@golden-frijoles/kit 0.28.0 → 0.29.1

package/dist/cross-agent-doctor.mjs

@@ -36,7 +36,7 @@ import {
   codexExecArgs,
   isCodexCapped,
 } from './lib/cross-agent-cli.mjs';
-import { readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 
 // ═══ CODEX ════════════════════════════════════════════════════════════════════════════════════
 // The codex half — diagnose why the Codex CLI can't run, and name the exact fix.
@@ -211,6 +211,10 @@ async function codexMain() {
 // (isMain-guarded, per LEARNINGS).
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const LIB_PATH = join(__dirname, 'lib', 'cross-agent-cli.mjs');
+// The byte-identical template mirror, when this runs in the repo that carries one (golden-beans:
+// `skills/template/scripts/`, held identical by check-script-parity). Bumping only LIB_PATH broke that
+// parity on 2026-10-06 (PR #278); in a consumer project the path does not exist and is skipped.
+const MIRROR_LIB_PATH = join(__dirname, '..', 'skills', 'template', 'scripts', 'lib', 'cross-agent-cli.mjs');
 
 // ── Pure decision core (the unit under test) ─────────────────────────────────────────────────────────
 // Given the observed facts, decide ONE action, most severe first:
@@ -554,7 +558,10 @@ async function agyMain() {
       }
       const src = readFileSync(LIB_PATH, 'utf8');
       const today = new Date().toISOString().slice(0, 10);
-      writeFileSync(LIB_PATH, bumpPinnedSource(src, obs.installed, today));
+      const bumped = bumpPinnedSource(src, obs.installed, today);
+      writeFileSync(LIB_PATH, bumped);
+      const mirrored = existsSync(MIRROR_LIB_PATH);
+      if (mirrored) writeFileSync(MIRROR_LIB_PATH, bumped);
       line(`✓ AGY_PINNED bumped ${obs.pinned} → ${obs.installed} (probe green; marker dated ${today}).`);
       const t = spawnSync(process.execPath, ['--test', 'scripts/lib/*.test.mjs', 'scripts/*.test.mjs'], {
         encoding: 'utf8',
@@ -577,7 +584,9 @@ async function agyMain() {
       line(
         '  branch `chore/agy-pin-bump-' +
           obs.installed +
-          '`, path-limited commit of scripts/lib/cross-agent-cli.mjs, PR.'
+          '`, path-limited commit of scripts/lib/cross-agent-cli.mjs' +
+          (mirrored ? ' and skills/template/scripts/lib/cross-agent-cli.mjs' : '') +
+          ', PR.'
       );
       return;
     }

package/dist/lib/cross-agent-cli.mjs

@@ -54,10 +54,10 @@ export const AGENT_BIN = {
 // Harmless here since AGY_MODEL/AGY_FALLBACK_MODEL below are always valid, listed model names (checked via
 // `agy models`), but it means a future typo in either constant would silently review with the WRONG model
 // instead of failing loud — watch for that if either constant is ever edited.
-// agy-doctor: last verified 2026-10-03 against 1.2.16.
+// agy-doctor: last verified 2026-10-06 against 1.3.0.
 //   ^ machine-managed marker — `node scripts/cross-agent-doctor.mjs agy --fix` rewrites it (with the constant
 //   below) after a green live contract probe. Don't hand-edit the marker's shape.
-export const AGY_PINNED = '1.2.16';
+export const AGY_PINNED = '1.3.0';
 
 // agy's `--print` mode prints NOTHING unless `--model` names a model — and, crucially, it ALSO prints
 // nothing (exit 0, empty stdout — the error lands only in agy's log, see --log-file) when the model is

package/dist/lib/golden-onboarding.mjs

@@ -157,29 +157,24 @@ export function compareVersions(a, b) {
 }
 
 /**
- * The ONE install prompt a stranger pastes into their agent (golden-frijoles-plugin S3.3/S3.4, D6/D8/X10).
+ * The ONE install prompt a stranger pastes into their agent (golden-frijoles-plugin S3.3/S3.4;
+ * account-from-the-terminal S1.2, D2).
  *
- * This is a CONSTANT, not this repo's business to author: golden-beans `apps/web/lib/install-prompt.ts`
- * is the SOURCE (`export const INSTALL_PROMPT`), and it names only `github.com` /
- * `raw.githubusercontent.com` URLs and no site URL — so unlike `getSiteUrl()`-backed strings there, it
- * needs no per-environment origin and is safe to transcribe byte-for-byte. This is that transcription,
- * exactly as golden-beans' `CopyPromptCard` renders it on the closing CTA, `/install` and onboarding.
+ * golden-beans `apps/web/lib/install-prompt.ts` is the SOURCE: `installPrompt(siteUrl)`, built from
+ * `getSiteUrl()` there because the prompt now sends the agent to read `<site>/install.md` before it
+ * installs anything. This is its transcription against the PRODUCTION origin — never a preview URL —
+ * and golden-beans' `install-prompt.test.ts` imports this constant and asserts it equals
+ * `installPrompt('https://goldenfrijoles.com')`, so a one-sided edit goes red there.
  * `scripts/check-onboarding-parity.mjs` asserts this string appears VERBATIM in the repo README.md and
- * the `golden-frijoles` umbrella SKILL.md — a one-word drift fails it. Never hand-edit this without the
- * source (golden-beans `apps/web/lib/install-prompt.ts`) changing first.
- *
- * Text: the audit's §3.1 prompt (`Roadmap/00-ideas/audits/golden-frijoles-unification-2026-09-23.md`,
- * golden-beans checkout), verbatim, its soft-wrapped blockquote lines joined into the one paragraph it
- * renders as.
+ * the `golden-frijoles` umbrella SKILL.md. Never hand-edit this without the source changing first.
  */
 export const INSTALL_PROMPT =
-  "Install the golden-frijoles plugin. If you're in Claude Code, run `claude plugin marketplace add " +
-  'golden-frijoles/skills`, then `claude plugin install golden-frijoles@golden-frijoles`. If you\'re in ' +
-  'another agent, run `npx skills add golden-frijoles/skills --skill \'*\'` and select your ' +
-  'agent. Use one installation method. You can read the skill directly at ' +
-  'https://github.com/golden-frijoles/skills/blob/main/plugins/golden-frijoles/skills/golden-frijoles/SKILL.md ' +
-  '(raw: https://raw.githubusercontent.com/golden-frijoles/skills/main/plugins/golden-frijoles/skills/golden-frijoles/SKILL.md). ' +
-  'Then use the golden-frijoles skill when working on this project, and start with its setup.';
+  'Set up Golden Frijoles in this project. ' +
+  '1. Read https://goldenfrijoles.com/install.md before installing anything. ' +
+  '2. Tell me in a few lines what it installs, what changes on this machine and which services it contacts. ' +
+  'Offer me a security review, and wait for my go-ahead. ' +
+  '3. Install it the way install.md says for the agent you are. ' +
+  '4. Run the golden-frijoles skill and start its setup.';
 
 /**
  * The value of `name` in a dotenv file, or null.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@golden-frijoles/kit",
-  "version": "0.28.0",
+  "version": "0.29.1",
   "description": "The scripts the Golden Frijoles skills run, packaged so they work in any repo: planning, build-order, reporting and verification rails. Zero dependencies.",
   "type": "module",
   "bin": {