@appchy/jarvis 0.1.66 → 0.1.67

package/dist/bin.js

@@ -10115,7 +10115,7 @@ import { createRequire as createRequire2 } from "module";
 var _require = createRequire2(import.meta.url);
 var VERSION2 = _require("../package.json").version ?? "0.0.0";
 var IS_DEV = String(_require("../package.json").name ?? "").endsWith("-dev");
-var SHA = "e0c2058";
+var SHA = "0b846a6";
 var BUILT = "2026-09-10";
 var BUILD = SHA ?? "source";
 var BUILD_LABEL = `${SHA ? `${VERSION2} (${SHA}${BUILT ? ` ${BUILT}` : ""})` : `${VERSION2} (source)`}${IS_DEV ? " \u2014 development build" : ""}`;

package/harness/harness/architecture.py

@@ -85,6 +85,17 @@ second copy of it here is a second copy to drift.
 """
 
 
+#: Where a repo's `work.config.json` says its schema lives. The package is published,
+#: so a CDN already serves it and there is nothing to host — and it is the same line in
+#: every repo, which a path into anybody's node_modules could never be.
+_WORK_CONFIG = (
+    "{\n"
+    '  "$schema": "https://cdn.jsdelivr.net/npm/@appchy/jarvis/harness/schema/'
+    'work.config.schema.json"\n'
+    "}\n"
+)
+
+
 def cmd_init(args) -> int:
     """Scaffold a work tree: the board, the roadmap, and the nine org-domains.
 
@@ -128,6 +139,19 @@ def cmd_init(args) -> int:
         write(root / name / "README.md",
               _charter(name, name.replace("-", " ").capitalize()))
 
+    # The repo's own config, which `init` did not use to write — so every repo that
+    # adopted the harness hand-copied one from a sibling, and copied whatever that
+    # sibling's `$schema` happened to point at. Three of them ended up naming a path
+    # inside a plugin that no longer exists, and a dangling `$schema` is not an error
+    # anywhere, so nothing said so.
+    #
+    # Only the pointer is written. Everything else in this file is a choice about the
+    # repo — its ledger letter, its verify commands, its instruction preset — and a
+    # scaffold that guesses those is a scaffold somebody has to undo. The schema tells
+    # the editor what the rest may say, which is exactly what a first-time adopter has
+    # no way to know.
+    write(project / ".claude" / "work.config.json", _WORK_CONFIG)
+
     print(f"initialised {rel(root, root) or 'work/'} at {root}")
     if made:
         print(f"  created {len(made)}: {', '.join(made)}")

package/harness/schema/work.config.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/appchy-ai/plugins/work.config.schema.json",
+  "$id": "https://cdn.jsdelivr.net/npm/@appchy/jarvis/harness/schema/work.config.schema.json",
   "title": "work.config.json",
   "description": "Per-repo configuration for the `work` harness, committed at .claude/work.config.json. This is the ONLY configuration path: Claude Code has deliberately ignored `pluginConfigs` in project settings since v2.1.207, because a cloned repo could otherwise inject values into hook commands and MCP configs. Treat it as a security surface — a value that reaches a shell command is the same injection wearing different clothes.",
   "type": "object",

package/harness/test_work.py

@@ -1893,6 +1893,30 @@ def test_init_scaffolds_the_whole_tree_and_is_idempotent_and_non_destructive():
         assert (root / "design" / "README.md").is_file(), "init did not backfill"
 
 
+def test_init_writes_a_config_whose_schema_pointer_exists_and_never_replaces_one():
+    with tempfile.TemporaryDirectory() as tmp:
+        _initialised(tmp)
+        cfg = Path(tmp) / ".claude" / "work.config.json"
+        assert cfg.is_file(), "a repo adopting the harness had to hand-copy this file"
+
+        # It parses, and the only thing scaffolded is the pointer — everything else in
+        # this file is a choice about the repo, and a guess is something to undo.
+        body = json.loads(cfg.read_text())
+        assert list(body) == ["$schema"]
+        assert body["$schema"].endswith("/harness/schema/work.config.schema.json")
+
+        # The pointer names the package, not a path inside anybody's plugin or
+        # node_modules — the failure this replaces was three repos naming a path that
+        # had been deleted, which no editor reports.
+        assert "@appchy/jarvis" in body["$schema"]
+        assert "plugins" not in body["$schema"]
+
+        # A repo that has already configured itself keeps what it wrote.
+        cfg.write_text('{"ids": {"prefix": "Z"}}')
+        assert architecture.cmd_init({"project_root": tmp}) == 0
+        assert json.loads(cfg.read_text()) == {"ids": {"prefix": "Z"}}
+
+
 def test_domain_new_pulls_a_shipped_charter_and_still_works_for_an_unknown_name():
     import os
     with tempfile.TemporaryDirectory() as tmp:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appchy/jarvis",
-  "version": "0.1.66",
+  "version": "0.1.67",
   "description": "Jarvis — local AI coding assistant CLI",
   "private": false,
   "type": "module",
@@ -56,17 +56,17 @@
     "tsup": "^8.5.1",
     "typescript": "^5.7.0",
     "vitest": "^2.1.0",
-    "@jarvis/agents": "1.0.0",
-    "@jarvis/anthropic": "1.0.0",
     "@jarvis/board": "0.1.0",
     "@jarvis/data": "0.1.0",
-    "@jarvis/errors": "1.0.0",
     "@jarvis/logger": "1.0.0",
     "@jarvis/rpc": "1.0.0",
+    "@jarvis/errors": "1.0.0",
     "@jarvis/types": "1.0.0",
     "@jarvis/typescript-config": "1.0.0",
     "@jarvis/ui": "0.1.0",
-    "@jarvis/vitest-config": "1.0.0"
+    "@jarvis/vitest-config": "1.0.0",
+    "@jarvis/agents": "1.0.0",
+    "@jarvis/anthropic": "1.0.0"
   },
   "scripts": {
     "dev": "tsx watch src/bin.ts start --foreground",