Compare commits
No commits in common. "main" and "v3.2.0" have entirely different histories.
11 changed files with 164 additions and 233 deletions
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "graceful-handoff",
|
||||
"version": "3.2.1",
|
||||
"version": "3.2.0",
|
||||
"description": "One-command session handoff into the STATE.md continuity system. /graceful-handoff reaches a natural stopping point, overwrites the nearest STATE.md with a complete state-of-play (mandatory '👉 NESTE' block), and commits per remote policy (private → tracked, public mirror → local-only). Skill-only, deterministic STATE helper, no hooks.",
|
||||
"author": {
|
||||
"name": "Kjell Tore Guttormsen"
|
||||
|
|
|
|||
22
CHANGELOG.md
22
CHANGELOG.md
|
|
@ -4,28 +4,6 @@ All notable changes to graceful-handoff are documented here.
|
|||
|
||||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
||||
|
||||
## [3.2.1] - 2026-08-09
|
||||
|
||||
The first time the pipeline was ever run against real repositories. It found two defects sitting under a 42/42-green suite — which is the point the repo's own docs had been making about what prose-grep tests can and cannot prove.
|
||||
|
||||
### Fixed
|
||||
|
||||
- **`dirty_files` truncated the first path.** `gitOk()` called `.trim()` on every command's output, but `git status --porcelain` encodes the worktree status in column 2 — a modified-but-unstaged file is `" M path"`. The trim ate that leading space, and the fixed `slice(3)` then ate the first character of the first path: `app.js` was reported as `pp.js`. Only the first line was affected, which is exactly why it survived: no existing test asserted `dirty_files` **values**, only that the key existed. Porcelain output is now read through a non-trimming `gitOkRaw()`.
|
||||
- **The commit message claimed a STATE.md update it did not contain.** `generateCommitMessage()` always produced `docs(<repo>): oppdater STATE.md (session handoff)`. On every `open/` repo — including this one — STATE.md is gitignored, so the handoff commit carries only the explicit `--also` paths. Git history is the regime's long-term log; it was systematically wrong about its own contents. The message now branches on what was actually staged.
|
||||
|
||||
### Changed
|
||||
|
||||
- **The leak condition is a hard gate, not an advisory.** A public remote whose STATE.md is not yet gitignored is the state a *fresh* `open/` repo starts in, and `should_commit_state` was `true` there — the ritual merely *mentioned* `leak_warning` and committed anyway. The warning now also lands in `errors[]` (step 2 stops on a non-empty `errors[]`), `should_commit_state` is `false`, and `--commit` refuses to stage STATE.md (`state-leak-blocked`). Explicit `--also` paths are still honoured: the gate protects STATE.md, not the commit as a whole. Both `--plan` and `--commit` now consult one exported `leakBlock()` so they cannot disagree.
|
||||
- **SKILL.md's justification for the single-line rule was outdated.** It claimed a wrapped `rationale=` replaces the repo's next step on the board with garbage. `board.sh` in repo-mailbox 0.20.3 tracks an HTML comment to its closer, so that no longer follows. The rule stands, now stated with the risk that *is* still real: a `rationale=` containing `-->` ends its own comment early.
|
||||
|
||||
### Tests
|
||||
|
||||
- 42 → 48. Four pipeline tests (first-character preservation in `dirty_files`, the `--plan` and `--commit` halves of the leak gate, commit-message honesty) and two SKILL.md drift guards (the corrected single-line rationale, and step 2 stopping rather than reporting). All six were written failing first.
|
||||
|
||||
### Not verified
|
||||
|
||||
- That `/graceful-handoff` loads as a user command (issue [#26251](https://github.com/anthropics/claude-code/issues/26251)), and that a cross-plugin `Skill` invocation of `repo-mailbox:route` passes from a sub-scoped skill. Both need the catalog `ref` bumped so the version is actually installed; the smoke test could exercise the pipeline but not the slash command.
|
||||
|
||||
## [3.2.0] - 2026-08-09
|
||||
|
||||
### Changed
|
||||
|
|
|
|||
21
CLAUDE.md
21
CLAUDE.md
|
|
@ -50,11 +50,8 @@ Hjelperen klassifiserer `origin`:
|
|||
- `github.com` eller `open/`-Forgejo-namespace → **public** → STATE.md local-only (gitignored), committes aldri.
|
||||
- ellers (privat Forgejo `ktg/…`) → **private** → STATE.md tracked + committet.
|
||||
|
||||
Den autoritative commit-beslutningen er `git check-ignore STATE.md`. Er de to inkonsistente
|
||||
(offentlig remote, men STATE.md IKKE gitignored) er det fra v3.2.1 en **hard gate**, ikke et varsel:
|
||||
`leak_warning` legges i `errors[]` (rituelet stopper i steg 2), `should_commit_state` blir `false`, og
|
||||
`--commit` nekter å stage STATE.md (`state-leak-blocked`). Det var den tilstanden et ferskt
|
||||
`open/`-repo starter i — å bare *nevne* den gjorde default-stien til lekkasjestien.
