From d8966ec258f1bab070c914342dc248636ca8c9f3 Mon Sep 17 00:00:00 2001 From: "ruleofcode.dev team" Date: Sat, 8 Aug 2026 16:07:49 +0300 Subject: [PATCH] =?UTF-8?q?chore(release):=20v7.17.6=20=E2=80=94=20hook=20?= =?UTF-8?q?exec=20bit,=20clean=20lockfile,=20schema=20docs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps package.json and hooks/installer VERSION to 7.17.6 and regenerates the tracked .husky hooks. schemaVersion stays 2. Ships what is already on develop: - fix(laws): Git Hook Compliance called every hook of every Windows project non-executable — a violation `chmod +x` could not fix, since NTFS has no such bit. The mode now comes from the git index, which answers the same question on every platform, and only names git runs as hooks are judged. The real defect it was built to catch is kept: hooks committed at 100644 are not executable on a Linux clone. - fix(deps): the lockfile pinned three transitive versions with high-severity advisories, so CI tested against them. Consumers were never exposed — a fresh install of the published package resolves the patched versions. package.json is unchanged. - docs: the law card schema, and why `stack` and a `satisfiedBy` key are two axes rather than one vocabulary. Gate: eslint 0, jest full suite, canary green (py100/ng136/node78). Self-audit: exit 0. --- .husky/commit-msg | 6 +++--- .husky/pre-commit | 4 ++-- .husky/pre-push | 4 ++-- CHANGELOG.md | 44 ++++++++++++++++++++++++++++++++++++++++++ package.json | 2 +- src/hooks/installer.ts | 2 +- 6 files changed, 53 insertions(+), 9 deletions(-) diff --git a/.husky/commit-msg b/.husky/commit-msg index c676911..c9016ad 100755 --- a/.husky/commit-msg +++ b/.husky/commit-msg @@ -1,4 +1,4 @@ -# RuleOfCode v7.17.5 Commit Message Validation +# RuleOfCode v7.17.6 Commit Message Validation # Config-driven validation with 1 pattern(s) # husky v9+ native hook (no deprecated v8 boilerplate) @@ -28,7 +28,7 @@ fi if [ "$VALID" = false ]; then echo "❌ Invalid commit message format!" echo "" - echo "🏛️ RuleOfCode v7.17.5 Constitutional Commit Message Format:" + echo "🏛️ RuleOfCode v7.17.6 Constitutional Commit Message Format:" echo " Your message must match one of the configured patterns" echo "" echo "Types: feat, fix, docs, style, refactor, test, chore, perf, ci, build, revert" @@ -68,4 +68,4 @@ if [ "$EXEMPT" = false ]; then fi fi -echo "✅ Commit message format validated (RuleOfCode v7.17.5)" +echo "✅ Commit message format validated (RuleOfCode v7.17.6)" diff --git a/.husky/pre-commit b/.husky/pre-commit index 2749bf6..661415b 100755 --- a/.husky/pre-commit +++ b/.husky/pre-commit @@ -1,5 +1,5 @@ -# RuleOfCode v7.17.5 Constitutional Checkpoint (husky v9+ native hook) -echo "🏛️ RuleOfCode v7.17.5 Constitutional Checkpoint with lint-staged" +# RuleOfCode v7.17.6 Constitutional Checkpoint (husky v9+ native hook) +echo "🏛️ RuleOfCode v7.17.6 Constitutional Checkpoint with lint-staged" npx lint-staged # Run constitutional audit on staged files diff --git a/.husky/pre-push b/.husky/pre-push index c42c80a..54a4fc3 100755 --- a/.husky/pre-push +++ b/.husky/pre-push @@ -1,5 +1,5 @@ -# RuleOfCode v7.17.5 Constitutional Compliance Pre-Push Hook (husky v9+ native) -echo "🏛️ RuleOfCode v7.17.5 Constitutional Checkpoint - Pre-Push Mode" +# RuleOfCode v7.17.6 Constitutional Compliance Pre-Push Hook (husky v9+ native) +echo "🏛️ RuleOfCode v7.17.6 Constitutional Checkpoint - Pre-Push Mode" echo "═════════════════════════════════════════════════════" # Run full RuleOfCode audit before push diff --git a/CHANGELOG.md b/CHANGELOG.md index b9b3848..7cb2ee5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,50 @@ All notable changes to RuleOfCode will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [7.17.6] - 2026-08-08 + +### 🐛 Fixed — the hook executable bit is read from the git index, not the filesystem + +Git Hook Compliance called **every hook of every Windows project** non-executable, and +the consumer could not act on it. NTFS carries no POSIX execute bit: `fs.stat().mode` is +`0o666` for every file there and `chmod` is a no-op, so `chmod +x` — the fix the law +printed — changes nothing. It also judged files git never runs: husky keeps +`.gitignore`, `husky.sh` and `h` in its hooks directory. + +The bit now comes from the **git index** (`100755` / `100644`), which answers the same +question identically on every platform and only for files a consumer can commit a mode +for. Untracked hooks are not judged at all — husky ignores its generated `_` directory +wholesale, so no mode exists there for anyone to set. Only names git actually runs as +hooks are considered. + +**The concern behind the law was real and is kept.** Hooks committed at `100644` are not +executable when the repository is cloned on Linux. The committed layout is +`.husky/`, not the resolved hooks directory, so the check reads both — removing +the false positive without removing the true one. The suggestion is now actionable: +`git update-index --chmod=+x `. + +Three new `detectionLimits` entries declare what is consequently **not** checked. + +If a Windows build was failing this law, this is the fix — no config change needed. + +### 🔒 Security — dependency lockfile refreshed + +Development installs pinned minimatch 9.0.5, brace-expansion 2.0.2 and lodash 4.17.21 — +three high-severity advisories between them. **Consumers were never exposed**: the +package's caret ranges resolve the patched versions on a fresh install, verified against +the published tarball. Only this repository's lockfile was stale, which meant CI tested +against vulnerable dependencies. `npm audit` now reports zero. + +### 📄 Documentation — the law card schema + +`roc laws --json` exposes two fields that look like one vocabulary and are not: `stack` +answers **selection** (does this law run here), a `satisfiedBy` key answers **guidance** +(which technology the instructions are written for). They are orthogonal — no key maps +onto a single stack, and `angular` sits on TypeScript-stack and universal laws too. The +README now documents both axes and points renderers at `satisfiedByStacks.stackToKey`, +which the JSON already shipped undocumented. It also states plainly that all 58 frontend +laws carry Angular guidance only. + ## [7.17.5] - 2026-08-08 ### 🐛 Fixed — three git laws were blind to linked worktrees diff --git a/package.json b/package.json index ddf5c90..ea04ef1 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "ruleofcode", - "version": "7.17.5", + "version": "7.17.6", "description": "Constitutional-compliance CLI — audit a codebase against a catalog of laws and get one honest pass-or-fail verdict, with git hooks. Supports TypeScript, Angular and Python.", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/src/hooks/installer.ts b/src/hooks/installer.ts index 7f460bd..4032640 100644 --- a/src/hooks/installer.ts +++ b/src/hooks/installer.ts @@ -17,7 +17,7 @@ export interface HooksInstallOptions { } export class GitHooksInstaller { - private static readonly VERSION = '7.17.5'; + private static readonly VERSION = '7.17.6'; private static readonly PACKAGE_JSON_FILE = 'package.json'; private static readonly HUSKY_DIR = '.husky'; private static readonly PRE_COMMIT_HOOK = 'pre-commit';