@aibyzero/byz 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 0.1.2 - 2026-08-27
+
+### Added
+
+- Bundled the pinned public CM Plugin Workflow with BYZ, keeping CM and CM Plugin independently selectable while preventing separate end-user installation or updates ([#12](https://github.com/kingxiaozhe/byz/pull/12)).
+
+### Fixed
+
+- Restored the package-root runtime assets required by the installed TUI and HTML exporter.
+
 ## 0.1.1 - 2026-08-27
 
 ### Added

package/README.md

@@ -4,9 +4,9 @@ BYZ is a business-first coding agent by Zero, built on the Pi coding-agent
 runtime. The command is `byz`; user configuration is stored under `.byz` rather
 than `.pi`.
 
-Status: initial public release. The public `cm-workflow` package is bundled and
-loaded by default. The private `cm-plugin-workflow` package remains separately
-installed and is available only to users with repository access.
+Status: initial public release. `cm-workflow` and `cm-plugin-workflow` are
+locked to full Git commits and bundled as independent workflow roots. CM loads
+by default; CM Plugin loads only when explicitly selected.
 
 ## Install and update
 
@@ -27,7 +27,7 @@ byz update
 
 This command updates only `@aibyzero/byz`. It never calls Pi's release channel,
 promotes the Pi source baseline, or updates workflow packages independently.
-When a new public CM version is accepted into BYZ, it ships in a new BYZ
+When a new CM or CM Plugin version is accepted into BYZ, it ships in a new BYZ
 version. Users receive it through the same `byz update` command.
 
 Workflows do not have an end-user update or rollback command. Every BYZ release
@@ -39,25 +39,15 @@ versions selected by their installed BYZ release.
 ```bash
 byz workflow list
 byz workflow check cm
-byz --workflow cm
-byz --workflow none
-```
-
-CM Plugin stays private and is not included in the public BYZ package:
-
-```bash
-export BYZ_CM_PLUGIN_WORKFLOW_SOURCE='git:git@github.com:OWNER/PRIVATE_REPO@<40-character-commit-sha>'
-byz workflow install cm-plugin
 byz workflow check cm-plugin
+byz --workflow cm
 byz --workflow cm-plugin
+byz --workflow none
 ```
 
-The private source is supplied by the authorized user and is never shipped in
-BYZ's public lock file. `workflow install` requires a full commit SHA and stores
-the package with Pi autoload disabled; BYZ injects it only when
-`--workflow cm-plugin` is selected. BYZ therefore loads at most one managed
-workflow per session. Local development can override package roots with
-`BYZ_CM_WORKFLOW_ROOT` or
+BYZ loads at most one workflow per session. Users do not install, update, or
+roll back either workflow separately. Local development can override package
+roots with `BYZ_CM_WORKFLOW_ROOT` or
 `BYZ_CM_PLUGIN_WORKFLOW_ROOT`; the two roots must remain distinct.
 
 ## Development
@@ -70,9 +60,8 @@ node packages/byz/dist/cli.js --help
 ```
 
 BYZ preserves Pi's MIT-licensed runtime and records the exact upstream baseline
-in `upstream.json`. Public workflow versions, source commits, licenses, and
-bundle boundaries are recorded in `workflows.lock.json`. Private source identity
-stays in the authorized user's `.byz` package configuration.
+in `upstream.json`. Workflow versions, source commits, licenses, and bundle
+boundaries are recorded in `workflows.lock.json`.
 
 Repository maintainers inspect a clean workflow checkout, then explicitly apply
 its version and Pi resource manifest to the next BYZ release branch:
@@ -86,9 +75,8 @@ npm run byz:sync-cm-plugin -- --root /path/to/cm-plugin-workflow --apply
 ```
 
 These repository commands never commit, push, open a pull request, tag, or
-publish. The CM command refreshes the root lockfile with lifecycle scripts
-disabled. The private CM Plugin command writes only its public-safe version and
-resource contract; it never persists the private checkout path or source.
+publish. Both commands refresh the root lockfile with lifecycle scripts
+disabled and pin the selected workflow to its full Git commit.
 
 ## Releasing BYZ
 

package/dist/cli.js

@@ -2,13 +2,7 @@
 
 import { main } from "./runtime/bundle/index.js";
 import { handleByzUpdate } from "./update.js";
-import {
-	getWorkflowInstallRequest,
-	handleWorkflowCommand,
-	installWorkflowPackage,
-	parseWorkflowOption,
-	prepareWorkflowRuntimeArgs,
-} from "./workflows.js";
+import { handleWorkflowCommand, parseWorkflowOption, prepareWorkflowRuntimeArgs } from "./workflows.js";
 
 process.title = "byz";
 process.env.BYZ_CODING_AGENT = "true";
@@ -35,13 +29,10 @@ try {
 	if (isRootHelp) {
 		console.error("BYZ updates: byz update (npm-managed global installations only)");
 		console.error("BYZ workflows: --workflow <cm|cm-plugin|none> (default: BYZ_WORKFLOW or cm)");
-		console.error("Commands: byz workflow <list|status|check|install> [cm|cm-plugin]");
+		console.error("Commands: byz workflow <list|status|check> [cm|cm-plugin]");
 	}
 
-	const installRequest = await getWorkflowInstallRequest(commandArgs);
-	if (installRequest) {
-		await installWorkflowPackage(installRequest);
-	} else if (await handleWorkflowCommand(commandArgs)) {
+	if (await handleWorkflowCommand(commandArgs)) {
 		// BYZ-owned command handled without starting the Pi runtime.
 	} else if (await handleByzUpdate(commandArgs)) {
 		// BYZ release metadata and package target stay independent from Pi.