@adia-ai/adia-ui-forge 0.8.4 → 0.8.5

package/skills/adia-release/references/recovery-paths.md

@@ -24,6 +24,8 @@
 
 **Shape:** multiple unpushed `release(*): vX.Y.Z` commits since the last published tag; operator asks to "publish what's accumulated."
 
+`release-pack.mjs --mode batch` hard-rejects and points here rather than attempting this — each version tags at its OWN release-commit SHA (not `main`'s single post-merge HEAD) and publish order must be enforced across versions, which the single-version orchestrator has no model for. This IS the manual procedure; there is no mechanized alternative.
+
 **Resolution:**
 
 1. Order the release commits oldest → newest.
@@ -36,7 +38,7 @@
 
 **Shape:** source + CHANGELOG entries landed under `## [Unreleased]`, no bump, no release commit.
 
-**Resolution:** [`cut-procedure.md`](cut-procedure.md) Variant B; `scripts/promote-unreleased.mjs` mechanizes the heading swap; fresh blocks per [`changelog-discipline.md`](changelog-discipline.md) §Authoring.
+**Resolution:** [`cut-procedure.md`](cut-procedure.md) Variant B; `` `${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/promote-unreleased.mjs` `` mechanizes the heading swap; fresh blocks per [`changelog-discipline.md`](changelog-discipline.md) §Authoring.
 