|
||||
Den autoritative commit-beslutningen er `git check-ignore STATE.md`; `remote_class` driver kun et
|
||||
`leak_warning` når de to er inkonsistente (offentlig remote, men STATE.md ikke gitignored).
|
||||
|
||||
**Denne repoen har `open/`-remote → STATE.md er gitignored (local-only).** Plugin-koden er offentlig;
|
||||
state-of-play er det ikke.
|
||||
|
|
@ -70,20 +67,15 @@ ubeslektet WIP. Regresjonstest håndhever dette. Pre-commit hooks respekteres ut
|
|||
node --test 'tests/**/*.test.mjs'
|
||||
```
|
||||
|
||||
48 tester på tvers av 3 filer (`skill-structure`, `scripts/handoff-pipeline`, `plugin-manifest`).
|
||||
42 tester på tvers av 3 filer (`skill-structure`, `scripts/handoff-pipeline`, `plugin-manifest`).
|
||||
Pipelinen er deterministisk og testes uten LLM-kall: `--plan`/`--commit`-JSON, nærmeste-STATE-resolusjon,
|
||||
remote-klassifisering, staging-disiplin (no-`git add -A`-regresjon), gitignored-STATE-skip, detached-HEAD,
|
||||
`--dry-run`.
|
||||
|
||||
**Vær ærlig om hva de beviser.** Ritual-testene i `skill-structure` er prosa-grep — de er
|
||||
drift-vakter, ikke korrekthetsbevis. Ingen av dem kjører rituelet. Grønne tester er ikke det
|
||||
samme som et verifisert ritual: smoke-testen 2026-08-09 kjørte pipelinen mot ekte scratch-repo
|
||||
og fant **to defekter under en 42/42-grønn suite** (`dirty_files` mistet første tegn; commit-
|
||||
meldingen påsto STATE-oppdatering den ikke inneholdt). Begge er fikset i v3.2.1 med test først.
|
||||
|
||||
**Fortsatt uverifisert:** at `/graceful-handoff` laster som user-command (issue #26251), og at
|
||||
kryss-plugin-`Skill`-invokering av `repo-mailbox:route` slipper gjennom fra en sub-scopet skill.
|
||||
Begge krever at katalogens `ref` er bumpet slik at versjonen faktisk er installert.
|
||||
drift-vakter, ikke korrekthetsbevis. Ingen av dem kjører rituelet. Den faktiske verifiseringen er
|
||||
en manuell `/graceful-handoff` mot et scratch-repo; grønne tester er ikke det samme som et
|
||||
verifisert ritual.
|
||||
|
||||
## Versjonering
|
||||
|
||||
|
|
@ -92,7 +84,6 @@ Begge krever at katalogens `ref` er bumpet slik at versjonen faktisk er installe
|
|||
- v2.1.0 (2026-05-01): modell-bevisst kontekstvindu (4-stegs resolution-kjede)
|
||||
- v3.0.0 (2026-06-23): **STATE.md-integrasjon (BREAKING).** Fjernet NEXT-SESSION-artefakt + alle 3 hooks; invertert pipeline (modellen skriver STATE.md, skriptet assisterer); remote-aware tracked/local-only-policy; fjernet Sonnet-pin.
|
||||
- v3.1.0 (2026-06-24): fjernet hardkodet push-vindu — push er nå ubetinget (kun Forgejo, fortsatt user-triggered).
|
||||
- v3.2.1 (2026-08-09): **første ekte smoke-test.** Fikset `dirty_files`-trunkering (`gitOk().trim()` spiste porcelain-linjens ledende mellomrom → `app.js` ble `pp.js`), commit-melding som påsto STATE-oppdatering på local-only-repo, og gjorde lekkasje-tilstanden til en hard gate. SKILL.md-begrunnelsen for én-linjes-regelen korrigert mot `board.sh` 0.20.3.
|
||||
- v3.2.0 (2026-08-09): ritualet synket med global «Session Slutt» — nytt route-steg (`repo-mailbox:route`) før STATE-skrivingen, board-/route-/route-last-linjer i malen, avslutningslinjen utvidet fra 3 til 6 felt (Innboks, Modell neste økt, Oppstartskommando), STATE-formatet konsolidert til én kopi (SKILL.md).
|
||||
|
||||
## Release (polyrepo — egen gated handling)
|
||||
|
|
|
|||
131
GOVERNANCE.md
Normal file
131
GOVERNANCE.md
Normal file
|
|
@ -0,0 +1,131 @@
|
|||
# Governance
|
||||
|
||||
How this marketplace is maintained, what you can expect from upstream, and how it's meant to be used.
|
||||
|
||||
## TL;DR
|
||||
|
||||
- Solo-maintained, AI-assisted development, MIT licensed.
|
||||
- **Fork-and-own is the default model.** Upstream is a starting point, not a vendor.
|
||||
- Issues welcome as signals. Pull requests are not accepted — see [Why no PRs](#pull-requests--no).
|
||||
- No SLA. Best-effort bug fixes and security advisories. Breaking changes happen and are noted in each plugin's CHANGELOG.
