@cairnkeep/cli 2.13.0 → 2.13.1

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.13.1] - 2026-08-17
+
+### Fixed
+
+- Generate release SBOMs directly as reproducible, schema-validated CycloneDX
+  1.6 documents with the pinned official npm generator. This replaces npm's
+  invalid CycloneDX 1.5 output and fails publication before attaching a broken
+  SBOM.
+
 ## [2.13.0] - 2026-08-17
 
 ### Added
@@ -347,7 +356,8 @@ stored memories.
 - Preserve executable permissions and Bash 3.2 portability on macOS.
 - Add backup-first uninstall and SQLite-safe memory export/import guidance.
 
-[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.13.0...HEAD
+[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.13.1...HEAD
+[2.13.1]: https://github.com/cairnkeep/cairnkeep/compare/v2.13.0...v2.13.1
 [2.13.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.12.0...v2.13.0
 [2.12.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.11.0...v2.12.0
 [2.11.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.9.0...v2.11.0

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.13.0
+**Baseline:** Cairnkeep 2.13.1
 **Last reviewed:** 2026-08-13
 
 This map prevents the course from drifting behind the product. It assigns each

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.13.0
+**Baseline:** Cairnkeep 2.13.1
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.13.0
+**Tested with:** Cairnkeep 2.13.1
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.13.0
+**Tested with:** Cairnkeep 2.13.1
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.13.0
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.13.1
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.13.0 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.13.1 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.13.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.13.1 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.13.0
+   npm install --global @cairnkeep/cli@2.13.1
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.13.0
+**Tested with:** Cairnkeep 2.13.1
 
 ## Outcome
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.13.0
+**Tested with:** Cairnkeep 2.13.1
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.13.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.13.1 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.13.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.13.1 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.13.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.13.1, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.13.0
+npm install --global @cairnkeep/cli@2.13.1
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.13.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.13.1; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 
@@ -134,7 +134,7 @@ prompts, approve skills, create an autonomous loop, or add remote access.
 
 ## Release boundary
 
-Ready means this lesson and its deterministic contracts pass against v2.13.0.
+Ready means this lesson and its deterministic contracts pass against v2.13.1.
 Release readiness requires a non-skipping acceptance run
 against separate Pi 0.84.1 minimum and explicitly versioned registry-current
 installations, plus the documented Node.js, Bash 3.2, and native Windows matrix.

package/docs/releasing.md

@@ -12,8 +12,12 @@ from a workstation.
 4. Publish a GitHub Release whose tag is exactly `v<package.json version>`.
 5. The `Publish release` workflow checks out that immutable tag, repeats the
    tests, and publishes `@cairnkeep/cli` with npm provenance.
-6. The workflow attaches the npm tarball, a CycloneDX SBOM, and SHA-256 checksums
-   to the GitHub Release.
+6. The workflow uses the exact locked `@cyclonedx/cyclonedx-npm` development
+   dependency to generate a reproducible CycloneDX 1.6 SBOM from
+   `package-lock.json`. Generation includes schema validation and runs before
+   npm publication, so an invalid document blocks both publication and
+   attachment. The workflow attaches that SBOM, the npm tarball, and SHA-256
+   checksums to the GitHub Release.
 7. The workflow publishes versioned `linux/amd64` and `linux/arm64`
    memory-server and workspace images to GHCR. It also updates `latest` for a
    stable release or `next` for a prerelease.

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.13.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.13.1","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cairnkeep/cli",
-  "version": "2.13.0",
+  "version": "2.13.1",
   "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
   "license": "Apache-2.0",
   "type": "module",
@@ -70,5 +70,8 @@
     "pi-coding-agent",
     "context",
     "rag"
-  ]
+  ],
+  "devDependencies": {
+    "@cyclonedx/cyclonedx-npm": "6.0.0"
+  }
 }