 ## §Scenario 4 — `[Unreleased]` extension (early cut + entangled fix)
 
@@ -72,7 +74,7 @@ node "${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/dispatch-publish.mjs" \
   --version X.Y.Z --verify-triggered   # re-dispatches ONLY packages with no run; idempotent
 ```
 
-For a batch, preserve npm-latest ordering (`--after <prev>`). Verify against the registry, not the workflows. **Prevention:** push tags one-at-a-time ([`cut-procedure.md`](cut-procedure.md) §Step 8); `release-pack.mjs` does this automatically and follows with `--verify-triggered`.
+For a batch, preserve npm-latest ordering (`--after <prev>`). Verify against the registry, not the workflows. **Prevention:** push tags one-at-a-time ([`cut-procedure.md`](cut-procedure.md) §Step 8); `` `${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/release-pack.mjs` `` does this automatically and follows with `--verify-triggered`.
 
 ## §Scenario 8 — Cut on the wrong branch
 

package/skills/adia-release/scripts/bump.mjs

@@ -140,4 +140,35 @@ function main() {
   }
 }
 
-main();
+// Fixture-locked proof of the core transform, entirely in-memory (no real
+// package.json files touched) — the `dry: true` path below asserts the
+// script never calls fs.writeFileSync by pointing at a path whose directory
+// doesn't exist; a latent write bug would throw ENOENT instead of passing.
+function selftest() {
+  const fake = [{
+    pkg: 'packages/web-components',
+    path: '/nonexistent-fixture-dir/package.json',
+    txt: '{\n  "name": "@adia-ai/web-components",\n  "version": "0.8.4"\n}\n',
+    version: '0.8.4',
+  }];
+  if (!validateAllAtFrom(fake, '0.8.4')) {
+    console.error('selftest FAIL: validateAllAtFrom rejected a matching version'); process.exit(1);
+  }
+  if (validateAllAtFrom(fake, '0.8.3')) {
+    console.error('selftest FAIL: validateAllAtFrom accepted a mismatched version'); process.exit(1);
+  }
+  const bumped = bumpAll(fake, '0.8.4', '0.8.5', true /* dry */);
+  if (bumped !== fake.length) {
+    console.error('selftest FAIL: bumpAll(dry) did not report all packages bumped'); process.exit(1);
+  }
+  // Corrupted package.json (regex has nothing to match) must be caught, not silently skipped.
+  const corrupted = [{ pkg: 'packages/x', path: '/nonexistent-fixture-dir/x/package.json', txt: '{}', version: '0.8.4' }];
+  if (bumpAll(corrupted, '0.8.4', '0.8.5', true) !== -1) {
+    console.error('selftest FAIL: corrupted package.json (no version match) not caught'); process.exit(1);
+  }
+  console.log('selftest OK');
+}
+
+const topArgv = process.argv.slice(2);
+if (topArgv[0] === 'selftest') selftest();
+else main();

package/skills/adia-release/scripts/dispatch-publish.mjs

@@ -199,19 +199,57 @@ async function main() {
   }
   console.log(`\n[dispatch] ${succeeded}/${PACKAGES.length} dispatched ${args.dry ? '(dry)' : ''}`);
 
-  if (!args.dry) {
-    console.log(`\n[next] wait for workflows to settle:`);
-    console.log(`  until [ "$(gh run list --workflow=publish-a2ui-validator.yml --limit 1 --json status -q '.[0].status')" = "completed" ]; do sleep 5; done`);
-    console.log(`\n[next] verify all 11 succeeded:`);
-    console.log(`  for pkg in ${PACKAGES.join(' ')}; do`);
-    console.log(`    gh run list --workflow=publish-$pkg.yml --limit 1 --json conclusion -q '.[0].conclusion'`);
-    console.log(`  done`);
+  // defect-2 (forge-campaign gh#268 audit): this used to print a "[next] wait
+  // for / verify" block phrased as a to-do EVEN THOUGH the dispatch above
+  // already fired — an operator's agent read it as "publish hasn't happened
+  // yet" and went back to refine CHANGELOGs post-publish. State what WAS
+  // done; offer monitoring as optional, not required.
+  if (!args.dry && succeeded > 0) {
+    // CodeRabbit (PR #289): "RUNNING" overclaimed — `gh workflow run` only
+    // confirms the dispatch was SUBMITTED; the run may still queue, or fail
+    // to materialize (bad ref, disabled workflow). "dispatched" is what we
+    // actually know happened; no further action is still true either way —
+    // the point stands, the verb doesn't overreach.
+    console.log(`\n✓ ${succeeded} publish workflow(s) dispatched above — no further action required.`);
+    console.log('  Optional — monitor until they settle:');
+    console.log(`    until [ "$(gh run list --workflow=publish-a2ui-validator.yml --limit 1 --json status -q '.[0].status')" = "completed" ]; do sleep 5; done`);
+    console.log('  Optional — check each conclusion once settled:');
+    console.log(`    for pkg in ${PACKAGES.join(' ')}; do`);
+    console.log(`      gh run list --workflow=publish-$pkg.yml --limit 1 --json conclusion -q '.[0].conclusion'`);
+    console.log(`    done`);
   }
 
   if (succeeded !== PACKAGES.length) process.exit(1);
 }
 