|
||||
|
||||
---
|
||||
|
||||
## Can I trust this?
|
||||
|
||||
Be honest with yourself about what you're adopting:
|
||||
|
||||
- **One maintainer.** If I get hit by a bus, the bus wins. The repos stay up under MIT, but no one owes you a fix.
|
||||
- **AI-generated code with human review.** Every plugin is built through dialog-driven development with Claude Code. I read, test, and judge the output before it ships, but I'm not auditing every line the way a security firm would. Treat it accordingly.
|
||||
- **No commercial interests.** I'm not selling a SaaS, not steering you toward a paid tier, not collecting telemetry. The plugins run locally in your Claude Code installation.
|
||||
- **MIT licensed.** Fork it, modify it, ship it under your own name.
|
||||
|
||||
If you work somewhere that needs vendor accountability, support contracts, or signed assurances — **this isn't that.** Use it as a reference implementation, fork it into your own organization, and own the result.
|
||||
|
||||
---
|
||||
|
||||
## How this is meant to be used
|
||||
|
||||
### Fork-and-own
|
||||
|
||||
The intended workflow:
|
||||
|
||||
1. **Fork** the marketplace (or a single plugin) into your own organization or namespace.
|
||||
2. **Tailor** it to your context — terminology, integrations, cycle lengths, regulatory framing, whatever doesn't fit out of the box.
|
||||
3. **Maintain it yourself.** Treat your fork as the canonical version for your team.
|
||||
4. **Watch upstream selectively.** Cherry-pick changes that help, ignore changes that don't. There's no obligation to stay in sync.
|
||||
|
||||
This isn't a workaround for not accepting PRs. It's the actual recommended adoption pattern, especially for plugins like `okr` and `ms-ai-architect` where every Norwegian public sector organization will need its own tildelingsbrev mappings, terminology, and integrations. A central "one true plugin" would be wrong for everyone.
|
||||
|
||||
### What to change first when you fork
|
||||
|
||||
Each plugin differs, but the common edits are:
|
||||
|
||||
- **Identity** — rename the plugin, replace authorship, update README.
|
||||
- **External integrations** — issue trackers, knowledge bases, dashboards, observability backends. The plugins ship as starting points, not pre-wired. Every organization must configure its own integrations.
|
||||
- **Norwegian-specific framing** — relevant for `okr` and `ms-ai-architect`. Other plugins are jurisdiction-neutral. Rewrite for your jurisdiction if you're outside Norway.
|
||||
- **Reference docs** — the knowledge base in each plugin reflects my reading. Replace with your organization's authoritative sources.
|
||||
- **Hooks and policies** — security thresholds, blocked commands, and audit gates are tuned to my taste. Tune them to yours.
|
||||
|
||||
### Staying current with upstream
|
||||
|
||||
If you want to pull in upstream changes later:
|
||||
|
||||
- **Cherry-pick, don't merge.** Each plugin moves independently and breaking changes land without ceremony.
|
||||
- **Read the CHANGELOG first.** Every plugin has one.
|
||||
- **Keep your customizations in clearly-named files.** The harder upstream is to merge cleanly, the more painful staying current becomes. A `local/` directory or `*.local.md` convention helps.
|
||||
|
||||
---
|
||||
|
||||
## What upstream provides
|
||||
|
||||
| | What I do | What I don't |
|
||||
|---|---|---|
|
||||
| **Bug fixes** | Best-effort when I notice or get a clear report | No SLA, no triage commitment |
|
||||
| **Security issues** | Investigate within reasonable time, document in CHANGELOG | No CVE process, no embargo coordination |
|
||||
| **New features** | When they fit my own usage | Not on request |
|
||||
| **Norwegian public sector context** | Kept current as long as the project lives | If I lose interest or change jobs, the framing freezes |
|
||||
| **Breaking changes** | Documented in CHANGELOG | They happen — version pin if you need stability |
|
||||
| **Compatibility** | Tracked against current Claude Code releases | No long-term support branches |
|
||||
|
||||
If any of this is a dealbreaker — fork now, version-pin, and stop reading upstream.
|
||||
|
||||
---
|
||||
|
||||
## How to contribute
|
||||
|
||||
### Issues — yes, please
|
||||
|
||||
Issues are the most valuable thing you can send me:
|
||||
|
||||
- **Bug reports** with reproduction steps. Even a screenshot helps.
|
||||
- **Use-case feedback.** "I tried to use this in my organization and X didn't fit" is genuinely useful, even if I can't fix it for you.
|
||||
- **Pointers to better sources.** If you know a DFØ veileder, an NSM guideline, or an academic paper that contradicts what's in a knowledge base, tell me.
|
||||
- **Security findings.** See each plugin's `SECURITY.md` for disclosure preference where one exists; otherwise email rather than open a public issue.
|
||||
|
||||
### Pull requests — no
|
||||
|
||||
This is deliberate, not laziness:
|
||||
|
||||
- **Solo review is a bottleneck.** Honest PR review takes me longer than rewriting from scratch. The math doesn't work.
|
||||
- **Forks are where the value is.** The fork-and-own model means upstream consolidation isn't the point. Your organization's adaptations belong in your fork, not mine.
