Defame1297
ea119d83b0
B1: check-skill-version-bump.sh resolves every merge-base with `git merge-base
--all` instead of the single base git happens to pick. A criss-cross history has
two, so the verdict turned on that choice: a skill byte-identical to main's tip
could still be reported "not above merge-base" / "not above main tip" and fail a
push that should pass. A skill now counts as changed only when it differs from
EVERY base, and its version must exceed the version at every base it exists at
as well as at the main tip; with more than one base the failure names which one.
Case 40 in tests/test-skill-version-bump.sh builds the criss-cross fixture and
pins both directions.
B2: check-apm-current.sh no longer assumes the remote default branch is `main`
when origin/HEAD is unset. A checkout whose default is `master` was standing on
its default branch and being told "this is a feature branch, so discard it" --
to throw away a real lock update. With origin/HEAD unset nothing is asserted and
the neutral advice stands. tests/test-apm-current-hook.sh covers the unset case
on both `main` and `master`.
#4: the required-frontmatter checks folded into skill-size-check.sh by c8a7c9e
were untested apart from the leading-zero shape -- mutating the missing-version
ERROR into a no-op left every suite green. tests/test-adr0020-frontmatter.sh now
pins name presence and non-emptiness, metadata.version presence and semver
shape, and the four grep defects the deleted test-skill-frontmatter.sh named.
#5: nothing asked whether a Vale rule still MATCHES anything -- rewriting
CompositionNote.yml's tokens to match nothing left test-vale-wrap.sh at 63/63.
Case 35 enumerates the rule files under the Kyberforge* style directories at run
time, requires an alert from each on its own fixture, and fails when a
discovered rule has no fixture row. The stale comment at case 31 is corrected.
#6: tests/run-tests.sh --strict exited 0 when discovery found no test-*.sh at
all; strictness only ever acted on skips, and with no suites there were none. It
now cross-checks the git index the way run-bats.sh does and fails
unconditionally on an empty set, naming the search root.
N9: the skill-size-check hook description in .pre-commit-config.yaml covered
only the size, context-budget and boundary-target gates. It now also names the
required frontmatter fields, matching docs/spec/gates.md.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NwD8Egs5r4ndqeFLmhusX2
87 lines
4.7 KiB
Bash
Executable File
87 lines
4.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SessionStart: keep an apm-consumed install level with its remote.
|
|
#
|
|
# Packages declared as unpinned git refs resolve against the remote default
|
|
# branch, so the deployed .claude/skills/ and .claude/agents/ go stale the
|
|
# moment anyone merges. The staleness bites when a session loads skills, which
|
|
# is why this runs at SessionStart rather than off a git hook — a pull is
|
|
# neither necessary nor sufficient for the install to have drifted.
|
|
#
|
|
# Refreshes in place and asks the host to re-scan, so the running session picks
|
|
# the new content up without a restart.
|
|
#
|
|
# Inert in any project that does not consume packages through apm.
|
|
set -uo pipefail
|
|
|
|
# Anchor on the project root, not the session's cwd. Claude Code exports
|
|
# CLAUDE_PROJECT_DIR for SessionStart hooks; a session opened in a subdirectory
|
|
# would otherwise miss the lockfile, no-op silently, and — worse — run the apm
|
|
# calls below against that wrong directory. Fall back to the cwd when the
|
|
# variable is absent, which keeps the hook inert-but-harmless under a host that
|
|
# does not set it.
|
|
project_dir="${CLAUDE_PROJECT_DIR:-$PWD}"
|
|
|
|
# No lockfile means nothing was installed through apm here — e.g. a host that
|
|
# installed this plugin natively. Say nothing and cost nothing.
|
|
[[ -f "$project_dir/apm.lock.yaml" ]] || exit 0
|
|
command -v apm > /dev/null 2>&1 || exit 0
|
|
|
|
# Every apm call below must see the same directory the guard just checked —
|
|
# `apm outdated` and `apm update` both resolve the lockfile from the cwd.
|
|
cd "$project_dir" || exit 0
|
|
|
|
# `apm outdated` exits 0 whether or not anything is stale, so the answer has to
|
|
# come from its output. ~0.7s against six remote refs; a hung remote must not
|
|
# hold the session open.
|
|
#
|
|
# There is no --json/machine-readable flag on `apm outdated` (verified against
|
|
# apm 0.28.0), so the phrase match is forced rather than chosen. Note the
|
|
# singular: apm prints "1 outdated dependency found" when exactly one package is
|
|
# behind, so matching only "dependencies" would silently miss a one-package
|
|
# drift. tests/test-apm-current-hook.sh pins both spellings against the real apm.
|
|
outdated_output="$(timeout 60 apm outdated 2>&1)" || exit 0
|
|
grep -qE 'outdated dependenc(y|ies) found' <<< "$outdated_output" || exit 0
|
|
|
|
stale_count="$(grep -oE '[0-9]+ outdated dependenc(y|ies) found' <<< "$outdated_output" | grep -oE '^[0-9]+' || true)"
|
|
[[ "$stale_count" =~ ^[0-9]+$ ]] || stale_count="some"
|
|
|
|
# Only ever emit fixed text plus a digit-checked count — never interpolate
|
|
# command output into the JSON, which would need escaping this cannot do safely.
|
|
emit() {
|
|
printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","reloadSkills":%s,"additionalContext":"%s"}}\n' "$1" "$2"
|
|
}
|
|
|
|
# What to do with the rewritten lock depends on the branch (ADR-0019): on the
|
|
# default branch it is a real update to commit or discard; on a feature branch it
|
|
# is churn unrelated to the branch and should be discarded. The branch name only
|
|
# selects between fixed strings and is never interpolated. Outside a git checkout,
|
|
# or on a detached HEAD, the neutral advice stands.
|
|
#
|
|
# So does an UNSET origin/HEAD, which is the common state: git only writes it on
|
|
# clone, and `git remote add` never does. The fallback here used to be `main`,
|
|
# which is a guess, and it is wrong in exactly the repos that would notice — a
|
|
# checkout whose default branch is `master` was told "this is a feature branch,
|
|
# so discard it" while standing on its default branch, i.e. told to throw away a
|
|
# real lock update. There is no cheap way to learn the remote's default without
|
|
# the network, so nothing is asserted: the advice stays neutral and the reader
|
|
# decides.
|
|
lock_advice="commit it or discard it deliberately."
|
|
current_branch="$(git symbolic-ref --short -q HEAD 2> /dev/null || true)"
|
|
default_branch="$(git symbolic-ref --short -q refs/remotes/origin/HEAD 2> /dev/null || true)"
|
|
default_branch="${default_branch#origin/}"
|
|
if [[ -n "$current_branch" && -n "$default_branch" ]]; then
|
|
if [[ "$current_branch" == "$default_branch" ]]; then
|
|
lock_advice="this is the default branch, so commit it or discard it deliberately."
|
|
else
|
|
lock_advice="this is a feature branch, so discard it: git checkout -- apm.lock.yaml && apm install"
|
|
fi
|
|
fi
|
|
|
|
if timeout 300 apm update --yes > /dev/null 2>&1; then
|
|
emit true "apm install was ${stale_count} package(s) behind the remote default branch and has been refreshed automatically; skills and agents were redeployed and re-scanned. apm.lock.yaml has been rewritten and is now a modified file in the working tree - ${lock_advice}"
|
|
else
|
|
emit false "apm install is ${stale_count} package(s) behind the remote default branch and the automatic refresh failed. Deployed skills and agents may be stale. Run: apm update --yes"
|
|
fi
|
|
|
|
exit 0
|