-main().catch((e) => {
-  console.error(`error: ${e.message}`);
-  process.exit(1);
-});
+// dry mode never shells out (run()/dispatch() short-circuit before
+// execSync), so this exercises the real functions without touching gh/npm.
+function selftest() {
+  let allOk = true;
+  for (const pkg of PACKAGES) {
+    if (!dispatch(pkg, '9.9.9', true /* dry */)) allOk = false;
+  }
+  if (!allOk) { console.error('selftest FAIL: dry dispatch() reported a failure for at least one package'); process.exit(1); }
+
+  // triggeredForTag() in dry mode must conservatively report "not yet
+  // triggered" — verifyTriggeredAndRedispatch's whole point is to re-dispatch
+  // misses; silently assuming "triggered" would let a real miss through.
+  if (triggeredForTag('web-components', '9.9.9', true) !== false) {
+    console.error('selftest FAIL: dry triggeredForTag() must report false (conservative default)'); process.exit(1);
+  }
+
+  const rc = verifyTriggeredAndRedispatch('9.9.9', true);
+  if (rc !== 0) { console.error(`selftest FAIL: dry verifyTriggeredAndRedispatch() should report rc=0, got ${rc}`); process.exit(1); }
+
+  console.log('selftest OK');
+}
+
+const topArgv = process.argv.slice(2);
+if (topArgv[0] === 'selftest') {
+  selftest();
+} else {
+  main().catch((e) => {
+    console.error(`error: ${e.message}`);
+    process.exit(1);
+  });
+}

package/skills/adia-release/scripts/gate-roster.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+// gate-roster.mjs — the ONE ordered list of the pre-cut gate roster.
+//
+// H3 (forge-campaign gh#268 audit): release-pack.mjs's Step 3 pre-flight ran
+// only 12 of the 17 gates cut-procedure.md §3.1 declares as "every gate runs;
+// a subset = pre-flight failure" — the roster had drifted into two places
+// (the script's own hardcoded array + the doc's table) and only one of them
+// got the memo when gates were added. This module is the single source: the
+// doc's §3.1 table transcribes it, release-pack.mjs's step3PreFlight()
+// imports and runs it in full, and nothing else declares its own subset — a
+// gate can only be dropped by editing this file, which is the change the
+// doc and the script both need anyway.
+//
+// Usage:
+//   import { GATE_ROSTER } from './gate-roster.mjs';
+//   node gate-roster.mjs --list     # human-readable numbered roster (docs/CI use)
+//   node gate-roster.mjs --count    # just the count (drift check)
+
+import { fileURLToPath } from 'node:url';
+import { realpathSync } from 'node:fs';
+
+export const GATE_ROSTER = [
+  { n: 1,  cmd: 'node scripts/build/components.mjs --verify', what: 'yaml ↔ sidecar ↔ .d.ts' },
+  { n: 2,  cmd: 'npm run verify:traits',                      what: 'trait coverage' },
+  { n: 3,  cmd: 'npm run check:lockstep',                     what: 'version coherence' },
+  { n: 4,  cmd: 'npm run test:unit',                          what: 'vitest' },
+  { n: 5,  cmd: 'npm run typecheck',                          what: 'tsc --noEmit' },
+  { n: 6,  cmd: 'npm run check:demo-shells',                  what: 'demo imports cover composes:' },
+  { n: 7,  cmd: 'npm run check:lightningcss-build',           what: 'CSS minifies' },
+  { n: 8,  cmd: 'npm run check:css-bundles-fresh',             what: 'dist CSS matches source' },
+  { n: 9,  cmd: 'npm run check:js-bundles-fresh',              what: 'dist JS matches source' },
+  { n: 10, cmd: 'npm run smoke:engines',                       what: 'gen-UI engines' },
+  { n: 11, cmd: 'npm run smoke:register-engine',               what: 'register-engine 11/11' },
+  { n: 12, cmd: 'npm run verify:corpus',                       what: 'corpus 0 errors' },
+  { n: 13, cmd: 'npm run check:chunks-fresh',                  what: 'chunk index vs sources' },
+  { n: 14, cmd: 'npm run check:embeddings-fresh',              what: 'embeddings vs chunk index' },
+  { n: 15, cmd: 'npm run check:links',                         what: 'intra-repo links' },
+  { n: 16, cmd: 'npm run eval:diff -- --engine zettel',        what: 'eval floors' },
+  { n: 17, cmd: 'npm run dogfood:status',                      what: 'P0/P1 dogfood floor' },
+];
+
+// -- CLI ------------------------------------------------------------------
+// Only runs when invoked directly (not when imported by release-pack.mjs).
+// realpathSync BOTH sides (CodeRabbit, PR #289): a naive string/URL compare
+// breaks under a symlinked invocation — this skill is normally reached
+// through `.claude/skills/adia-release` -> `packages/plugins/adia-ui-forge/
+// skills/adia-release`, and Node resolves `import.meta.url` through that
+// symlink to the real file while `process.argv[1]` keeps the as-invoked
+// path, so an unresolved compare never matches even when this IS the entry
+// point. Verified directly (see embeddings-chunks.mjs's identical guard).