|
||||
- **AI-generated code complicates provenance.** Every line here is produced through dialog with Claude Code, with me as the judge. Mixing in PRs from contributors with different processes and licensing assumptions creates a mess I'd rather not untangle.
|
||||
|
||||
If you've built something useful on top of a fork, **publish it under your own name and link back.** I'll happily list notable forks here once they exist.
|
||||
|
||||
### Notable forks
|
||||
|
||||
*(To be populated as forks emerge. If you've forked one of these plugins for production use, open an issue and I'll add a link.)*
|
||||
|
||||
---
|
||||
|
||||
## Relationship between plugins
|
||||
|
||||
These plugins are **independent**. Install one without the others, fork one without the others. They share conventions (slash command naming, hook patterns, AI-generated disclosure) but no runtime dependencies.
|
||||
|
||||
The marketplace is a **catalog**, not a suite. Don't fork the whole repo unless you actually want to maintain everything.
|
||||
|
||||
---
|
||||
|
||||
## Versioning and stability
|
||||
|
||||
- **Semantic versioning per plugin.** Each plugin has its own `CHANGELOG.md` and version number.
|
||||
- **Breaking changes happen.** I bump the major version when they do, but I don't run an LTS branch.
|
||||
- **Pin your version.** If stability matters more than features, install a specific version and stay there until you choose to upgrade.
|
||||
|
||||
---
|
||||
|
||||
## Public sector adoption notes
|
||||
|
||||
For Norwegian etater specifically:
|
||||
|
||||
- **DPIA-relevant data flows are documented in the relevant plugin README where applicable.** Read them before installation.
|
||||
- **No data leaves your machine** beyond what Claude Code itself sends to Anthropic. The plugins themselves do not call external services unless you configure an integration.
|
||||
- **Drøftingsplikt and ledelsesansvar** are not replaced by these tools. The `okr` plugin coaches; it does not decide. The `ms-ai-architect` plugin advises; it does not approve.
|
||||
- **Choose your Claude deployment carefully.** claude.ai vs. API direct vs. Bedrock in EU region have different data residency profiles. The plugins don't choose for you.
|
||||
|
||||
---
|
||||
|
||||
## License
|
||||
|
||||
MIT for all plugins in this marketplace. See each plugin's `LICENSE` file.
|
||||
|
|
@ -2,11 +2,11 @@
|
|||
|
||||
One-command session handoff into the STATE.md continuity system. Overwrites the nearest STATE.md with a complete state-of-play and commits per remote policy.
|
||||
|
||||
> **Solo-maintained, fork-and-own.** This plugin is a starting point, not a vendor product. Issues are welcome as signals; pull requests are not accepted. See [GOVERNANCE.md](https://git.fromaitochitta.com/open/repo-standard/src/branch/main/GOVERNANCE.md) for the full model and what upstream provides.
|
||||
> **Solo-maintained, fork-and-own.** This plugin is a starting point, not a vendor product. Issues are welcome as signals; pull requests are not accepted. See [GOVERNANCE.md](GOVERNANCE.md) for the full model and what upstream provides.
|
||||
|
||||
*AI-generated: all code produced by Claude Code through dialog-driven development. Every change is human-directed, reviewed, and validated before commit. Per Anthropic Consumer Terms §4, ownership of outputs is assigned to the user.*
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -269,13 +269,13 @@ Enforced by tests, not convention:
|
|||
node --test 'tests/**/*.test.mjs'
|
||||
```
|
||||
|
||||
48 tests across 3 files:
|
||||
42 tests across 3 files:
|
||||
|
||||
| File | Coverage |
|
||||
|------|----------|
|
||||
| `tests/skill-structure.test.mjs` | SKILL.md frontmatter (no `model:` pin, `Write` + `Skill` in allowed-tools, `disable-model-invocation`), `👉 NESTE` mandate, the three STATE header comment lines + their single-line constraint, route-before-write ordering, the six closing-line fields, removal of `commands/` and `hooks/` |
|
||||
| `tests/scripts/handoff-pipeline.test.mjs` | `--plan`/`--commit`/`--dry-run`, nearest-STATE resolution, remote classification, **no-`git add -A` regression**, gitignored-STATE skip, detached HEAD |
|
||||
| `tests/plugin-manifest.test.mjs` | plugin.json version + description, CHANGELOG `[3.2.1]`, `[3.2.0]` and `[3.0.0]` BREAKING + preserved history |
|
||||
| `tests/plugin-manifest.test.mjs` | plugin.json version + description, CHANGELOG `[3.2.0]` and `[3.0.0]` BREAKING + preserved history |
|
||||
|
||||
The suite runs in a few seconds — no LLM involvement. **Nothing runs it automatically:** this forge has no CI runner, so the command above from a clean clone is the only verification. That is also why this README carries no test badge — a static one would assert a run nobody performed.
|
||||
|
||||
|
|
|
|||
31
SECURITY.md
31
SECURITY.md
|
|
@ -1,31 +0,0 @@
|
|||
# Security policy
|
||||
|
||||
## Reporting a vulnerability
|
||||
|
||||
Report privately to <security@fromaitochitta.com> - do not open a
|
||||
public issue.
