@constraint/cli 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constraint/cli",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Install, publish, and report Agent Skills with Constraint",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -26,6 +26,7 @@ import {
 } from './setup.js';
 import {
   configuredAgents,
+  identifyLocalSkill,
   installSkill,
   installedSkills,
   manageableDomainRecords,
@@ -35,7 +36,7 @@ import {
   uploadSkill,
 } from './skills.js';
 
-const VERSION = '0.4.1';
+const VERSION = '0.4.2';
 
 const HELP = `Constraint Skills CLI
 
@@ -481,7 +482,31 @@ async function reportCommand(args, config, out) {
   if (!resolvedClient || !resolvedSession) {
     throw new Error('Could not tell the client and session from this path. Pass --client and --session.');
   }
+
+  // Version attribution: hash the local skill folder and match it against the
+  // published versions, so the run records what actually ran — not "latest".
+  let detail;
+  try {
+    detail = await apiRequest(config, `/skills/${encodeURIComponent(skill)}`);
+  } catch (error) {
+    if (/not found/i.test(error.message)) {
+      const projectRoot = await findProjectRoot();
+      const hint = await identifyLocalSkill(config, { skill_id: skill, slug: skill, latest_version: 0 }, { projectRoot })
+        .then((found) => found.localPath)
+        .catch(() => null);
+      throw new Error(
+        `${skill} is not on Constraint.` +
+        (hint ? ` Found a local skill at ${hint} — upload it first:
+  constraint skills upload ${hint} --domain <domain>` : ' Upload it first with constraint skills upload.'),
+      );
+    }
+    throw error;
+  }
+  const projectRoot = await findProjectRoot();
+  const identified = await identifyLocalSkill(config, detail, { projectRoot });
+
   const query = new URLSearchParams({ skill, client: resolvedClient, session: resolvedSession });
+  if (identified.verified) query.set('version', String(identified.version));
   const run = await apiRequest(config, `/skill-reports?${query.toString()}`, {
     method: 'POST',
     headers: { 'Content-Type': mediaType(transcript.absolute), 'X-Transcript-Filename': transcript.filename },
@@ -491,6 +516,10 @@ async function reportCommand(args, config, out) {
     run_id: run.run_id,
     skill: run.skill_slug,
     version: run.skill_version,
+    version_verified: identified.verified,
+    ...(identified.localPath && !identified.verified
+      ? { warning: `local copy at ${identified.localPath} does not match any published version` }
+      : {}),
     state: run.state,
     client: run.client,
     session: run.client_session_id,

package/src/files.js

@@ -43,7 +43,9 @@ export async function readSkillDirectory(input) {
 
 export function packageDigest(files) {
   const hash = crypto.createHash('sha256');
-  for (const file of [...files].sort((a, b) => a.path.localeCompare(b.path))) {
+  // Sort by code points, not locale: this digest must match the server's,
+  // which sorts paths with plain string comparison.
+  for (const file of [...files].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))) {
     hash.update(file.path);
     hash.update('\0');
     hash.update(file.content);

package/src/skills.js

@@ -231,6 +231,42 @@ export async function installedSkills({ scope = 'project', projectRoot, agents }
   return Object.values(lock.installations || {}).filter((item) => !selected || selected.has(item.agent));
 }
 
+// Version attribution for reports: find the skill's local folder (managed
+// symlink or plain folder — agents read both from the same directories), hash
+// it with the registry's package digest, and match against published versions.
+export async function identifyLocalSkill(config, detail, { projectRoot = null } = {}) {
+  const candidates = [];
+  if (projectRoot) {
+    for (const agent of ['claude-code', 'codex']) {
+      candidates.push(path.join(agentPaths(agent, { scope: 'project', projectRoot }).skills, detail.slug));
+    }
+  }
+  for (const agent of ['claude-code', 'codex']) {
+    candidates.push(path.join(agentPaths(agent).skills, detail.slug));
+  }
+  let local = null;
+  for (const candidate of candidates) {
+    try {
+      const digest = packageDigest(await readSkillDirectory(candidate));
+      local = { path: candidate, digest };
+      break;
+    } catch {
+      // not present here; keep looking
+    }
+  }
+  if (!local) return { localPath: null, version: null, verified: false };
+  for (let version = detail.latest_version; version >= 1; version -= 1) {
+    const candidate = await apiRequest(
+      config,
+      `/skills/${encodeURIComponent(detail.skill_id)}/versions/${version}`,
+    );
+    if (candidate.version.content_sha256 === local.digest) {
+      return { localPath: local.path, version, verified: true };
+    }
+  }
+  return { localPath: local.path, version: null, verified: false };
+}
+
 export async function readTranscript(file) {
   const absolute = path.resolve(file);
   return { absolute, filename: path.basename(absolute), content: await fs.readFile(absolute) };