@dogfood-lab/ai-crucible 0.2.0 → 0.4.0

package/bin/ai-crucible.js

@@ -5,14 +5,20 @@
 // the release-asset names from convention, downloads the platform binary from the ai-crucible
 // GitHub Release, verifies its SHA256 against checksums-<version>.txt, caches it, and runs it
 // with full arg passthrough.
-//   binary:    ai-crucible-0.2.0-linux-x64
-//   checksums: checksums-0.2.0.txt
+//
+// version + tag are read from THIS package's package.json at runtime — NEVER hardcoded — so the
+// launcher can never drift from the published package. A hardcoded version silently fetched the
+// previous release's binaries after a bump (the published 0.3.0 package shipped a bin pinned to
+// 0.2.0, so `npx` ran 0.2.0 code); deriving it makes that drift structurally impossible.
+//   binary:    ai-crucible-<version>-<os>-<arch>
+//   checksums: checksums-<version>.txt
+const { version } = require("../package.json");
 process.env.MCPTOOLSHOP_LAUNCH_CONFIG = JSON.stringify({
   toolName: "ai-crucible",
   owner: "dogfood-lab",
   repo: "ai-crucible",
-  version: "0.2.0",
-  tag: "v0.2.0",
+  version: version,
+  tag: "v" + version,
 });
 
 require("@mcptoolshop/npm-launcher/bin/mcptoolshop-launch.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dogfood-lab/ai-crucible",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "ai-crucible — a diagnostic measurement instrument: a cross-family panel of local LLM judges under a sealed boundary, scoring against a hidden oracle. Zero-prerequisite npx install via a verified binary launcher. Research preview.",
   "type": "commonjs",
   "license": "MIT",
@@ -17,7 +17,8 @@
     "LICENSE"
   ],
   "scripts": {
-    "verify": "node -e \"require('./bin/ai-crucible.js')\" 2>&1 || true"
+    "verify": "node -e \"require('./bin/ai-crucible.js')\" 2>&1 || true",
+    "test": "node test/version-derive.test.js"
   },
   "keywords": [
     "llm",