|
||||
Canonical repository: https://git.fromaitochitta.com/open/graceful-handoff
|
||||
|
||||
Please include the affected version or commit, a minimal reproduction,
|
||||
and the impact you see. We acknowledge every report within 5 working
|
||||
days, agree a fix and disclosure timeline with the reporter, and aim to
|
||||
disclose within 90 days of the initial report.
|
||||
|
||||
## Response process
|
||||
|
||||
1. Acknowledge within 5 working days.
|
||||
2. Triage and confirm severity within 10 working days.
|
||||
3. Develop and test a fix.
|
||||
4. Publish an advisory and credit the reporter unless they prefer
|
||||
to remain anonymous.
|
||||
|
||||
## Supported versions
|
||||
|
||||
Only the latest tagged release (currently v3.2.1) is supported and
|
||||
receives security fixes. Earlier tags are not maintained; upgrade to
|
||||
the latest release before reporting.
|
||||
|
||||
## Advisories
|
||||
|
||||
Security fixes are noted in [CHANGELOG.md](CHANGELOG.md). There is no
|
||||
separate advisory database for this repository.
|
||||
|
|
@ -59,23 +59,10 @@ function gitOk(cmd, opts = {}) {
|
|||
}
|
||||
}
|
||||
|
||||
// Same as gitOk, but WITHOUT trim(). `git status --porcelain` puts the worktree
|
||||
// status in column 2, so a modified-but-unstaged file is " M path" — a leading
|
||||
// space that carries meaning. Trimming it shifted the first line left, and the
|
||||
// fixed slice(3) below then ate the first character of the first path ("app.js"
|
||||
// → "pp.js"). Only ever use this where leading whitespace is significant.
|
||||
function gitOkRaw(cmd, opts = {}) {
|
||||
try {
|
||||
return execSync(cmd, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], ...opts });
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function gitStatus(cwd) {
|
||||
const o = { cwd };
|
||||
const branch = gitOk('git branch --show-current', o) || gitOk('git rev-parse --abbrev-ref HEAD', o);
|
||||
const porcelain = (gitOkRaw('git status --porcelain', o) || '').replace(/\n+$/, '');
|
||||
const porcelain = gitOk('git status --porcelain', o) || '';
|
||||
const dirty = porcelain.length > 0;
|
||||
let ahead = 0;
|
||||
const upstream = gitOk('git rev-parse --abbrev-ref @{u} 2>/dev/null', o);
|
||||
|
|
@ -123,18 +110,6 @@ export function classifyRemote(url) {
|
|||
return 'private';
|
||||
}
|
||||
|
||||
// The leak gate. A public remote whose STATE.md is NOT gitignored is not an
|
||||
// advisory condition — it is the single state in which continuing the ritual is
|
||||
// itself what causes the leak, and it is exactly the state a fresh `open/` repo
|
||||
// starts in. Both --plan and --commit consult this one function so they cannot
|
||||
// disagree about whether STATE.md may be staged.
|
||||
export function leakBlock({ shouldBeLocalOnly, stateGitignored, remoteClass, remoteUrl }) {
|
||||
if (!shouldBeLocalOnly || stateGitignored) return null;
|
||||
return `BLOKKERT: STATE.md er IKKE gitignored, men remote er ${remoteClass} (${remoteUrl || 'ingen'}) — `
|
||||
+ `å committe den ville lekket intern state-of-play ved push. Legg 'STATE.md' i .gitignore `
|
||||
+ `(den skal være local-only på denne remoten), så kjør rituelet på nytt.`;
|
||||
}
|
||||
|
||||
// ---------- Plan (read-only) ----------
|
||||
|
||||
function buildPlan(cwd, errors) {
|
||||
|
|
@ -156,9 +131,10 @@ function buildPlan(cwd, errors) {
|
|||
{ cwd: dirname(statePath) }
|
||||
);
|
||||
|
||||
const leakWarning = leakBlock({ shouldBeLocalOnly, stateGitignored, remoteClass, remoteUrl });
|
||||
// Blocking, not advisory: step 2 of the ritual stops on a non-empty errors[].
|
||||
if (leakWarning) errors.push(leakWarning);
|
||||
const leakWarning = (shouldBeLocalOnly && !stateGitignored)
|
||||
? `STATE.md er IKKE gitignored, men remote er ${remoteClass} (${remoteUrl || 'ingen'}) — `
|
||||
+ `legg STATE.md i .gitignore for å unngå å lekke intern state-of-play ved push.`
|
||||
: null;
|
||||
|
||||
const git = gitStatus(cwd);
|
||||
const recentCommits = (gitOk('git log --oneline -8', { cwd }) || '').split('\n').filter(Boolean);
|
||||
|
|
@ -173,7 +149,7 @@ function buildPlan(cwd, errors) {
|
|||
remote_url: remoteUrl,
|
||||
remote_class: remoteClass,
|
||||
should_be_local_only: shouldBeLocalOnly,
|
||||
should_commit_state: !stateGitignored && !leakWarning,
|
||||
should_commit_state: !stateGitignored,
|
||||
leak_warning: leakWarning,
|
||||
git_status: { branch: git.branch, dirty: git.dirty, ahead: git.ahead, detached: git.detached, upstream: git.upstream },
|
||||
dirty_files: git.dirtyFiles,
|
||||
|
|
@ -185,15 +161,9 @@ function buildPlan(cwd, errors) {
|
|||
|
||||
// ---------- Commit (write) ----------
|
||||
|
||||
// The message must describe what the commit actually contains. On every `open/`
|
||||
// repo STATE.md is gitignored, so the handoff commit carries only the explicit
|
||||
// --also paths — claiming a STATE.md update there made git history, the regime's
|
||||
// long-term log, systematically wrong about its own contents.
