git-repokit 0.9.11__tar.gz → 0.9.12__tar.gz

{git_repokit-0.9.11/git_repokit.egg-info → git_repokit-0.9.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-repokit
-Version: 0.9.11
+Version: 0.9.12
 Summary: Create standardized Git repositories: language presets, licenses, GitHub setup, and a private notes vault
 Author: Dustin Darcy
 License-Expression: MIT
@@ -157,8 +157,6 @@ git push
 
 `safe-merge` leaves out the private content (`private/`, `CLAUDE.md`, `revisions/`, ...), and the hooks refuse it on a public branch if it ever gets staged. `--github` pushes only the public branches. Other layouts: `simple` (private, dev, main), `gitflow`, `github-flow`, and your own with `--branches` and `--worktrees`; see [Branch strategies](#branch-strategies) below.
 
-> **Known issue in 0.9.11:** this create prints `fatal: ambiguous argument 'private'` once per public branch, and `dev/` and `github/` start with only the README and `.github/`. The loop above still brings the work across. The fix is tracked in [#16](https://github.com/DazzleTools/git-repokit/issues/16).
-
 ### Other common creates
 
 ```bash

{git_repokit-0.9.11 → git_repokit-0.9.12}/README.md

@@ -116,8 +116,6 @@ git push
 
 `safe-merge` leaves out the private content (`private/`, `CLAUDE.md`, `revisions/`, ...), and the hooks refuse it on a public branch if it ever gets staged. `--github` pushes only the public branches. Other layouts: `simple` (private, dev, main), `gitflow`, `github-flow`, and your own with `--branches` and `--worktrees`; see [Branch strategies](#branch-strategies) below.
 
-> **Known issue in 0.9.11:** this create prints `fatal: ambiguous argument 'private'` once per public branch, and `dev/` and `github/` start with only the README and `.github/`. The loop above still brings the work across. The fix is tracked in [#16](https://github.com/DazzleTools/git-repokit/issues/16).
-
 ### Other common creates
 
 ```bash

{git_repokit-0.9.11 → git_repokit-0.9.12/git_repokit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-repokit
-Version: 0.9.11
+Version: 0.9.12
 Summary: Create standardized Git repositories: language presets, licenses, GitHub setup, and a private notes vault
 Author: Dustin Darcy
 License-Expression: MIT
@@ -157,8 +157,6 @@ git push
 
 `safe-merge` leaves out the private content (`private/`, `CLAUDE.md`, `revisions/`, ...), and the hooks refuse it on a public branch if it ever gets staged. `--github` pushes only the public branches. Other layouts: `simple` (private, dev, main), `gitflow`, `github-flow`, and your own with `--branches` and `--worktrees`; see [Branch strategies](#branch-strategies) below.
 
-> **Known issue in 0.9.11:** this create prints `fatal: ambiguous argument 'private'` once per public branch, and `dev/` and `github/` start with only the README and `.github/`. The loop above still brings the work across. The fix is tracked in [#16](https://github.com/DazzleTools/git-repokit/issues/16).
-
 ### Other common creates
 
 ```bash

{git_repokit-0.9.11 → git_repokit-0.9.12}/git_repokit.egg-info/SOURCES.txt

@@ -209,6 +209,7 @@ tests/test_license_cli.py
 tests/test_licenses.py
 tests/test_new_default.py
 tests/test_packaging.py
+tests/test_private_branch_create.py
 tests/test_readme_blocks.py
 tests/test_run_tests_driver.py
 tests/test_template_parity.py

{git_repokit-0.9.11 → git_repokit-0.9.12}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 # PyPI's trusted publisher is registered for this name (DazzleTools/git-repokit,
 # publish.yml, environment pypi); the command stays `repokit`
 name = "git-repokit"
-version = "0.9.11"
+version = "0.9.12"
 description = "Create standardized Git repositories: language presets, licenses, GitHub setup, and a private notes vault"
 readme = "README.md"
 license = "MIT"

{git_repokit-0.9.11 → git_repokit-0.9.12}/repokit/__version__.py

@@ -1,4 +1,4 @@
 """Version information for RepoKit."""
