feature-flow-cli 0.1.4__tar.gz → 0.1.6__tar.gz

{feature_flow_cli-0.1.4/feature_flow_cli.egg-info → feature_flow_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: feature-flow-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: A ticket-graph workflow for coding agents: installs the feature-flow skill into a repo
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/hamilton-sky/feature-flow
@@ -53,7 +53,9 @@ uvx feature-flow-cli install /path/to/your/repo --agent all   # or: pipx run fea
 
 The package puts a `feature-flow` command on your PATH with `install`, `status <feature>` and `view <feature>`. It installs the same files, byte for byte, as `install.py` from a clone.
 
-The installer lists what it wrote in `.feature-flow/installed.txt`. Commit those files (`git add --pathspec-from-file=.feature-flow/installed.txt`); until you do, the flow does not count them as uncommitted changes.
+The installer lists what it wrote in `.feature-flow/installed.txt`, with each file's hash in `.feature-flow/installed.sha256`. Commit those files (`git add --pathspec-from-file=.feature-flow/installed.txt`); until you do, the flow does not count them as uncommitted changes. Installing a newer version over an older one updates every file nobody edited since it was installed, and keeps (and names) the ones you changed; `--force` replaces those too.
+
+To keep the install out of git, so only your plans and tickets get committed, install with `--private`. It lists the installed files in `.git/info/exclude`, which git reads like `.gitignore` but never commits, and later installs keep that list up to date. If you already committed the install, it prints the `git rm --cached` command that untracks it and keeps the files. Every clone then needs its own install.
 
 Then, in your repo, in the agent:
 

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/README.md

@@ -34,7 +34,9 @@ uvx feature-flow-cli install /path/to/your/repo --agent all   # or: pipx run fea
 
 The package puts a `feature-flow` command on your PATH with `install`, `status <feature>` and `view <feature>`. It installs the same files, byte for byte, as `install.py` from a clone.
 
-The installer lists what it wrote in `.feature-flow/installed.txt`. Commit those files (`git add --pathspec-from-file=.feature-flow/installed.txt`); until you do, the flow does not count them as uncommitted changes.
+The installer lists what it wrote in `.feature-flow/installed.txt`, with each file's hash in `.feature-flow/installed.sha256`. Commit those files (`git add --pathspec-from-file=.feature-flow/installed.txt`); until you do, the flow does not count them as uncommitted changes. Installing a newer version over an older one updates every file nobody edited since it was installed, and keeps (and names) the ones you changed; `--force` replaces those too.
+
+To keep the install out of git, so only your plans and tickets get committed, install with `--private`. It lists the installed files in `.git/info/exclude`, which git reads like `.gitignore` but never commits, and later installs keep that list up to date. If you already committed the install, it prints the `git rm --cached` command that untracks it and keeps the files. Every clone then needs its own install.
 
 Then, in your repo, in the agent:
 

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/adapters/codex/feature-flow/SKILL.md

@@ -31,7 +31,7 @@ To add tickets to a plan that exists, edit it by hand following the ticket rules
 
 With a plan present, check these before `start`, and stop at the first that fails:
 
-- `git status --porcelain` is empty, apart from untracked Python bytecode (`__pycache__/`, `*.pyc`) and untracked files listed in `.feature-flow/installed.txt`: those are feature-flow's own install, so never stop for them. Suggest committing them (`git add --pathspec-from-file=.feature-flow/installed.txt && git commit -m "chore: install feature-flow"`) and carry on.
+- `git status --porcelain` is empty, apart from untracked Python bytecode (`__pycache__/`, `*.pyc`) and files listed in `.feature-flow/installed.txt` and that list itself: those are feature-flow's own install or upgrade, so never stop for them (`next` still stops if one of them was edited). Suggest committing them (`git add --pathspec-from-file=.feature-flow/installed.txt && git commit -m "chore: install feature-flow"`) and carry on.
 - `python3 scripts/flow-status.py <feature> --check` prints `OK`.
 - `.agents/flow-roles/ticket-builder.md` and `.agents/flow-roles/ticket-reviewer.md` exist. If not, say to run `uvx feature-flow-cli install . --agent codex` in this repo (or `python3 install.py <repo> --agent codex` from a feature-flow clone).
 

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/feature_flow/__init__.py

@@ -1,3 +1,3 @@
 """Feature Flow: a ticket-graph workflow for coding agents."""
 