package/scripts/test-release-sbom.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+WORKFLOW="$ROOT/.github/workflows/publish.yml"
+TEMP_DIR=$(mktemp -d)
+trap 'rm -f "$TEMP_DIR/cairnkeep.cdx.json"; rmdir "$TEMP_DIR"' EXIT
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+node - "$ROOT/package.json" "$ROOT/package-lock.json" "$WORKFLOW" <<'NODE'
+const fs = require("node:fs");
+
+const manifest = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const lock = JSON.parse(fs.readFileSync(process.argv[3], "utf8"));
+const workflow = fs.readFileSync(process.argv[4], "utf8");
+const expected = "6.0.0";
+
+if (manifest.devDependencies?.["@cyclonedx/cyclonedx-npm"] !== expected) {
+  throw new Error(`package.json must pin @cyclonedx/cyclonedx-npm exactly to ${expected}`);
+}
+if (lock.packages?.[""]?.devDependencies?.["@cyclonedx/cyclonedx-npm"] !== expected) {
+  throw new Error(`package-lock.json root must pin @cyclonedx/cyclonedx-npm exactly to ${expected}`);
+}
+if (lock.packages?.["node_modules/@cyclonedx/cyclonedx-npm"]?.version !== expected) {
+  throw new Error(`package-lock.json must resolve @cyclonedx/cyclonedx-npm ${expected}`);
+}
+
+const artifactStep = workflow.indexOf("- name: Build and validate release artifacts");
+const publishStep = workflow.indexOf("- name: Publish to npm with provenance");
+const attachStep = workflow.indexOf("- name: Attach package and SBOM to GitHub release");
+if (artifactStep < 0 || publishStep < 0 || attachStep < 0 || !(artifactStep < publishStep && publishStep < attachStep)) {
+  throw new Error("release artifacts must validate before npm publication and attach only after publication");
+}
+NODE
+
+grep -Fq './node_modules/.bin/cyclonedx-npm' "$WORKFLOW" || fail "release workflow does not use the locked CycloneDX generator"
+grep -Fq -- '--package-lock-only' "$WORKFLOW" || fail "release workflow does not use the package lock"
+grep -Fq -- '--omit dev' "$WORKFLOW" || fail "release workflow does not omit development dependencies"
+grep -Fq -- '--output-reproducible' "$WORKFLOW" || fail "release workflow does not request reproducible output"
+grep -Fq -- '--spec-version 1.6' "$WORKFLOW" || fail "release workflow does not emit CycloneDX 1.6"
+grep -Fq -- '--validate' "$WORKFLOW" || fail "release workflow does not validate the generated SBOM"
+if grep -Fq 'npm sbom' "$WORKFLOW"; then
+  fail "release workflow still uses npm sbom"
+fi
+if grep -Fqi 'sbomsmith' "$WORKFLOW"; then
+  fail "release workflow must not depend on an external converter"
+fi
+
+"$ROOT/node_modules/.bin/cyclonedx-npm" \
+  --package-lock-only \
+  --omit dev \
+  --output-reproducible \
+  --spec-version 1.6 \
+  --output-format JSON \
+  --output-file "$TEMP_DIR/cairnkeep.cdx.json" \
+  --validate \
+  "$ROOT/package.json"
+
+node - "$TEMP_DIR/cairnkeep.cdx.json" <<'NODE'
+const fs = require("node:fs");
+
+const bom = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+if (bom.bomFormat !== "CycloneDX") throw new Error("release SBOM format is not CycloneDX");
+if (bom.specVersion !== "1.6") throw new Error("release SBOM version is not CycloneDX 1.6");
+if (!Array.isArray(bom.components) || bom.components.length === 0) throw new Error("release SBOM has no components");
+if (!Array.isArray(bom.dependencies) || bom.dependencies.length === 0) throw new Error("release SBOM has no dependency graph");
+
+const scpLike = /^[^/@\s:]+@[^/\s:]+:.+$/;
+function inspect(value) {
+  if (Array.isArray(value)) {
+    for (const item of value) inspect(item);
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  if (Array.isArray(value.externalReferences)) {
+    for (const reference of value.externalReferences) {
+      if (typeof reference?.url === "string" && scpLike.test(reference.url)) {
+        throw new Error(`release SBOM contains an invalid SCP-style external reference: ${reference.url}`);
+      }
+    }
+  }
+  for (const child of Object.values(value)) inspect(child);
+}
+inspect(bom);
+NODE
+
+echo "PASS: release SBOM is reproducible, schema-validated CycloneDX 1.6"