|
||||
function generateCommitMessage(statePath, root, includesState) {
|
||||
function generateCommitMessage(statePath, root) {
|
||||
const name = root ? basename(root) : basename(dirname(statePath));
|
||||
return includesState
|
||||
? `docs(${name}): oppdater STATE.md (session handoff)`
|
||||
: `chore(${name}): session handoff (STATE.md local-only, ikke committet)`;
|
||||
return `docs(${name}): oppdater STATE.md (session handoff)`;
|
||||
}
|
||||
|
||||
function doCommit(cwd, args, errors) {
|
||||
|
|
@ -215,20 +185,8 @@ function doCommit(cwd, args, errors) {
|
|||
|
||||
// Build the stage list. CRITICAL: never `git add -A` — stage ONLY STATE.md
|
||||
// (when it is tracked, i.e. not gitignored) plus any explicit --also paths.
|
||||
// Same gate as --plan: never stage STATE.md onto a public remote. --also paths
|
||||
// stay honoured — the operator named those explicitly, and the gate protects
|
||||
// STATE.md specifically, not the commit as a whole.
|
||||
const remoteUrl = gitOk('git remote get-url origin 2>/dev/null', { cwd });
|
||||
const remoteClass = classifyRemote(remoteUrl);
|
||||
const leakWarning = leakBlock({
|
||||
shouldBeLocalOnly: remoteClass !== 'private', stateGitignored, remoteClass, remoteUrl,
|
||||
});
|
||||
|
||||
const stageList = [];
|
||||
if (leakWarning) {
|
||||
errors.push(leakWarning);
|
||||
actions.push('state-leak-blocked (STATE.md ikke gitignored på offentlig remote — ikke staget)');
|
||||
} else if (!stateGitignored) {
|
||||
if (!stateGitignored) {
|
||||
if (existsSync(statePath)) stageList.push(statePath);
|
||||
else errors.push(`STATE.md finnes ikke på ${statePath} — skriv den før commit`);
|
||||
} else {
|
||||
|
|
@ -241,11 +199,11 @@ function doCommit(cwd, args, errors) {
|
|||
}
|
||||
|
||||
if (stageList.length === 0) {
|
||||
actions.push('intet-å-committe (STATE.md ikke committerbar og ingen --also-stier)');
|
||||
actions.push('intet-å-committe (STATE.md gitignored og ingen --also-stier)');
|
||||
return { mode: 'commit', actions_taken: actions, errors, git_status: git };
|
||||
}
|
||||
|
||||
const message = args.message || generateCommitMessage(statePath, root, stageList.includes(statePath));
|
||||
const message = args.message || generateCommitMessage(statePath, root);
|
||||
|
||||
try {
|
||||
execFileSync('git', ['add', '--', ...stageList], { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
|
||||
|
|
|
|||
|
|
@ -49,13 +49,8 @@ Parse JSON:
|
|||
"errors": []
|
||||
}
|
||||
```
|
||||
Hvis `errors[]` ikke er tom: rapporter og **STOPP** — ikke skriv STATE.md, ikke commit.
|
||||
|
||||
`leak_warning` er ett av dem, og det er en hard gate, ikke et varsel: er remoten offentlig
|
||||
mens STATE.md ennå IKKE er gitignored, er det å fortsette nettopp det som lekker intern
|
||||
state-of-play. Det er også tilstanden et ferskt `open/`-repo starter i. Si fra til bruker
|
||||
med remedien i klartekst — legg `STATE.md` i `.gitignore` — og kjør rituelet på nytt
|
||||
etterpå. Skriptet nekter uansett å stage STATE.md i denne tilstanden (`state-leak-blocked`).
|
||||
Hvis `errors[]` ikke er tom: rapporter og stopp. Hvis `leak_warning` er satt: nevn det
|
||||
for bruker (STATE.md burde vært gitignored på denne remoten).
|
||||
|
||||
### 3. Rut neste økt (FØR du skriver STATE.md)
|
||||
Bestem først HVA «👉 NESTE» skal si — selve arbeidet neste økt skal gjøre. Så scorer du
|
||||
|
|
@ -103,14 +98,10 @@ Krav til innholdet:
|
|||
det handlingsrettede. Operatøren skal aldri måtte lete.