-__version__ = "0.1.4"
+__version__ = "0.1.6"

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/feature_flow/command.py

@@ -12,7 +12,7 @@ from pathlib import Path
 from feature_flow import __version__, cli, install, status, suggest, view
 
 USAGE = """\
-usage: feature-flow install [target-repo] [--agent claude|codex|all] [--user] [--force] [--dry-run]
+usage: feature-flow install [target-repo] [--agent claude|codex|all] [--user] [--private] [--force] [--dry-run]
        feature-flow status <feature> [--next | --counts | --check | --mermaid [plain] | --json]
        feature-flow view <feature> [--watch] [--no-open] [--out FILE]
        feature-flow reset <feature> [NN]

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/feature_flow/git.py

@@ -1,5 +1,6 @@
 """The few git calls the conductor needs, each one an argument list, never a shell string."""
 
+import hashlib
 import subprocess
 from pathlib import Path
 
@@ -30,17 +31,30 @@ def head():
     return _git("rev-parse", "HEAD").stdout.strip()
 
 
+# the installer's record of what it wrote: the paths, and the sha256 of each as it wrote it
+INSTALLED = Path(".feature-flow") / "installed.txt"
+HASHES = Path(".feature-flow") / "installed.sha256"
+
+
+def _read_lines(path):
+    try:
+        return path.read_text(encoding="utf-8").splitlines()
+    except (OSError, UnicodeDecodeError):
+        return []
+
+
 def changes():
     """Every changed path, untracked files included, as `git status --porcelain` sees them, except
-    the untracked files feature-flow's installer wrote (an install not committed yet is not a change)
-    and untracked Python bytecode, which the flow's own Python runs leave behind."""
-    installed = set()
+    feature-flow's own install: a file still exactly as the installer wrote it, an untracked file it
+    lists without a hash (an install from before it kept hashes), and its two record files, which every
+    install rewrites; and untracked Python bytecode, which the flow's own Python runs leave behind."""
+    listed, hashes = set(), {}
     top = toplevel()
     if top is not None:
-        try:
-            installed = set((top / ".feature-flow" / "installed.txt").read_text(encoding="utf-8").splitlines())
-        except (OSError, UnicodeDecodeError):
-            pass
+        listed = set(_read_lines(top / INSTALLED))
+        for line in _read_lines(top / HASHES):
+            digest, _, name = line.partition("  ")
+            hashes[name] = digest
     entries = _git("status", "--porcelain", "-z", "-uall").stdout.split("\0")
     found = []
     i = 0
@@ -52,12 +66,26 @@ def changes():
         code, path = entry[:2], entry[3:]
         if code[0] in "RC":
             i += 1  # the rename's source path follows
-        if code == "??" and (path in installed or _bytecode(path)):
+        if path in (INSTALLED.as_posix(), HASHES.as_posix()):
+            continue
+        if path in hashes:
+            # only a worktree change: a staged version would ride along in the next commit
+            if (code[0] in " ?" and code[1] != "T" and top is not None and not (top / path).is_symlink()
+                    and _sha256(top / path) == hashes[path]):
+                continue
+        elif code == "??" and (path in listed or _bytecode(path)):
             continue
         found.append(path)
     return found
 
 
+def _sha256(path):
+    try:
+        return hashlib.sha256(path.read_bytes()).hexdigest()
+    except OSError:
+        return None
+
+
 def _bytecode(path):
     return path.endswith(".pyc") or "__pycache__/" in "/" + path
 

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/feature_flow/install.py

@@ -1,8 +1,9 @@
 """The installer, ported from install.sh with the same report and exit codes.
 
-usage: python3 install.py [target-repo] [--agent claude|codex|all] [--user] [--force] [--dry-run]
+usage: python3 install.py [target-repo] [--agent claude|codex|all] [--user] [--private] [--force] [--dry-run]
 copies the feature-flow skill, its roles, scripts and guides into a repo so the flow works there.
-a file that already exists and differs is kept and reported, unless --force is given.
+a file that already exists and differs is kept and reported, unless --force is given or nobody
+edited it since an earlier feature-flow install wrote it (then it is updated).
 nothing is ever deleted. CLAUDE_HOME overrides ~/.claude and AGENTS_HOME overrides ~/.agents for --user.
 
 Files are compared and written as bytes, and the two text transforms (the Codex skill header and
@@ -11,15 +12,18 @@ so the installed tree is the same byte for byte. Files are listed in byte order,
 with LC_ALL=C.
 """
 
+import hashlib
 import os
 import re
 import shutil
 import subprocess
 import sys
 
