const state = getSessionState(cwd);
+  if (state?.worktreePath) {
+    deny(`⛔ On '${branch}' — worktree already created.\n`
+      + `  cd ${state.worktreePath}\n`);
+  }
   deny(`⛔ On '${branch}' — start on a feature branch and claim an issue.\n`
     + '  git checkout -b feature/<name>\n'
     + '  bd update <id> --claim\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xtrm-tools",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "Claude Code tools installer (skills, hooks, MCP servers)",
   "license": "MIT",
   "type": "module",