|
||||
- **De tre kommentar-linjene MÅ stå på ÉN linje hver** — aldri brutt over flere, aldri
|
||||
som YAML-blokk. `board.sh` leser første linje under overskriften som ikke er blank,
|
||||
ikke en overskrift og ikke er del av en HTML-kommentar, og viser den som repoets neste
|
||||
steg på tvers av alle repo. Den sporer nå kommentaren til sin **closer** (repo-mailbox
|
||||
0.20.3), så en brukket linje river ikke lenger i seg tavlens neste steg — regelen står
|
||||
fordi den fortsatte risikoen er reell: en `rationale=` som selv inneholder `-->`
|
||||
avslutter sin egen kommentar for tidlig, og da er det kommentar-innmat som havner på
|
||||
tavlen. Skriv aldri closer-sekvensen inne i en rationale. `route-last` utelates helt
|
||||
hvis ett av de fire feltene er ukjent — en gjettet verdi leses tilbake senere som en
|
||||
måling.
|
||||
ikke en overskrift og ikke starter med `<!--`, og viser den som repoets neste steg på
|
||||
tvers av alle repo. En brukket `rationale=` erstatter derfor neste steg på tavlen med
|
||||
søppel. `route-last` utelates helt hvis ett av de fire feltene er ukjent — en gjettet
|
||||
verdi leses tilbake senere som en måling.
|
||||
- **Board-linjen er den eneste kilden til hvem repoet venter PÅ** (`blocked-on`).
|
||||
Innboks-tall betyr det motsatte: at andre venter på DEG.
|
||||
- Konkret, ikke vagt. «Kjør `node --test tests/`, bekreft grønn, så release-cut» — ikke
|
||||
|
|
@ -177,12 +168,10 @@ avslutningsinstruksen — ingen av dem er valgfrie):
|
|||
## Begrensninger / antakelser (smoke-test)
|
||||
|
||||
- `disable-model-invocation: true` har en åpen issue (#26251) som potensielt kan blokkere
|
||||
user-invocation. **Fortsatt uverifisert** — smoke-testen 2026-08-09 kjørte pipelinen mot
|
||||
ekte repo, men kunne ikke teste selve slash-kommandoen. Smoke-test den etter installasjon.
|
||||
user-invocation. Smoke-test at `/graceful-handoff` fungerer etter installasjon.
|
||||
- Remote-klassifisering er heuristisk (`open/`/`github` → offentlig). Den autoritative
|
||||
commit-beslutningen er `git check-ignore STATE.md`. Er de to inkonsistente, stopper
|
||||
rituelet (steg 2) og skriptet nekter å stage STATE.md — feilklassifisering kan derfor
|
||||
koste deg en ekstra runde, men aldri en lekkasje.
|
||||
commit-beslutningen er likevel `git check-ignore STATE.md` — så feilklassifisering
|
||||
fører ikke til lekkasje, kun til et `leak_warning` hvis konfigurasjonen er inkonsistent.
|
||||
- **`repo-mailbox` er en myk avhengighet, ikke en hard.** Steg 3 invokerer
|
||||
`repo-mailbox:route` via Skill-verktøyet. To ting er ikke verifisert her: at
|
||||
`repo-mailbox` i det hele tatt er installert i et gitt repo, og at en `Skill`-oppføring
|
||||
|
|
|
|||
|
|
@ -10,9 +10,9 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
|
|||
const MANIFEST = join(__dirname, '..', '.claude-plugin', 'plugin.json');
|
||||
const CHANGELOG = join(__dirname, '..', 'CHANGELOG.md');
|
||||
|
||||
test('plugin.json version is 3.2.1', () => {
|
||||
test('plugin.json version is 3.2.0', () => {
|
||||
const m = JSON.parse(readFileSync(MANIFEST, 'utf-8'));
|
||||
assert.equal(m.version, '3.2.1');
|
||||
assert.equal(m.version, '3.2.0');
|
||||
});
|
||||
|
||||
test('CHANGELOG has a [3.2.0] entry describing the ritual sync', () => {
|
||||
|
|
|
|||
|
|
@ -118,54 +118,6 @@ test('--plan: private remote → should_commit_state true, not local-only', asyn
|
|||
rmSync(repo, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
test('--plan: dirty_files keeps the first character of a worktree-only change', async () => {
|
||||
// Regression (smoke-test 2026-08-09): `git status --porcelain` encodes the
|
||||
// worktree status in column 2, so a modified-but-unstaged file is " M path".
|
||||
// gitOk() trimmed the whole command output, eating that leading space, and
|
||||
// the fixed slice(3) then ate the first character of the FIRST path:
|
||||
// "app.js" was reported as "pp.js". Only the first line is affected, which is
|
||||
// why it survived every existing test — none asserted dirty_files values.
|
||||
const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/ktg/secret.git' });
|
||||
writeFileSync(join(repo, 'README.md'), '# test modified\n', 'utf-8'); // tracked → " M README.md"
|
||||
writeFileSync(join(repo, 'zz-untracked.txt'), 'x\n', 'utf-8'); // sorts after → "?? zz-..."