+from feature_flow.released import RELEASED
+
 # the help text
 USAGE = """\
-usage: python3 install.py [target-repo] [--agent claude|codex|all] [--user] [--force] [--dry-run]
+usage: python3 install.py [target-repo] [--agent claude|codex|all] [--user] [--private] [--force] [--dry-run]
 copies the feature-flow skill, its roles, scripts and guides into a repo so the flow works there.
   --agent claude (default)
     skills  go to <target>/.claude/skills/   (or ~/.claude/skills/ with --user)
@@ -30,7 +34,10 @@ copies the feature-flow skill, its roles, scripts and guides into a repo so the
   --agent all does both.
   scripts go to <target>/scripts/ and guides, roles and the Python package to <target>/.feature-flow/
     (always: the skill and scripts/flow.py read them from the repo)
-a file that already exists and differs is kept and reported, unless --force is given.
+a file that already exists and differs is kept and reported, unless --force is given or it is
+  still exactly what an earlier feature-flow install wrote (then it is updated).
+  --private keeps the install out of git: its paths go into .git/info/exclude, which is never
+    committed, so only the plans and tickets are. Later installs keep that list up to date.
 nothing is ever deleted. CLAUDE_HOME overrides ~/.claude and AGENTS_HOME overrides ~/.agents for --user.
 """
 
@@ -42,6 +49,19 @@ SKILLS = ("feature-flow", "architect-review", "automation-design")
 # the in-repo files an install wrote, one path per line, relative to the target. The conductor does not
 # count them as a dirty tree while they are untracked, and `git add --pathspec-from-file` commits them.
 INSTALLED = ".feature-flow/installed.txt"
+# the sha256 of each of those files as the install wrote it, `<sha256>  <path>` per line. A later install
+# replaces a file that still has its recorded bytes: nobody edited it, so it is not the user's version.
+HASHES = ".feature-flow/installed.sha256"
+# the same record for a --user install, in ~/.claude and ~/.agents, paths relative to that folder
+USER_HASHES = "feature-flow.sha256"
+# the lines a --private install keeps in .git/info/exclude, between these two markers
+EXCLUDE_BEGIN = "# feature-flow install (--private): kept out of git"
+EXCLUDE_END = "# end of feature-flow install"
+
+
+def _sha256(data):
+    return hashlib.sha256(data).hexdigest()
+
 
 # an old skill that runs the ticket script (the bash one or the Python one) or ends a review with a verdict
 LEFTOVER = re.compile(rb"scripts/flow-status\.(?:sh|py)|REVIEW: PASS")
@@ -152,13 +172,14 @@ def _logical_cwd():
 
 
 class Installer:
-    def __init__(self, here, target, agent, user_level, force, dry, out):
+    def __init__(self, here, target, agent, user_level, force, dry, out, private=False):
         self.here = here
         self.target = target
         self.agent = agent
         self.force = force
         self.dry = dry
         self.out = out
+        self.private = private
         if user_level:
             home = os.environ.get("HOME", "")
             self.claude_dir = os.environ.get("CLAUDE_HOME") or home + "/.claude"
@@ -172,7 +193,14 @@ class Installer:
             package = os.path.dirname(os.path.abspath(__file__))
         self.package = package
         self.added = self.updated = self.same = self.kept = 0
-        self.written = []
+        self.written = {}
+        # each folder this installs into, with its hash record; the target's own comes first
+        self.records = [(target, HASHES)]
+        if user_level and agent in ("claude", "all"):
+            self.records.append((self.claude_dir, USER_HASHES))
+        if user_level and agent in ("codex", "all"):
+            self.records.append((self.agents_dir, USER_HASHES))
+        self.recorded = dict((root, self._read_hashes(root + "/" + record)) for root, record in self.records)
 
     def place(self, file, dest, data=None):
         """One file: add it, replace it (--force), leave it alone (same) or keep the user's version.
@@ -181,23 +209,55 @@ class Installer:
         if not os.path.exists(dest):
             self.out("  add     " + dest)
             self.added += 1
-            self.written.append(dest)
+            self.written[dest] = new
             if not self.dry:
                 os.makedirs(os.path.dirname(dest), exist_ok=True)
                 self._copy(file, dest, data)
         elif new is not None and _read(dest) == new:
             self.same += 1
-            self.written.append(dest)
-        elif self.force:
+            self.written[dest] = new
+        elif self.force or self.untouched(dest):
             self.out("  update  " + dest)
             self.updated += 1
-            self.written.append(dest)
+            self.written[dest] = new
             if not self.dry:
                 self._copy(file, dest, data)
         else:
             self.out("  kept    " + dest + " (differs from this version, use --force to replace it)")
             self.kept += 1
 