 
-__version__ = "0.9.11"
+__version__ = "0.9.12"
 __version_info__ = tuple(int(part) for part in __version__.split("."))

{git_repokit-0.9.11 → git_repokit-0.9.12}/repokit/branch_utils.py

@@ -154,10 +154,12 @@ class BranchContext:
         return self.branch_type == 'public'
     
     def get_staged_files(self) -> List[str]:
-        """Get list of files staged for commit."""
+        """Files the commit adds or changes (0.9.12: deletions are left out --
+        removing a private file from a public branch is what the guard wants,
+        not something to refuse)."""
         try:
             result = subprocess.run(
-                ['git', 'diff', '--cached', '--name-only'],
+                ['git', 'diff', '--cached', '--name-only', '--diff-filter=ACMR'],
                 cwd=self.repo_path,
                 capture_output=True,
                 text=True,

{git_repokit-0.9.11 → git_repokit-0.9.12}/repokit/common_kit.py

@@ -131,23 +131,59 @@ def _toml_list(values: List[str]) -> str:
 _TABLE_HEADER = re.compile(r"^[ \t]*\[[ \t]*tool[ \t]*\.[ \t]*\"?repokit-common\"?[ \t]*\][ \t]*\r?\n", re.MULTILINE)
 
 
+# Keys whose list only ever protects more as it grows: when the table already
+# has one, the entries it lacks are added to it rather than the key being
+# skipped (0.9.12). A layer's pyproject.toml ships its own private-patterns, and
+# skipping the key dropped CLAUDE.md and the private dirs from the guard.
+_UNION_KEYS = ("private-patterns",)
+_TOML_STRING = re.compile(r'"((?:[^"\\]|\\.)*)"|\'([^\']*)\'')
+
+
+def _union_into_list(table: str, key: str, values: List[str]) -> Optional[str]:
+    """`table` with the `values` its `key = [...]` list lacks appended inside
+    the brackets (a list written over several lines is kept as written).
+    None when the key is not a list or nothing is missing."""
+    found = re.search(rf"^([ \t]*{re.escape(key)}[ \t]*=[ \t]*\[)(.*?)(\])", table, re.MULTILINE | re.DOTALL)
+    if not found:
+        return None
+    inner = found.group(2)
+    present = {(m.group(1) if m.group(1) is not None else m.group(2)).replace('\\"', '"').replace("\\\\", "\\")
+               for m in _TOML_STRING.finditer(inner)}
+    missing = [v for v in values if v not in present]
+    if not missing:
+        return None
+    kept = inner.rstrip()
+    tail = inner[len(kept):]
+    sep = "" if not kept.strip() else (" " if kept.endswith(",") else ", ")
+    added = _toml_list(missing)[1:-1]
+    return table[: found.start(2)] + kept + sep + added + tail + table[found.end(2):]
+
+
 def _merge_into_table(text: str, settings: Dict[str, List[str]]) -> Optional[str]:
     """Add the keys the existing [tool.repokit-common] table lacks, right after
-    its header; a key already present is never overwritten. Returns the new
-    text, or None when nothing was missing."""
+    its header. A key already present is never overwritten, except that a
+    `_UNION_KEYS` list gains the entries it lacks. Returns the new text, or
+    None when nothing was missing."""
     header = _TABLE_HEADER.search(text)
     if not header:
         return None
     rest = text[header.end():]
     next_table = re.search(r"^[ \t]*\[", rest, re.MULTILINE)   # the table ends at the next header
     table = rest[: next_table.start()] if next_table else rest
+    after = rest[len(table):]
     missing = [key for key in settings
                if not re.search(rf"^[ \t]*{re.escape(key)}[ \t]*=", table, re.MULTILINE)]
-    if not missing:
+    grown = table
+    for key in _UNION_KEYS:
+        if key in settings and key not in missing:
+            unioned = _union_into_list(grown, key, settings[key])
+            if unioned is not None:
+                grown = unioned
+    if not missing and grown == table:
         return None
     nl = "\r\n" if "\r\n" in text else "\n"
     lines = "".join(f"{key} = {_toml_list(settings[key])}{nl}" for key in missing)
-    return text[: header.end()] + lines + rest
+    return text[: header.end()] + lines + grown + after
 
 
 def write_settings(repo_root: str, settings: Dict[str, List[str]]) -> Optional[str]:
@@ -158,7 +194,8 @@ def write_settings(repo_root: str, settings: Dict[str, List[str]]) -> Optional[s
     (created with the header repokit-common requires, or merged the same way).
     A key already present is never overwritten: a code-type layer may ship
     the file with its own version-source, and the private-branch settings go
-    in beside it rather than being dropped.
+    in beside it rather than being dropped. The one exception is
+    private-patterns, whose existing list gains the entries it lacks.
     """
     if not settings:
         return None

{git_repokit-0.9.11 → git_repokit-0.9.12}/repokit/guardrails.py

@@ -214,7 +214,7 @@ except ImportError:
     
     if branch not in ['private', 'local']:
         # Check for obvious private files
-        result = subprocess.run(['git', 'diff', '--cached', '--name-only'],
+        result = subprocess.run(['git', 'diff', '--cached', '--name-only', '--diff-filter=ACMR'],
                               capture_output=True, text=True)
         files = result.stdout.strip().split('\\n')
         

{git_repokit-0.9.11 → git_repokit-0.9.12}/repokit/hooks/pre-commit-template

@@ -2,7 +2,7 @@
 # Pre-commit hook to prevent committing private content
 
 # Check for private directories
-for file in $(git diff --cached --name-only); do
+for file in $(git diff --cached --name-only --diff-filter=ACMR); do
     if echo "$file" | grep -q -E "^private/|^convos/|^logs/|__private__"; then
         echo "ERROR: Attempting to commit private content: $file"
         echo "Private content should not be committed to the repository."
@@ -15,7 +15,7 @@ PRIVATE_PATTERNS=(
 $private_dirs_patterns
 )
 
-for file in $(git diff --cached --name-only); do
+for file in $(git diff --cached --name-only --diff-filter=ACMR); do
     for pattern in "${PRIVATE_PATTERNS[@]}"; do
         if echo "$file" | grep -q -E "$pattern"; then
             echo "ERROR: Attempting to commit private content: $file"

{git_repokit-0.9.11 → git_repokit-0.9.12}/repokit/repo_manager.py

@@ -239,9 +239,10 @@ class RepoManager:
         # Create local repository directory
         os.makedirs(self.repo_root, exist_ok=True)
 
-        # Create github directory for worktree (legacy layout only)
-        if self.github_root:
-            os.makedirs(self.github_root, exist_ok=True)
+        # No <name>/github is made ahead of time (0.9.12): `git worktree add`
+        # creates the folder when main is checked out there, and a strategy
+        # with no worktree for main (minimal), or one that checks main out
+        # elsewhere (--branch-dir-main), must not get a stray github/ folder.
 
         # Create standard subdirectories
         standard_dirs = self.config.get(
@@ -1070,6 +1071,29 @@ class RepoManager:
             else:
                 self.logger.info(f"Linked {path}/private to the private repository")
 
+    def _worktree_of(self, branch: str) -> Optional[str]:
+        """The folder where `branch` is checked out in a worktree other than
+        repo_root itself, from `git worktree list --porcelain`; None when it
+        has none (0.9.12)."""
+        out = self.run_git(["worktree", "list", "--porcelain"], cwd=self.repo_root, check=False) or ""
+        here = os.path.normcase(os.path.abspath(self.repo_root))
+        path = None
+        for line in out.splitlines():
+            if line.startswith("worktree "):
+                path = line[len("worktree "):].strip()
+            elif line.strip() == f"branch refs/heads/{branch}" and path:
+                if os.path.normcase(os.path.abspath(path)) != here:
+                    return path
+        return None
+
+    @staticmethod
+    def _branch_exists_in(repo: str, name: str) -> bool:
+        """Whether a local branch named exactly `name` exists in `repo`
+        (0.9.12: the old check matched by substring, so `dev` found `develop`)."""
+        result = subprocess.run(["git", "show-ref", "--verify", "--quiet", f"refs/heads/{name}"],
+                                cwd=repo, capture_output=True, stdin=subprocess.DEVNULL)
+        return result.returncode == 0
+
     def _setup_github_integration(self) -> None:
         """Set up GitHub integration."""
         self.logger.info("Setting up GitHub integration")
@@ -1084,6 +1108,19 @@ class RepoManager:
         if not self.github_root:
             return
 
+        # Run git only in the default branch's real worktree (0.9.12). The
+        # folder is where `git worktree list` says the branch is checked out,
+        # not an assumed <name>/github: with no worktree there, `git add` and
+        # `git commit` walked up into whatever repository enclosed the
+        # project and committed in it. No worktree for the default branch
+        # means nothing to do -- the branch already carries .github, cut from
+        # the private branch.
+        main_worktree = self._worktree_of(self.config.get("default_branch", "main"))
+        if not main_worktree:
+            self.logger.info("No worktree for the default branch; its .github came with the branch")
+            return
+        self.github_root = main_worktree
+
         # Only proceed if the GitHub worktree exists
         if not os.path.exists(self.github_root):
             self.logger.warning(
@@ -1222,7 +1259,7 @@ class RepoManager:
 # Pre-commit hook to prevent committing private content
 
 # Check for private directories
-for file in $(git diff --cached --name-only); do
+for file in $(git diff --cached --name-only --diff-filter=ACMR); do
     if echo "$file" | grep -q -E "^private/|^convos/|^logs/|__private__"; then
         echo "ERROR: Attempting to commit private content: $file"
         echo "Private content should not be committed to the repository."
@@ -1427,6 +1464,10 @@ exit 0
         )
         private_branch = self.private_branch
 
+        # A public branch that cannot be built, or fails verification, fails
+        # the create (0.9.12): it used to be a warning and the create exited 0
+        # with every public branch holding only the initial commit.
+        failed = []
         for branch in branches:
             if branch != private_branch:  # Skip private branch
                 try:
@@ -1447,17 +1488,21 @@ exit 0
                         self.logger.info(f"Successfully created and verified clean public branch '{branch}'")
                     else:
                         self.logger.error(f"Branch '{branch}' failed verification - contains private content!")
-                        
+                        failed.append(branch)
+
                     if self.verbose >= 2:
                         approach = "selective" if is_adoption else "standard"
                         self.logger.debug(
                             f"Created clean public branch '{branch}' using {approach} approach"
                         )
                 except Exception as e:
-                    self.logger.warning(f"Failed to create clean public branch '{branch}': {str(e)}")
+                    self.logger.error(f"Failed to create clean public branch '{branch}': {str(e)}")
+                    failed.append(branch)
 
         # Switch back to private branch for continued development
         self.run_git(["checkout", private_branch], cwd=self.repo_root)
+        if failed:
+            raise RuntimeError(f"public branches not built: {', '.join(failed)}")
 
     def _get_working_directory_files(self) -> List[str]:
         """
@@ -1575,8 +1620,7 @@ exit 0
             current_branch = self.run_git(["rev-parse", "--abbrev-ref", "HEAD"], cwd=self.repo_root).strip()
             
             # Check if branch already exists
-            existing_branches = self.run_git(["branch", "--list"], cwd=self.repo_root).splitlines()
-            branch_exists = any(branch_name in branch.strip() for branch in existing_branches)
+            branch_exists = self._branch_exists_in(self.repo_root, branch_name)  # exact name (0.9.12)
             
             if branch_exists:
                 self.logger.info(f"Branch '{branch_name}' already exists, will recreate with selective approach")
@@ -1660,17 +1704,22 @@ exit 0
             current_branch = self.run_git(["rev-parse", "--abbrev-ref", "HEAD"], cwd=self.repo_root).strip()
             
             # Check if branch already exists
-            existing_branches = self.run_git(["branch", "--list"], cwd=self.repo_root).splitlines()
-            branch_exists = any(branch_name in branch.strip() for branch in existing_branches)
+            branch_exists = self._branch_exists_in(self.repo_root, branch_name)  # exact name (0.9.12)
             
+            # The source is always the BRANCH, never a folder of the same name:
+            # a private/ folder sits beside the private branch, and a bare
+            # `git reset --hard private` is refused as ambiguous (0.9.12;
+            # djdarcy: "The only private we care about in the private-public
+            # branch strategy is the "private" branch as the source").