+const isMain = (() => {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+})();
+if (isMain) {
+  const args = new Set(process.argv.slice(2));
+  if (args.has('--count')) {
+    console.log(GATE_ROSTER.length);
+  } else if (args.has('--list') || args.size === 0) {
+    console.log(`${GATE_ROSTER.length}-gate pre-cut roster (source of truth — cut-procedure.md §3.1 transcribes this):\n`);
+    for (const g of GATE_ROSTER) {
+      console.log(`  ${String(g.n).padStart(2)}. ${g.cmd.padEnd(46)} # ${g.what}`);
+    }
+  } else {
+    console.log('Usage: node gate-roster.mjs [--list|--count]');
+  }
+}

package/skills/adia-release/scripts/insert-stub.mjs

@@ -16,6 +16,8 @@
 // cycles.
 
 import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 import process from 'node:process';
 import { resolvePackageChangelog } from './package-paths.mjs';
 
@@ -126,4 +128,36 @@ function main() {
   }
 }
 
-main();
+// Fixture-locked proof against a real (throwaway) temp directory.
+function selftest() {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'insert-stub-selftest-'));
+  try {
+    const dir = path.join(tmp, 'packages', 'llm');
+    fs.mkdirSync(dir, { recursive: true });
+    const clPath = path.join(dir, 'CHANGELOG.md');
+    const anchor = '## [0.1.0] — 2026-01-01';
+    fs.writeFileSync(clPath, `# C\n\n${anchor}\n\n- prior\n`);
+
+    const stub = buildStub('0.2.0', '2026-02-02', '@adia-ai/web-components', 'packages/web-components/CHANGELOG.md#020--2026-02-02');
+    const r1 = insertStub(tmp, 'llm', anchor, stub, '0.2.0', false);
+    if (r1 !== 'inserted') { console.error(`selftest FAIL: expected 'inserted', got '${r1}'`); process.exit(1); }
+    const out = fs.readFileSync(clPath, 'utf8');
+    if (!out.includes('## [0.2.0]')) { console.error('selftest FAIL: stub heading not written'); process.exit(1); }
+    if (out.indexOf('## [0.2.0]') > out.indexOf(anchor)) {
+      console.error('selftest FAIL: stub must land ABOVE the previous-version anchor, not below'); process.exit(1);
+    }
+
+    // Idempotency: re-inserting against an already-stubbed target must fail
+    // loudly, not create a duplicate [0.2.0] block.
+    const r2 = insertStub(tmp, 'llm', anchor, stub, '0.2.0', false);
+    if (r2 !== 'already-present') { console.error(`selftest FAIL: expected 'already-present' on re-run, got '${r2}'`); process.exit(1); }
+
+    console.log('selftest OK');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+const topArgv = process.argv.slice(2);
+if (topArgv[0] === 'selftest') selftest();
+else main();

package/skills/adia-release/scripts/promote-unreleased.mjs

@@ -20,6 +20,8 @@
 //   2  — bad args / file I/O error
 
 import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 import process from 'node:process';
 import { resolvePackageChangelog } from './package-paths.mjs';
 
@@ -86,4 +88,36 @@ function main() {
   }
 }
 
-main();
+// Fixture-locked proof against a real (throwaway) temp directory — promote()
+// does real fs.readFileSync/writeFileSync via resolvePackageChangelog, so a
+// pure in-memory test can't exercise it; a temp dir keeps this <1s and
+// touches nothing in the real repo.
+function selftest() {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'promote-unreleased-selftest-'));
+  try {
+    const dir = path.join(tmp, 'packages', 'web-components');
+    fs.mkdirSync(dir, { recursive: true });
+    const clPath = path.join(dir, 'CHANGELOG.md');
+    fs.writeFileSync(clPath, '# C\n\n## [Unreleased]\n\n### Fixed\n- x\n\n## [0.1.0] — 2026-01-01\n\n- y\n');
+
+    const r1 = promote(tmp, 'web-components', '0.2.0', '2026-02-02', false);
+    if (r1 !== 'promoted') { console.error(`selftest FAIL: expected 'promoted', got '${r1}'`); process.exit(1); }
+    const out = fs.readFileSync(clPath, 'utf8');
+    if (!out.includes('## [0.2.0] — 2026-02-02')) { console.error('selftest FAIL: new heading not written'); process.exit(1); }
+    if (out.includes('## [Unreleased]')) { console.error('selftest FAIL: [Unreleased] heading should have been renamed, not left behind'); process.exit(1); }
+    if (!out.includes('### Fixed\n- x')) { console.error('selftest FAIL: content under the heading must survive the rename'); process.exit(1); }
+
+    // Idempotency: re-running against an already-promoted target must fail
+    // loudly (a silent no-op or a duplicate block would both be wrong).
+    const r2 = promote(tmp, 'web-components', '0.2.0', '2026-02-02', false);
+    if (r2 !== 'already-promoted') { console.error(`selftest FAIL: expected 'already-promoted' on re-run, got '${r2}'`); process.exit(1); }
+
+    console.log('selftest OK');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+const topArgv = process.argv.slice(2);
+if (topArgv[0] === 'selftest') selftest();
+else main();