+    def locate(self, dest):
+        """The install folder dest is in and dest relative to it, or (None, None)."""
+        for root, _ in sorted(self.records, key=lambda r: -len(r[0])):
+            if dest.startswith(root + "/"):
+                return root, dest[len(root) + 1:]
+        return None, None
+
+    @staticmethod
+    def _read_hashes(path):
+        recorded = {}
+        try:
+            with open(path, encoding="utf-8") as f:
+                for line in f:
+                    digest, _, name = line.rstrip("\n").partition("  ")
+                    if name:
+                        recorded[name] = digest
+        except (OSError, UnicodeDecodeError):
+            pass
+        return recorded
+
+    def untouched(self, dest):
+        """dest still holds the bytes an earlier feature-flow install wrote there. Never a symlink or a
+        file with other hard links: writing through it would change the file it shares bytes with."""
+        if os.path.islink(dest) or os.stat(dest).st_nlink > 1:
+            return False
+        old = _read(dest)
+        if old is None:
+            return False
+        digest = _sha256(old)
+        root, rel = self.locate(dest)
+        return digest in RELEASED or self.recorded.get(root, {}).get(rel) == digest
+
     @staticmethod
     def _copy(file, dest, data):
         """cp -p: contents, mode and times."""
@@ -243,21 +303,92 @@ class Installer:
                        role_body(data if data is not None else b""))
 
     def write_installed(self):
-        """Add this run's in-repo files to the list, keeping the earlier runs' files that still exist."""
-        path = self.target + "/" + INSTALLED
+        """Add this run's in-repo files to the list, and every file's hash to its folder's record, keeping
+        the earlier runs' entries for files that still exist. True when the target's list or record changed."""
         names = set()
         try:
-            with open(path, encoding="utf-8") as old:
+            with open(self.target + "/" + INSTALLED, encoding="utf-8") as old:
                 names.update(line.strip() for line in old)
         except OSError:
             pass
-        names = set(n for n in names if n and os.path.isfile(self.target + "/" + n))
-        prefix = self.target + "/"
-        names.update(dest[len(prefix):] for dest in self.written if dest.startswith(prefix))
-        names.add(INSTALLED)
+        hashes = dict((root, dict(self.recorded[root])) for root, _ in self.records)
+        for dest, data in self.written.items():
+            root, rel = self.locate(dest)
+            if root == self.target:
+                names.add(rel)
+            if root is not None and data is not None:
+                hashes[root][rel] = _sha256(data)
+        names.update((INSTALLED, HASHES))
+        names = sorted(n for n in names
+                       if n in (INSTALLED, HASHES) or (n and os.path.isfile(self.target + "/" + n)))
+        changed = self._write(self.target + "/" + INSTALLED, "".join(n + "\n" for n in names))
+        for root, record in self.records:
+            kept = names if root == self.target else sorted(
+                n for n in hashes[root] if os.path.isfile(root + "/" + n))
+            text = "".join("%s  %s\n" % (hashes[root][n], n) for n in kept if n in hashes[root])
+            if self._write(root + "/" + record, text) and root == self.target:
+                changed = True
+        return changed
+
+    @staticmethod
+    def _write(path, text):
+        try:
+            with open(path, encoding="utf-8", newline="") as f:
+                if f.read() == text:
+                    return False
+        except (OSError, UnicodeDecodeError):
+            pass
         os.makedirs(os.path.dirname(path), exist_ok=True)
-        with open(path, "w", encoding="utf-8", newline="\n") as new:
-            new.write("".join(n + "\n" for n in sorted(names)))
+        # a new file moved into place: a link at the path is replaced, never written through
+        tmp = path + ".tmp"
+        with open(tmp, "w", encoding="utf-8", newline="\n") as f:
+            f.write(text)
+        os.replace(tmp, path)
+        return True
+
+    def exclude_file(self):
+        """The repo's .git/info/exclude (a worktree's shared one too), or None outside a git repo."""
+        try:
+            r = subprocess.run(["git", "-C", self.target, "rev-parse", "--git-path", "info/exclude"],
+                               stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, universal_newlines=True)
+        except OSError:
+            return None
+        path = r.stdout.strip()
+        if r.returncode != 0 or not path:
+            return None
+        return os.path.normpath(os.path.join(self.target, path))
+
+    def excluded(self):
+        """An earlier --private install left its block in .git/info/exclude: keep the install private."""
+        path = self.exclude_file()
+        return path is not None and EXCLUDE_BEGIN in _read_text(path).splitlines()
+
+    def write_exclude(self, path):
+        """Put every in-repo file of the install between the markers in .git/info/exclude, keeping the
+        user's own lines. True when the file changed."""
+        try:
+            with open(path, encoding="utf-8") as f:
+                lines = f.read().splitlines()
+        except (OSError, UnicodeDecodeError):
+            lines = []
+        if EXCLUDE_BEGIN in lines and EXCLUDE_END in lines[lines.index(EXCLUDE_BEGIN):]:
+            start = lines.index(EXCLUDE_BEGIN)
+            end = lines.index(EXCLUDE_END, start)
+            del lines[start:end + 1]
+        names = [n.strip() for n in _read_text(self.target + "/" + INSTALLED).splitlines()]
+        block = ["/.feature-flow/"] + ["/" + n for n in names if n and not n.startswith(".feature-flow/")]
+        text = "\n".join(lines + [EXCLUDE_BEGIN] + block + [EXCLUDE_END]) + "\n"
+        return self._write(path, text)
+
+    def tracked_installed(self):
+        """The installed files git already tracks: an exclude line does not untrack them."""
+        try:
+            r = subprocess.run(["git", "-C", self.target, "ls-files", "-z", "--full-name"],
+                               stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, universal_newlines=True)
+        except OSError:
+            return []
+        names = set(_read_text(self.target + "/" + INSTALLED).splitlines())
+        return [n for n in r.stdout.split("\0") if n in names]
 
