From 51afe9bd198388fee1d54901421cedf49cede45f Mon Sep 17 00:00:00 2001
From: Bastien Chanot <git@bchanot.fr>
Date: Tue, 23 Jun 2026 15:29:01 +0200
Subject: [PATCH] build(install): auto-revert curated config after install
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

graphify's installer rewrites CLAUDE.md + .claude/settings.json (clobbers
the curated graphify section, drops the "This repo only" header, injects
aggressive MANDATORY pre-tool hooks) and `claude plugin install` flips
enable-states in settings.json. These 3 files are hand-curated, never
installer-owned.

Snapshot them at the top of install-plugins.sh and restore on EXIT (trap)
so `make install` / `make plugin` leaves them exactly as found. Pre-existing
local edits are preserved; only installer drift is undone. Verified with an
isolated drift→restore test. update-all.sh needs no guard — it only runs
`claude plugin update` (no enable flips) and never re-runs graphify's
CLAUDE.md/settings integration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UyNYwD4UccVw9ZCFZyJX55
---
 install-plugins.sh | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/install-plugins.sh b/install-plugins.sh
index a4d466f..22afff3 100644
--- a/install-plugins.sh
+++ b/install-plugins.sh
@@ -29,6 +29,42 @@ fi
 # shellcheck source=lib/detect-plugins.sh
 source "$REPO/lib/detect-plugins.sh"
 
+# ── Guard hand-curated config against installer drift ────────
+# graphify's installer (Step 7) rewrites CLAUDE.md + .claude/settings.json
+# (clobbers the curated graphify section + injects aggressive MANDATORY
+# hooks), and `claude plugin install` (Step 5) flips enable-states in
+# settings.json. These 3 files are maintained by hand + commit, never by
+# the installer. Snapshot them now and restore on exit so a run leaves them
+# exactly as it found them. Pre-existing local edits are preserved; only the
+# installer's drift is undone. NOTE: this makes these files install-immutable
+# — anything the installer should add to them must be committed by hand.
+GUARDED_CONFIGS=("CLAUDE.md" ".claude/settings.json" "settings.json")
+CFG_SNAPSHOT="$(mktemp -d 2>/dev/null || true)"
+
+restore_curated_configs() {
+  [ -n "$CFG_SNAPSHOT" ] || return 0
+  local f
+  for f in "${GUARDED_CONFIGS[@]}"; do
+    if [ -f "$CFG_SNAPSHOT/$f" ] && ! cmp -s "$CFG_SNAPSHOT/$f" "$REPO/$f"; then
+      cp "$CFG_SNAPSHOT/$f" "$REPO/$f"
+      info "Reverted installer drift in $f (curated config kept as committed)"
+    fi
+  done
+  rm -rf "$CFG_SNAPSHOT"
+}
+
+if [ -n "$CFG_SNAPSHOT" ]; then
+  for _cfg in "${GUARDED_CONFIGS[@]}"; do
+    if [ -f "$REPO/$_cfg" ]; then
+      mkdir -p "$CFG_SNAPSHOT/$(dirname "$_cfg")"
+      cp "$REPO/$_cfg" "$CFG_SNAPSHOT/$_cfg"
+    fi
+  done
+  trap restore_curated_configs EXIT
+else
+  warn "Config guard disabled (mktemp failed) — CLAUDE.md/settings may drift"
+fi
+
 # Read pinned version from plugins.lock.json
 # Usage: pinned_version "rtk" → prints version string or "latest"
 pinned_version() {