+            source_ref = f"refs/heads/{source_branch}"
             if branch_exists:
                 # Branch exists, check it out and reset it
                 self.logger.info(f"Branch '{branch_name}' already exists, resetting it")
                 self.run_git(["checkout", branch_name], cwd=self.repo_root)
-                self.run_git(["reset", "--hard", source_branch], cwd=self.repo_root)
+                self.run_git(["reset", "--hard", source_ref], cwd=self.repo_root)
             else:
                 # Create the new branch from the source branch
-                self.run_git(["checkout", "-b", branch_name, source_branch], cwd=self.repo_root)
+                self.run_git(["checkout", "-b", branch_name, source_ref], cwd=self.repo_root)
             
             # Use existing BranchContext with configuration to identify private content
             context = BranchContext(self.repo_root, self._get_branch_config())
@@ -2059,8 +2108,8 @@ exit 0
                     else:
                         # For branches not in worktrees, we can update them directly
                         self.run_git(["checkout", branch], cwd=self.repo_root)
-                        self.run_git(
-                            ["reset", "--hard", private_branch], cwd=self.repo_root
+                        self.run_git(  # the branch, never a folder of the same name (0.9.12)
+                            ["reset", "--hard", f"refs/heads/{private_branch}"], cwd=self.repo_root
                         )
                         self.logger.info(
                             f"Updated branch '{branch}' from {private_branch}"
@@ -2366,12 +2415,14 @@ exit 0
 
     def _cleanup_sensitive_files(self, branch_context: Optional[str] = None, dry_run: bool = False) -> Dict[str, List[str]]:
         """
-        Branch-aware cleanup of sensitive files during repository adoption.
-        
-        This method performs intelligent cleanup based on branch context:
-        - For private branches: Only clean git index, preserve working directory
-        - For public branches: Clean both working directory and git index
-        
+        Take sensitive files out of a branch's git index, leaving them on disk.
+
+        Called while a public branch is cut. It removes tracked files matching
+        the sensitive patterns from the index (`git rm --cached`) and never
+        deletes anything from the working folder, which in the private-branch
+        model is the private checkout (0.9.12). The 'working_dir' list in the
+        result is always empty; it is kept for callers that read it.
+
         Args:
             branch_context: Branch we're cleaning for (e.g. 'private', 'dev', 'main')
             dry_run: If True, only report what would be cleaned
@@ -2411,65 +2462,18 @@ exit 0
         cleanup_logger.info(f"Is private branch: {is_private_branch}")
         cleanup_logger.info(f"Using {len(patterns_to_clean)} sensitive patterns: {patterns_to_clean}")
         
-        # For private branches, we preserve working directory files but clean git index
-        # For public branches, we clean both working directory and git index
-        clean_working_dir = not is_private_branch
+        # The working folder is never cleaned, for any branch (0.9.12). In the
+        # private-branch model a public branch is cut inside repo_root, which is
+        # the PRIVATE checkout (<name>/local), so deleting matching files from
+        # disk removed a person's untracked .env, logs and backups from their
+        # own working folder. It never ran before 0.9.12 only because the reset
+        # before it always failed. Taking files out of the public branch is the
+        # index clean below, which leaves them on disk.
