@cleocode/goal 0.9.6 → 0.9.7

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.9.7 — 2026-10-28
+
+- **Fixed — the installed-release proof matches what the package actually ships.** `scripts/check-installed-goal.ts` compares every production artifact in the tag with the bytes the running plugin loaded. `isArtifactPath` counted `skills/*/evals/**` as production artifacts, but `package.json`'s `files` deliberately excludes them (`!skills/*/evals`), so npm never installs them and the comparison reported them as missing for every real install — making the release proof impossible to satisfy. The artifact set now matches the packed files; **every shipped entrypoint, `src/**`, `dist/**` and `skills/**` file is still byte-compared**, and an unexpected file is still rejected.
+- **Packaging.** Same runtime, same CLI; only the version label and the artifact-set definition changed.
+
 ## 0.9.6 — 2026-10-28
 
 - **Packaging only — a git-tag install can be prepared by npm again.** `opencode plugin add github:kryptobaseddev/open-goal#vX.Y.Z` prepares a git dependency with npm, and npm installs the package's devDependencies before packing it. `@opencode/plugin` pulls the AWS Bedrock SDK, and npm's fresh resolution selected `@aws-sdk/*` versions whose registry tarballs were not available, so the preparation failed with `git dep preparation failed` (bun resolves the same tree fine, which is why CI and local installs were unaffected). `overrides` now pin that AWS dev tree to the exact versions this repository's `bun.lock` already resolves — all present and verified. **No runtime dependency, source or behaviour change**; `bun install` resolves the same versions and the published tarball is unchanged apart from the version.

package/dist/cli.js

@@ -6910,7 +6910,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 // package.json
 var package_default = {
   name: "@cleocode/goal",
-  version: "0.9.6",
+  version: "0.9.7",
   description: "CLEO Goal: persistent, host-verified goal mode for OpenCode 2 (and any harness through cleo-goal tick), with a structured goal contract and a live TUI.",
   type: "module",
   license: "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/goal",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "description": "CLEO Goal: persistent, host-verified goal mode for OpenCode 2 (and any harness through cleo-goal tick), with a structured goal contract and a live TUI.",
   "type": "module",
   "license": "MIT",

package/src/verify/artifact.ts

@@ -31,7 +31,12 @@ export type RuntimeProvenance = {
 
 const entrypoints = ["package.json", "server.ts", "tui.tsx", "rpc.ts"]
 const directories = ["src", "skills", "dist"]
-export const isArtifactPath = (path: string) => entrypoints.includes(path) || directories.some((dir) => path.startsWith(`${dir}/`))
+/** The package's `files` excludes the skill eval fixtures under
+ * `skills/<name>/evals/`; those are neither shipped nor loaded, so they are not
+ * production artifacts and can never be byte-proven from an installed package. */
+const notShipped = /^skills\/[^/]+\/evals\//
+export const isArtifactPath = (path: string) =>
+  !notShipped.test(path) && (entrypoints.includes(path) || directories.some((dir) => path.startsWith(`${dir}/`)))
 export const hashArtifact = (bytes: Uint8Array) => createHash("sha256").update(bytes).digest("hex")
 
 export function captureArtifactHashes(root: string): ArtifactHashes {
@@ -41,7 +46,7 @@ export function captureArtifactHashes(root: string): ArtifactHashes {
       const path = `${relative}/${item.name}`
       if (item.isSymbolicLink()) throw new Error(`Artifact symlink is not a loaded-byte proof: ${path}`)
       if (item.isDirectory()) walk(path)
-      else if (item.isFile()) files.push(path)
+      else if (item.isFile() && isArtifactPath(path)) files.push(path)
     }
   }
   for (const dir of directories) walk(dir)