|
||||
const result = await runPipeline(repo, ['--plan']);
|
||||
const json = JSON.parse(result.stdout);
|
||||
assert.ok(
|
||||
json.dirty_files.includes('README.md'),
|
||||
`first dirty path truncated: ${JSON.stringify(json.dirty_files)}`
|
||||
);
|
||||
assert.ok(json.dirty_files.includes('zz-untracked.txt'), 'untracked path missing');
|
||||
rmSync(repo, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
// ---------- leak hard-gate (public remote + STATE.md not gitignored) ----------
|
||||
|
||||
test('--plan: public remote + STATE not gitignored BLOCKS the ritual (errors, no commit)', async () => {
|
||||
const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/open/foo.git' });
|
||||
const result = await runPipeline(repo, ['--plan']);
|
||||
const json = JSON.parse(result.stdout);
|
||||
assert.equal(json.should_commit_state, false, 'must not advertise STATE.md as committable');
|
||||
assert.ok(
|
||||
json.errors.some(e => /gitignore/i.test(e)),
|
||||
`expected a blocking leak error naming the remedy, got ${JSON.stringify(json.errors)}`
|
||||
);
|
||||
rmSync(repo, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
test('--commit refuses to stage STATE.md on a public remote when it is not gitignored', async () => {
|
||||
const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/open/foo.git' });
|
||||
writeFileSync(join(repo, 'STATE.md'), '# STATE would leak\n');
|
||||
const result = await runPipeline(repo, ['--commit']);
|
||||
const json = JSON.parse(result.stdout);
|
||||
const tracked = execFileSync('git', ['ls-files', 'STATE.md'], { cwd: repo, encoding: 'utf-8' }).trim();
|
||||
assert.equal(tracked, '', 'STATE.md must never become tracked on a public remote');
|
||||
assert.ok(
|
||||
json.errors.some(e => /gitignore/i.test(e)),
|
||||
`expected a blocking leak error, got ${JSON.stringify(json.errors)}`
|
||||
);
|
||||
rmSync(repo, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
// ---------- --commit ----------
|
||||
|
||||
test('--commit on private repo stages and commits ONLY STATE.md', async () => {
|
||||
|
|
@ -223,26 +175,6 @@ test('--commit on public repo does NOT commit gitignored STATE.md', async () =>
|
|||
rmSync(repo, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
test('--commit message does not claim a STATE.md update when STATE.md was skipped', async () => {
|
||||
// On every `open/` repo STATE.md is gitignored, so the handoff commit carries
|
||||
// only the explicit --also paths. The message claimed "oppdater STATE.md"
|
||||
// regardless, making git history — the regime's long-term log — systematically
|
||||
// wrong about what the commit contains.
|
||||
const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/open/foo.git', gitignoreState: true });
|
||||
writeFileSync(join(repo, 'STATE.md'), '# STATE local-only\n');
|
||||
writeFileSync(join(repo, 'code.mjs'), 'export const x = 1;\n');
|
||||
const result = await runPipeline(repo, ['--commit', '--also', 'code.mjs']);
|
||||
const json = JSON.parse(result.stdout);
|
||||
assert.ok(json.actions_taken.includes('committed'), `expected a commit, got ${JSON.stringify(json.actions_taken)}`);
|
||||
assert.doesNotMatch(
|
||||
json.commit_message,
|
||||
/oppdater STATE\.md/,
|
||||
`commit claims a STATE.md update it does not contain: ${json.commit_message}`
|
||||
);
|
||||
assert.match(json.commit_message, /local-only/, 'message should say why STATE.md is absent');
|
||||
rmSync(repo, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
test('--commit on detached HEAD is detected (no commit attempted)', async () => {
|
||||
const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/ktg/secret.git' });
|
||||
const sha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: repo, encoding: 'utf-8' }).trim();
|
||||
|
|
|
|||
|
|
@ -94,23 +94,6 @@ test('SKILL.md warns that the three comment lines must stay single-line (board.s
|
|||
assert.match(s, /ÉN linje/);
|
||||
});
|
||||
|
||||
test('the single-line rule no longer rests on a consequence board.sh has since fixed', () => {
|
||||
// repo-mailbox 0.20.3's board.sh tracks an HTML comment to its closer, so a
|
||||
// wrapped rationale no longer leaks comment internals into the board excerpt.
|
||||
// The rule stands; the stated consequence had to stop being the reason.
|
||||
const s = skill();
|
||||
assert.doesNotMatch(s, /erstatter derfor neste steg på tavlen med søppel/);
|
||||
assert.match(s, /closer/, 'must name the real remaining risk (a rationale containing the closer)');
|
||||
});
|
||||
|
||||
test('SKILL.md hard-gates the leak case instead of merely mentioning it', () => {
|
||||
const s = skill();
|
||||
const step2 = s.slice(s.indexOf('### 2.'), s.indexOf('### 3.'));
|
||||
assert.match(step2, /leak_warning/);
|
||||
assert.match(step2, /STOPP|stopp/, 'step 2 must stop the ritual, not just report');
|
||||
assert.match(step2, /\.gitignore/, 'step 2 must name the remedy');
|
||||
});
|
||||
|
||||
test('SKILL.md routes the next session via the repo-mailbox route skill', () => {
|
||||
assert.match(skill(), /repo-mailbox:route/);
|
||||
});
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue