@christang/keel 5.14.0 → 5.20.0

package/assets/bootstrap/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- keel:start version=5.14.0 -->
+<!-- keel:start version=5.20.0 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.

package/bin/keel.js

@@ -699,21 +699,35 @@ function openspecReportedVersion(command) {
   return match ? match[0] : null;
 }
 
-function lockedOpenSpecVersion() {
+// The root is the repository under diagnosis, never PACKAGE_ROOT. Rooting this
+// at Keel's own install location made the line a statement about a repository
+// the reader was never shown: a consumer pinning 9.9.9 was told the version
+// Keel's checkout pins, and a global install — which ships no lockfile — was
+// told `unreadable` forever, which is exactly the drift this check was added
+// to expose. There is no fallback to PACKAGE_ROOT on purpose; falling back
+// would reinstate the misattribution and leave the reader unable to tell which
+// case they were in.
+//
+// Three outcomes, not two. A repository with no lockfile and one whose lockfile
+// names no OpenSpec both *declare* nothing, which is the ordinary case for any
+// project that does not depend on OpenSpec directly. A lockfile that exists and
+// cannot be parsed is a read failure. Collapsing them would either warn at
+// everyone or hide a real failure.
+function declaredOpenSpecVersion(repo) {
+  const lockPath = path.join(repo, "package-lock.json");
+  if (!fs.existsSync(lockPath)) return { state: "none", version: null };
+  let lock;
   try {
-    const lock = JSON.parse(
-      fs.readFileSync(path.join(PACKAGE_ROOT, "package-lock.json"), "utf8")
-    );
-    for (const [name, entry] of Object.entries(lock.packages || {})) {
-      if (name.endsWith("@fission-ai/openspec") && entry && entry.version) {
-        return entry.version;
-      }
-    }
+    lock = JSON.parse(fs.readFileSync(lockPath, "utf8"));
   } catch {
-    // No lockfile in a published install; there is then nothing to disagree
-    // with, which is not the same as agreement and is reported as such.
+    return { state: "unreadable", version: null };
   }
-  return null;
+  for (const [name, entry] of Object.entries(lock.packages || {})) {
+    if (name.endsWith("@fission-ai/openspec") && entry && entry.version) {
+      return { state: "declared", version: entry.version };
+    }
+  }
+  return { state: "none", version: null };
 }
 
 function findOpenSpecCommand() {
@@ -1426,16 +1440,24 @@ function runDoctor(options) {
         silentNotFound: true,
       }) === 0;
     const resolvedVersion = openspecReportedVersion(openspec);
-    const locked = lockedOpenSpecVersion();
+    const declared = declaredOpenSpecVersion(repo);
     const mismatched = Boolean(
-      resolvedVersion && locked && resolvedVersion !== locked
+      resolvedVersion
+      && declared.state === "declared"
+      && resolvedVersion !== declared.version
     );
     const where = bareOpenSpecOnPath
       ? openspec
       : `${openspec} is keel-resolvable but bare \`openspec\` is not on PATH — use \`keel openspec\``;
-    const versions = `${resolvedVersion || "version unreadable"}, lockfile ${
-      locked || "unreadable"
-    }`;
+    // Two versions on one line need two owners. `repo` is the repository named
+    // on doctor's first line; the answering build is attributed by the path
+    // already printed beside it.
+    const declaredText = {
+      declared: `repo pins ${declared.version}`,
+      none: "repo declares no OpenSpec version",
+      unreadable: "repo package-lock.json unreadable",
+    }[declared.state];
+    const versions = `${resolvedVersion || "version unreadable"}, ${declaredText}`;
     printDoctorLine(
       "openspec",
       mismatched || !bareOpenSpecOnPath ? "warning" : "ok",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.14.0",
+  "version": "5.20.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.14.0",
+  "version": "5.20.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.14.0",
+  "version": "5.20.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/skills/keel-review-checklist/SKILL.md

@@ -23,7 +23,7 @@ Read the selected OpenSpec proposal, design, specs, tasks, diff, and command evi
 - For a red-green strategy (`vertical-tdd`, `regression-first`), confirm concrete per-label `.red` and `.green` Evidence exists for the same check; evidence-first tasks instead name their observable proof.
 - A failure message must **name the actual cause** of what it reports. Watch for one condition guarding **two distinct failures** — `if result is None or result["status"] != expected` reports the first failure's message when the second one happened, sending the reader to a place with no problem in it. Split the condition. No gate can judge this: deciding whether a sentence misleads needs a model, so it stays here.
 - When two tasks in the change declared the same Touch set under a red-green strategy — `keel gate task-start` warns about this — ask whether they turned out to be **one behavior** split in half. The tell is that the first task's minimal implementation was wrong in the field, or that the second had no honest red left because the first already made its checks pass. The gate can only see the shape; by completion you can see the outcome, which is the only point at which this is answerable.
-- When no trustworthy explicit Git base exists, do not attribute dirty paths automatically. Review scope semantically.
+- Scope attribution is now the gate's job by default: `keel gate task-complete` compares the worktree against the dirty set `task-start` recorded and refuses a path outside Touch, so a `pass` is evidence about scope rather than silence about it. Two cases still need you. When the gate reports paths as *unattributed* — no recorded set, because the manifest predates the field or the guard was cleared — nothing was checked and the review is the only scope evidence. And a path already dirty when the task started is never attributed even if the task changed it again, so read the gate's silence about such a path as absence of a check rather than absence of a write.
 - For `Coupling: required`, confirm one complete candidate reached its completion gate and generated artifacts are aligned.
 
 ## Semantic Review

package/scripts/install_to_repo.py

@@ -120,9 +120,19 @@ TASKS_COMMIT_STATUS_PATTERNS = (
         "remove branch merge state from tasks.md; git log is the source of truth",
     ),
 )
+# A commit identifier is hexadecimal, and `a`-`f` are the only reason those
+# letters appear in one. A run of decimal digits alone is a phone number, a
+# timestamp, an order number, or a port — evidence prose, not state git owns.
+# Matching one as a recorded identifier (#58) asks the author to reword
+# something that was true, and a check that refuses correct work is one people
+# learn to route around. The length and word-boundary conditions are kept
+# verbatim inside the lookahead, so the token that matches is the token that
+# always matched, minus the all-decimal ones.
+_HASH_SHAPED_TOKEN = r"\b(?=[0-9a-f]{7,40}\b)[0-9a-f]*[a-f][0-9a-f]*\b"
+_HASH_CONTEXT_WORD = r"(?:commit|提交|合入|master|main|HEAD|hash|哈希)"
 TASKS_CONTEXTUAL_HASH_RE = re.compile(
-    r"(?i)(?:commit|提交|合入|master|main|HEAD|hash|哈希).*\b[0-9a-f]{7,40}\b|"
-    r"\b[0-9a-f]{7,40}\b.*(?:commit|提交|合入|master|main|HEAD|hash|哈希)"
+    rf"(?i){_HASH_CONTEXT_WORD}.*{_HASH_SHAPED_TOKEN}|"
+    rf"{_HASH_SHAPED_TOKEN}.*{_HASH_CONTEXT_WORD}"
 )