@codexstar/bug-hunter 3.0.5 → 3.0.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codexstar/bug-hunter",
-  "version": "3.0.5",
+  "version": "3.0.6",
   "description": "Adversarial AI bug hunter — multi-agent pipeline finds security vulnerabilities, logic errors, and runtime bugs, then fixes them autonomously. Works with Claude Code, Cursor, Codex CLI, Copilot, Kiro, and more.",
   "license": "MIT",
   "main": "bin/bug-hunter",
@@ -30,16 +30,16 @@
     "static-analysis"
   ],
   "files": [
-    "agents/",
     "bin/",
     "scripts/",
     "schemas/",
     "prompts/",
     "templates/",
     "modes/",
-    "skills/",
     "evals/",
     "docs/",
+    "agents/",
+    "skills/",
     "SKILL.md",
     "README.md",
     "CHANGELOG.md",
@@ -57,6 +57,7 @@
     "access": "public"
   },
   "scripts": {
+    "prepublishOnly": "node scripts/prepublish-guard.cjs",
     "prepack": "node --test scripts/tests/*.test.cjs",
     "test": "node --test scripts/tests/*.test.cjs",
     "doctor": "node bin/bug-hunter doctor",

package/scripts/prepublish-guard.cjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * prepublish-guard.cjs
+ *
+ * Blocks `npm publish` unless:
+ *   1. Git working tree is clean (no uncommitted changes)
+ *   2. Current HEAD is pushed to origin (no unpushed commits)
+ *   3. package.json version matches the git tag (if tag exists)
+ *
+ * This prevents the "published to npm but forgot to commit/push" problem.
+ * Bypass with: SKIP_PREPUBLISH_GUARD=1 npm publish
+ */
+
+const { execSync } = require('child_process');
+
+if (process.env.SKIP_PREPUBLISH_GUARD === '1') {
+  console.log('⚠️  prepublish-guard: SKIPPED (SKIP_PREPUBLISH_GUARD=1)');
+  process.exit(0);
+}
+
+const run = (cmd) => execSync(cmd, { encoding: 'utf8' }).trim();
+
+const errors = [];
+
+// 1. Check for uncommitted changes
+try {
+  const status = run('git status --porcelain');
+  if (status) {
+    errors.push(
+      '❌ Uncommitted changes detected. Commit or stash before publishing.\n' +
+      status.split('\n').map(l => `   ${l}`).join('\n')
+    );
+  }
+} catch {
+  errors.push('❌ Not a git repository or git not available.');
+}
+
+// 2. Check for unpushed commits
+try {
+  const unpushed = run('git log --oneline origin/main..HEAD 2>/dev/null');
+  if (unpushed) {
+    errors.push(
+      '❌ Unpushed commits. Run `git push` before publishing.\n' +
+      unpushed.split('\n').map(l => `   ${l}`).join('\n')
+    );
+  }
+} catch {
+  // If origin/main doesn't exist, skip this check
+}
+
+// 3. Version/tag consistency check
+try {
+  const version = require('../package.json').version;
+  const tagExists = (() => {
+    try { run(`git rev-parse v${version} 2>/dev/null`); return true; } catch { return false; }
+  })();
+  if (tagExists) {
+    const tagCommit = run(`git rev-parse v${version}`);
+    const headCommit = run('git rev-parse HEAD');
+    if (tagCommit !== headCommit) {
+      errors.push(
+        `❌ Tag v${version} exists but points to a different commit.\n` +
+        `   Tag:  ${tagCommit.slice(0, 8)}\n` +
+        `   HEAD: ${headCommit.slice(0, 8)}\n` +
+        `   Bump the version or move the tag.`
+      );
+    }
+  }
+} catch {
+  // Non-fatal
+}
+
+if (errors.length > 0) {
+  console.error('\n🛑 prepublish-guard: publish blocked\n');
+  errors.forEach(e => console.error(e + '\n'));
+  console.error('Bypass with: SKIP_PREPUBLISH_GUARD=1 npm publish\n');
+  process.exit(1);
+}
+
+console.log('✅ prepublish-guard: clean tree, all pushed — safe to publish');

package/scripts/run-bug-hunter.cjs

@@ -205,7 +205,8 @@ function sleep(ms) {
 
 function runCommandOnce({ command, timeoutMs }) {
   return new Promise((resolve) => {
-    const child = childProcess.spawn('/bin/zsh', ['-lc', command], {
+    const shell = process.env.SHELL || '/bin/bash';
+    const child = childProcess.spawn(shell, ['-lc', command], {
       stdio: ['ignore', 'pipe', 'pipe']
     });
     let stdout = '';

package/scripts/tests/worktree-harvest.test.cjs

@@ -20,7 +20,7 @@ function makeGitFixture() {
   // Bare origin
   const origin = path.join(sandbox, 'origin.git');
   fs.mkdirSync(origin, { recursive: true });
-  execFileSync('git', ['init', '--bare'], { cwd: origin, stdio: 'ignore' });
+  execFileSync('git', ['init', '--bare', '-b', 'main'], { cwd: origin, stdio: 'ignore' });
 
   // Working clone
   const repo = path.join(sandbox, 'repo');