     def report_leftovers(self, dirs):
         """A skill folder this installer does not own but that drives the flow (it runs the ticket
@@ -294,8 +425,7 @@ class Installer:
         self.copy_tree(here + "/guides", self.target + "/.feature-flow/guides")
         self.copy_tree(here + "/agents", self.target + "/.feature-flow/agents")
         self.copy_tree(self.package, self.target + "/.feature-flow/feature_flow", skip=BUNDLE)
-        if not self.dry:
-            self.write_installed()
+        listed = not self.dry and self.write_installed()
 
         self.out("")
         verb = "would add" if self.dry else "added"
@@ -311,7 +441,17 @@ class Installer:
                 git = 127
             if git != 0:
                 self.out("note: %s is not a git repository, and the flow needs one" % self.target)
-            elif self.added or self.updated:
+            elif self.private or self.excluded():
+                self.private = True
+                exclude = self.exclude_file()
+                if exclude and self.write_exclude(exclude):
+                    self.out("kept out of git: the install is listed in " + os.path.relpath(exclude, self.target)
+                             .replace(os.sep, "/") + ", which is never committed")
+                if self.tracked_installed():
+                    self.out("note: git still tracks the install from before. untrack it, keeping the files: "
+                             "git rm -r -q --cached --ignore-unmatch --pathspec-from-file=%s"
+                             ' && git commit -m "chore: stop tracking feature-flow"' % INSTALLED)
+            elif self.added or self.updated or listed:
                 git_c = ""
                 if os.path.realpath(self.target) != os.path.realpath(os.getcwd()):
                     git_c = '-C "%s" ' % self.target if " " in self.target else "-C %s " % self.target
@@ -326,9 +466,17 @@ class Installer:
         return 0
 
 
+def _read_text(path):
+    data = _read(path)
+    try:
+        return data.decode("utf-8") if data is not None else ""
+    except UnicodeDecodeError:
+        return ""
+
+
 def parse(argv):
     """The options, read in order like the bash case statement. Returns a dict, or None for --help."""
-    opts = {"target": "", "agent": "claude", "user": False, "force": False, "dry": False}
+    opts = {"target": "", "agent": "claude", "user": False, "private": False, "force": False, "dry": False}
     i = 0
     while i < len(argv):
         a = argv[i]
@@ -341,6 +489,8 @@ def parse(argv):
             opts["agent"] = a[len("--agent="):]
         elif a == "--user":
             opts["user"] = True
+        elif a == "--private":
+            opts["private"] = True
         elif a == "--force":
             opts["force"] = True
         elif a == "--dry-run":
@@ -375,7 +525,7 @@ def run(argv, here, out, err):
         return 2
     target = os.path.normpath(os.path.join(_logical_cwd(), target))
     installer = Installer(os.path.abspath(str(here)), target, opts["agent"], opts["user"],
-                          opts["force"], opts["dry"], out)
+                          opts["force"], opts["dry"], out, opts["private"])
     return installer.run()
 
 