+        clean_working_dir = False
         clean_git_index = True  # Always clean git index
-        
-        cleanup_logger.info(f"Will clean working directory: {clean_working_dir}")
-        cleanup_logger.info(f"Will clean git index: {clean_git_index}")
-        
-        # Clean working directory files (only for public branches)
-        if clean_working_dir:
-            cleanup_logger.debug("Scanning working directory for sensitive files")
-            for root, dirs, files in os.walk(self.repo_root):
-                # Skip .git directory
-                if ".git" in root.split(os.sep):
-                    continue
-                    
-                for file in files:
-                    file_path = os.path.join(root, file)
-                    relative_path = os.path.relpath(file_path, self.repo_root)
-                    if self._is_vendored(relative_path):
-                        continue
 
-                    # Check if file matches any sensitive pattern
-                    should_remove = False
-                    matching_pattern = None
-                    
-                    for pattern in patterns_to_clean:
-                        # Cross-platform pattern matching using normalized paths
-                        normalized_relative = str(Path(relative_path)).replace('\\', '/')
-                        normalized_pattern = pattern.replace('\\', '/')
-                        
-                        # Check multiple match approaches for cross-platform compatibility
-                        matches = [
-                            fnmatch.fnmatch(normalized_relative, normalized_pattern),  # Full path
-                            fnmatch.fnmatch(file, normalized_pattern),                 # Filename only
-                            fnmatch.fnmatch(str(Path(file)), normalized_pattern),     # Filename as Path
-                        ]
-                        
-                        if any(matches):
-                            should_remove = True
-                            matching_pattern = pattern
-                            if self.verbose >= 3:
-                                cleanup_logger.debug(f"Pattern '{pattern}' matched file '{relative_path}' (normalized: '{normalized_relative}')")
-                            break
-                    
-                    if should_remove:
-                        cleanup_results["working_dir"].append(relative_path)
-                        
-                        if dry_run:
-                            cleanup_logger.info(f"Would remove (working dir): {relative_path} (pattern: {matching_pattern})")
-                        else:
-                            try:
-                                os.remove(file_path)
-                                cleanup_logger.debug(f"Removed (working dir): {relative_path} (pattern: {matching_pattern})")
-                            except Exception as e:
-                                cleanup_logger.warning(f"Failed to remove {relative_path}: {str(e)}")
-        else:
-            cleanup_logger.info("Skipping working directory cleanup (private branch - files preserved)")
-        
+        cleanup_logger.info(f"Will clean git index: {clean_git_index} (the working folder is never touched)")
+
         # Clean git index files (always done)
         if clean_git_index:
             cleanup_logger.debug("Scanning git index for sensitive files")

{git_repokit-0.9.11 → git_repokit-0.9.12}/repokit/templates/hooks/pre-commit.template

@@ -23,7 +23,7 @@ esac
 
 # Check for private content using BranchContext patterns
 has_private_content=0
-for file in $(git diff --cached --name-only); do
+for file in $(git diff --cached --name-only --diff-filter=ACMR); do
     # Check against all private content patterns from BranchContext
     if echo "$file" | grep -q -E "$private_content_regex"; then
         if [ $has_private_content -eq 0 ]; then
@@ -50,7 +50,7 @@ if [ $has_private_content -eq 1 ]; then
 fi
 
 # Check for large files (>10MB)
-for file in $(git diff --cached --name-only); do
+for file in $(git diff --cached --name-only --diff-filter=ACMR); do
     if [ -f "$file" ]; then
         size=$(du -k "$file" | awk '{print $1}')
         if [ "$size" -gt 10240 ]; then

{git_repokit-0.9.11 → git_repokit-0.9.12}/tests/test_layers.py

@@ -504,7 +504,7 @@ def test_write_settings_merges_missing_keys_and_never_overwrites(tmp_path):
     assert common_kit.write_settings(str(tmp_path), {"private-patterns": ["CLAUDE.md"], "languages": ["NOT-THIS"]}) == ".repokit-common.toml"
     assert f.read_bytes() == (b'[tool.repokit-common]\r\nprivate-patterns = ["CLAUDE.md"]\r\n'
                               b'version-source = "include/x/version.h"\r\nlanguages = ["c-cpp"]\r\n')
-    assert common_kit.write_settings(str(tmp_path), {"private-patterns": ["other"]}) is None   # present: untouched
+    assert common_kit.write_settings(str(tmp_path), {"languages": ["other"]}) is None   # present: untouched
     py = tmp_path / "pyproject.toml"
     py.write_text('[project]\nname = "p"\n\n[tool.repokit-common]\nversion-source = "p/_version.py"\n\n[tool.other]\nx = 1\n')
     assert common_kit.write_settings(str(tmp_path), {"private-branches": ["private", "scratch"]}) == "pyproject.toml"
@@ -512,6 +512,44 @@ def test_write_settings_merges_missing_keys_and_never_overwrites(tmp_path):
                               'version-source = "p/_version.py"\n\n[tool.other]\nx = 1\n')
 
 
+def test_write_settings_adds_the_private_patterns_an_existing_list_lacks(tmp_path):
+    """0.9.12: a table that already has private-patterns (the pypi layer's
+    pyproject.toml ships one) keeps its entries and gains the ones the
+    private-branch model needs -- skipping the key dropped CLAUDE.md from
+    the guard on public branches. Other keys are still never overwritten."""