feature_flow_cli-0.1.6/feature_flow/released.py

@@ -0,0 +1,90 @@
+"""The sha256 of every file that feature-flow-cli 0.1.0 to 0.1.4 installed (all three --agent
+choices; .feature-flow/installed.txt aside). Those releases kept no record of what they wrote, so an
+install over one of them replaces a file whose bytes are on this list: nobody edited it since. Later
+installs record their own hashes in .feature-flow/installed.sha256, so this list never grows."""
+
+RELEASED = frozenset((
+    "03111666084be6a375a0e7a42784ea8c5aed7a5a1e71e83cf2ad44fd656f758c",
+    "0385988f5d4a23daf13556a391b71bb387a25ab2b7fa8bba81b0276321028e07",
+    "0597a52bee02482ee472218b98ee6c507900df02c4f081ca795b0038eebc21bd",
+    "08419881ab53935e0a739d8ae7fc6e5cdfaeb597394bdd5c11d538a5a8086091",
+    "0b2544121889d10f5b3295700ed49d03940291243edbe6f69b5cc9eb5c2678db",
+    "0fbc776b32836e8050c07cd95d50265a415999f558c00bc7131a8b1c8f8dd893",
+    "116af2cb64dd22b061e7217a7aec96ecc2fa9193905f17154ce73542b8a3a049",
+    "158be4902bdd7a039c9fd844188545c148e289c8ca168a0a93890b9321342252",
+    "1598ed3851313756552c258447b74a7b59aca36365760ce66ecd0695a8614021",
+    "16e75f565e30ac0d4e418d813f9c399928607a26a7c84f4b983bb1e8fc4e30c1",
+    "1bdbe5d780580a9931d123decccdf5c06293b11e3481658dbfe50a8511326b85",
+    "1ee3b01e4c92e9fa9f8124a18fa89ea336562d2597325201ec0595ee431f0c09",
+    "2a3416153494015130e81876ee94f452a9c94848757cff488309ac056048887a",
+    "2a799ddadcfc4744c0837cb0a087f74556cdb88945be93ed8e508a5667c1f65a",
+    "2ae68f7df0e92d59a9e69dbd3da5103da9ab3de9b9a2ab7aec3054c410cb5ad1",
+    "2c6350ef4162ee3d208145821818c4540a99dcf4bb17915f0fdfca8a89e01bfb",
+    "2d2666ff07b3bafa9b257b013a1ef5f889b95c6657cc553f580bc74ef1232038",
+    "2f5b589e2acafc5bfefbcbf68d69bc57c028dc509d4766160762695be532aa9b",
+    "2f94fd1730077974774efa75d49741a6277e9a060041041c023ff9ff4d6129e7",
+    "38901e898c4f78b41527dede20bfca26080de99683b3e5bba0019d87046ae338",
+    "38b2d2b4c45e8c76ecd0381ef0820ca4cc516c4ac1f117b2ec99ac6ce3c2e300",
+    "39d97eb189726b3c92a399dc60e736d12b12a8252d637588c5b2a31fc2020b5f",
+    "3ff57472860da0076ac1d8a8a0537eddd29f3c63989cd5068906e5f31e7abebc",
+    "408779e5a420a8b90cf0422830660f1593efdd9c4999665a1beb0097219c2749",
+    "447f0c9f2eccb2f5313ca913d91d7fb9c336b30fa03b5d534609cd22de040703",
+    "45b62b9d60f88ef8ac8f22f585d662a3004b1dce3875f125b5a1649958511392",
+    "45cc664cb168ea82b3d04d16cd96c4392bcc21741f55749306e69fd8f2a0f68c",
+    "46ad183898dfa8d860480a123049a74c1bae56d364434ddcd51ed955fec02ca1",
+    "4bb17e6f9d9b3c77e858f061b888ab9a7bea9e3ef2cf269230c1c3d42d800a91",
+    "52c8362a637ea80835743fd568bce4c05c591d758608c5b89316391779b0166b",
+    "569951f6d447ae256d1802ab29ac287af6858e38a34879d3f4534d732097babc",
+    "5a2b9d23bbc192412b574d96cc26c09e486173c4ecf3b1d72e4f989f600bbaa9",
+    "5b4611c7d419c54d645189cf3e67630678b10d5300f7a6dbe32f75d87876dbf4",
+    "5e3895c34a7a0a95cd784c3c99beab4e102bc0a84edd76a9e7586007f55df16b",
+    "631fd0f9243caca088bf8ff37a08c1f5e75bcd42589b73a18137936259d211b7",
+    "6981a0e0de889d7296bc680f030adf3e354785424d589548257863ca6ae82835",
+    "69b13a131466af54a172e7255fade246aad706b177fa3601a843af7a873cb226",
+    "6b559ad3ea84b358417700469b7aa0aa48079fc6cddcc9fcbc2dbe312a6ccec8",
+    "71c83d16835bf50ee9e78a4a4183a101a1124d5059390e219b7509c96b70488c",
+    "71d26991a5263aade812bc9aaf90ddbee44b9c61263302fa5fbcf0093f74be6b",
+    "7530aa90149353b607560eb9c16a8ce9be75846f68fb3b71c5a2c9173d21a9b3",
+    "761710d8db4ffcb3c9c1a3d941210fa052569994bc2138e974ad44cc6ffe6ba3",
+    "774116e163377390b58dc779d008825013d4aff023a2c30332f46db53b473edd",
+    "7e42e219a8bb55cad10239ffa290a3d12912350635e8c846c105888dfada5670",
+    "800e3a2518755ca20f64ba8518943a11f60e14c8e0ec77bc7a631b7660968861",
+    "80535d95ae9fb56ddf746240e9ce6fcf6eaac401e0516ac37584b411113b7017",
+    "89522ebb5bf8891a5faab80c86715e3f610808ef588ce0bb261c5ba4bb83c115",
+    "8cfd3af473fa146477117cbc406841c542bc137516951fb801204395b444233b",
+    "9551f7f94fed0f7e1bb6f35dc6826e2eec37ae18f840ac741fbf369c0fb0bfe7",
+    "983395967e1e26bca59cf4da539481f426c3c3d02e67028076cd4d204527ac44",
+    "9892816825e0de4f5a40dbaf2506b30d1b3568d0aeadc6597c4a1fc0fd872225",
+    "9de945fd57f367ae4db739d8a63d45996912f3797450b53f3ad04f8c43f5cbd5",
+    "a0b250ed64f1d38dd9029507a8a34fdbd2bc3aa78a930c439029889f6acfd89f",
+    "a666d3eba10f164f50a5005ef70c19b1d5f33c3d43fdf926ac7a9a6815514366",
+    "a6d0a0b7ba5c5ccedf2a4d27e0b06e61b8e9563e81fdcd7617da9d4bc3506d71",
+    "a7871218beabd7928dc63729cd5141539dc291bb037baa1b9c82e8269c0e272a",
+    "aafd905d9d98879c7b6747aa544542df23f6d565cdcef47f7a207808983900d9",
+    "ae0790f7fca8c996c3844827e9904ee95b2ced3854277bd440faa59213603935",
+    "ae999c50a91a234b4943dff8731d40d30da7d04b2ba4cf13911a6ac6236d2c60",
+    "af9a25625f44a64770d6aebce5882c08dbda89b116a25d430a1b7855b8b0d9cf",
+    "b922951702a7837923fb52820930ca32fc96c13fc1f0a44650ee135828b4aa80",
+    "bc2f066334afbee46bd97168513c36ae129a098179c389c1986b0b7a47f98621",
+    "bd24f9b858bab7411493eb97a2c011d906ec56d7a7efb2c7e116cc308b0e4c55",
+    "bd7a2653a1015b9e42366c21a2dd60d1c4ea3ca07ca0afee9dddf3d36ec7741e",
+    "bda718088ea2b848b000dca2ff78e35795d4400b57ecbc0bfbccdab451245f45",
+    "c0a28ab04d02c5eff6f94ed3cdc543257919adcaaf30ec108cd6692a5319081c",
+    "c2dbc3162f8bd47a15cb0a10e6cade2cefd3f951ea8c75b175957be1cdceb174",
+    "c35e773600d4c3340b5e49eff9cc8eb2682adf7ab8a56599a2ce3fa709c10cbf",
+    "c36d2575c40b7f71abc45a58124e6a18b6f423919b9bc1ec69a1a1ff0095589d",
+    "c3a0196ebb59f110e968173ff40df3778e73e7eded2afe58deea9dc0734a9e20",
+    "cf78e2cfe6e224e3854017787634bffc3e048b48709b767b7ae953e20b707746",
+    "d3a2313826088d95dc0bc2625b0222f98223636eda3a59efeac5838f362e5b2b",
+    "e0a98bc037bfdef778a0d5d14a4d9abc2b23c4c0ea754491cba307e9c0e2169f",
+    "e8194c0aa46b169d8412837f9345c8f32378570b8474a2357c5570080093b7ce",
+    "eb346f05cd6359292749a0915fe8b3412b3f99a493a21b294e763a3da0a80852",
+    "ee7c8f100721d6ad36ad653a0b82c11eab02217f015344bc707c158f32a08c93",
+    "f05d890a79379ee8b89bcef86361acc93ca6b3f7b277500126d058243a60f9f2",
+    "f335488f1e89e63bf2f0588a71feccbfece080ef9dcb5fac15f89868576434f0",
+    "f34612dfc665fccc1a47f041d096877fa8a4d9c00aad832646d9ab6408305bba",
+    "f6352f7ca92571045aa0c7d8ffbe2708f8315c6bd852433e7f32fc8b4af65fdb",
+    "f714136a9c949bcb23b67755a3072d0946ca5a6c0a484f6a42f80c23964e5758",
+    "f799e5372b598cda13cf2b2d8b888c1703fed71a3af2ec2aa802b838a7de39ba",
+    "fded1be6a891c062ad84d14960b47daa0d2424d87ade33922d7f9acfe2b64600",
+))