+    py = tmp_path / "pyproject.toml"
+    py.write_text('[tool.repokit-common]\nversion-source = "p/_version.py"\n'
+                  'private-patterns = ["private/", "local/", ".env"]\n\n[tool.other]\nx = ["CLAUDE.md"]\n')
+    settings = {"private-patterns": ["CLAUDE.md", "private/", "convos/"], "version-source": ["NOT-THIS"]}
+    assert common_kit.write_settings(str(tmp_path), settings) == "pyproject.toml"
+    assert py.read_text() == ('[tool.repokit-common]\nversion-source = "p/_version.py"\n'
+                              'private-patterns = ["private/", "local/", ".env", "CLAUDE.md", "convos/"]\n\n'
+                              '[tool.other]\nx = ["CLAUDE.md"]\n')
+    assert common_kit.write_settings(str(tmp_path), settings) is None   # nothing missing any more
+
+    toml = tmp_path / "sub"
+    toml.mkdir()
+    f = toml / ".repokit-common.toml"
+    f.write_bytes(b"[tool.repokit-common]\r\nprivate-patterns = [\r\n    'private/',\r\n]\r\n")
+    assert common_kit.write_settings(str(toml), {"private-patterns": ["CLAUDE.md"]}) == ".repokit-common.toml"
+    assert f.read_bytes() == b"[tool.repokit-common]\r\nprivate-patterns = [\r\n    'private/', \"CLAUDE.md\"\r\n]\r\n"
+
+
+def test_write_settings_union_stays_in_its_own_list_and_table(tmp_path):
+    """0.9.12: the union reads single-quoted entries as present, adds only to
+    the private-patterns list (not to a list after it), and the table ends at
+    the next header -- a key of the same name in a later table neither counts
+    as present nor receives anything. Found by the 0.9.12 mutation sweep."""
+    py = tmp_path / "pyproject.toml"
+    py.write_text("[tool.repokit-common]\nprivate-patterns = ['private/', \"local/\"]\nlanguages = [\"python\"]\n\n"
+                  "[tool.other]\nprivate-branches = [\"x\"]\n")
+    settings = {"private-patterns": ["private/", "CLAUDE.md"], "private-branches": ["private", "scratch"]}
+    assert common_kit.write_settings(str(tmp_path), settings) == "pyproject.toml"
+    assert py.read_text() == ("[tool.repokit-common]\nprivate-branches = [\"private\", \"scratch\"]\n"
+                              "private-patterns = ['private/', \"local/\", \"CLAUDE.md\"]\nlanguages = [\"python\"]\n\n"
+                              "[tool.other]\nprivate-branches = [\"x\"]\n")
+
+
 # --- U2.3: packaging ----------------------------------------------------------
 
 @pytest.mark.integration

{git_repokit-0.9.11 → git_repokit-0.9.12}/tests/test_new_default.py

@@ -114,6 +114,17 @@ class TestPrivateBranchModelWithCommon(RepoKitTestCase):
         allowed = commit_file(local, "CLAUDE.md")
         self.assertEqual(allowed.returncode, 0, allowed.stdout + allowed.stderr)
 
+    def test_claude_md_refused_on_main_of_a_python_project(self):
+        """0.9.12: a Python project's pyproject.toml ships its own private-patterns;
+        the private-branch entries must be added to that list, or CLAUDE.md
+        reaches main (committed from the github worktree)."""
+        self.assert_repokit_success(["create", "demo", "--branch-strategy", "simple", "--with-common",
+                                     "--language", "python", "--no-push"])
+        github = os.path.join(self.test_dir, "demo", "github")
+        self.assertIn('"CLAUDE.md"', Path(github, "pyproject.toml").read_text(encoding="utf-8"))
+        refused = commit_file(github, "CLAUDE.md")
+        self.assertNotEqual(refused.returncode, 0, refused.stdout + refused.stderr)
+
     def test_a_custom_private_branch_is_written_to_the_settings(self):
         self.assert_repokit_success(["create", "demo", "--branch-strategy", "simple",
                                      "--private-branch", "scratch", "--with-common", "--no-push"])