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6/feature_flow_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: feature-flow-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: A ticket-graph workflow for coding agents: installs the feature-flow skill into a repo
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/hamilton-sky/feature-flow
@@ -53,7 +53,9 @@ uvx feature-flow-cli install /path/to/your/repo --agent all   # or: pipx run fea
 
 The package puts a `feature-flow` command on your PATH with `install`, `status <feature>` and `view <feature>`. It installs the same files, byte for byte, as `install.py` from a clone.
 
-The installer lists what it wrote in `.feature-flow/installed.txt`. Commit those files (`git add --pathspec-from-file=.feature-flow/installed.txt`); until you do, the flow does not count them as uncommitted changes.
+The installer lists what it wrote in `.feature-flow/installed.txt`, with each file's hash in `.feature-flow/installed.sha256`. Commit those files (`git add --pathspec-from-file=.feature-flow/installed.txt`); until you do, the flow does not count them as uncommitted changes. Installing a newer version over an older one updates every file nobody edited since it was installed, and keeps (and names) the ones you changed; `--force` replaces those too.
+
+To keep the install out of git, so only your plans and tickets get committed, install with `--private`. It lists the installed files in `.git/info/exclude`, which git reads like `.gitignore` but never commits, and later installs keep that list up to date. If you already committed the install, it prints the `git rm --cached` command that untracks it and keeps the files. Every clone then needs its own install.
 
 Then, in your repo, in the agent:
 

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/feature_flow_cli.egg-info/SOURCES.txt

@@ -21,6 +21,7 @@ feature_flow/gate.py
 feature_flow/git.py
 feature_flow/install.py
 feature_flow/prompts.py
+feature_flow/released.py
 feature_flow/state.py
 feature_flow/status.py
 feature_flow/suggest.py

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/guides/build.md

@@ -12,7 +12,7 @@ Follow the repo's documented ticket location if it has one. Otherwise they are i
 
 ## Step 2: Pre-flight
 
-Run `git status --porcelain`. Untracked files listed in `.feature-flow/installed.txt` are feature-flow's own install and do not count, and neither does untracked Python bytecode (`__pycache__/`, `*.pyc`).
+Run `git status --porcelain`. Files listed in `.feature-flow/installed.txt`, and that list itself, are feature-flow's own install and do not count, and neither does untracked Python bytecode (`__pycache__/`, `*.pyc`).
 
 - Clean: continue.
 - Dirty, manual: show the files and offer to commit, stash, or continue anyway.

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/install.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""The feature-flow installer. usage: python3 install.py [target-repo] [--agent claude|codex|all] [--user] [--force] [--dry-run]"""
+"""The feature-flow installer. usage: python3 install.py [target-repo] [--agent claude|codex|all] [--user] [--private] [--force] [--dry-run]"""
 import sys
 from pathlib import Path
 

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/install.sh

@@ -1,4 +1,4 @@
 #!/bin/bash
-# usage: bash install.sh [target-repo] [--agent claude|codex|all] [--user] [--force] [--dry-run]
+# usage: bash install.sh [target-repo] [--agent claude|codex|all] [--user] [--private] [--force] [--dry-run]
 # runs the Python installer next to this file; python3 install.py --help says what it does.
 exec python3 "$(dirname "$0")/install.py" "$@"

{feature_flow_cli-0.1.4 → feature_flow_cli-0.1.6}/skills/feature-flow/SKILL.md

@@ -31,7 +31,7 @@ To add tickets to a plan that exists, edit it by hand following the ticket rules
 
 With a plan present, check these before `start`, and stop at the first that fails:
 
-- `git status --porcelain` is empty, apart from untracked Python bytecode (`__pycache__/`, `*.pyc`) and untracked files listed in `.feature-flow/installed.txt`: those are feature-flow's own install, so never stop for them. Suggest committing them (`git add --pathspec-from-file=.feature-flow/installed.txt && git commit -m "chore: install feature-flow"`) and carry on.
+- `git status --porcelain` is empty, apart from untracked Python bytecode (`__pycache__/`, `*.pyc`) and files listed in `.feature-flow/installed.txt` and that list itself: those are feature-flow's own install or upgrade, so never stop for them (`next` still stops if one of them was edited). Suggest committing them (`git add --pathspec-from-file=.feature-flow/installed.txt && git commit -m "chore: install feature-flow"`) and carry on.
 - `python3 scripts/flow-status.py <feature> --check` prints `OK`.
 - `ticket-builder.md` and `ticket-reviewer.md` are in `.claude/agents/`, `~/.claude/agents/`, or `$CLAUDE_HOME/agents/` when `CLAUDE_HOME` is set. If not, say to run `uvx feature-flow-cli install .` in this repo (or `python3 install.py <repo>` from a feature-flow clone).