@ijfw/install 1.5.3 → 1.5.5

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [1.5.4] -- 2026-05-26
+
+**Wayland Hub Extension pack pipeline.** Adds `pack-hub-extension` -- a new CLI subcommand that produces the three distributable artifacts Wayland's prebuild sync script needs to bundle IJFW as a native Hub Extension without committing binaries to the Wayland repo.
+
+### Added
+
+- `ijfw pack-hub-extension [--output <dir>]` produces three artifacts in one shot:
+  - `ijfw-<version>.zip` -- the installable Hub Extension bundle (manifest + lifecycle hooks + assets)
+  - `ijfw-<version>.sha512` -- SHA-512 SRI checksum for Wayland's integrity verifier
+  - `hub-index-snippet.json` -- drop-in entry for Wayland's Hub Index, ready to merge at build time
+- `--output <dir>` flag lets callers stage artifacts anywhere (defaults to `dist/`); the flag is forwarded verbatim to `scripts/pack-hub-extension.js`.
+- `scripts/pack-hub-extension.js` + `scripts/hub-extension/**` now ship inside the npm tarball, so Wayland's prebuild script can invoke the packer directly via `npx -y @ijfw/install@<version> pack-hub-extension --output <stage-dir>` with no local clone required.
+- Hub Extension bundle includes `scripts/install.js` (runs `npx -y @ijfw/install@latest` non-interactively) and `scripts/uninstall.js` with split timeouts -- 100s for install, 30s for uninstall -- so Wayland's sandboxed fork never hangs the boot sequence.
+- Manifest template (`aion-extension.json.tmpl`) declares all 15 `acpAdapters` so Wayland's existing verifier checks every supported CLI on PATH post-install. If any are missing, install fails with a clear error rather than silently succeeding.
+- Wayland integration: their `scripts/sync-hub-extensions.ts` prebuild step invokes `pack-hub-extension` at every build so each Wayland release snapshots the latest published IJFW without storing binaries in the repo.
+
+### Internal
+
+- `@ijfw/memory-server@1.5.4` republishes alongside with no functional changes vs 1.5.3 -- preserves the version-lockstep invariant between the two packages.
+- Test coverage: `installer/test/test-pack-hub-extension.js` verifies artifact production, SHA-512 stability across runs on identical content, and manifest shape conformance.
+
 ## [1.3.2] -- 2026-05-15
 
 **Project-agnostic swarm orchestration + live visual workflow + richer Codex native surface.** Adds first-class Team Assembly, blackboard coordination, swarm task lifecycle, conservative git worktrees, recovery checkpoints, Superpowers-style live design previews, and Claude-parity Codex command aliases.

package/README.md

@@ -1,92 +1,60 @@
-# @ijfw/install
+# @ijfw/install — One-command installer for IJFW
 
-One-command installer for [IJFW](https://gitlab.com/therealseandonahoe/ijfw) -- the AI
-efficiency layer for 15 AI coding agents: Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, Hermes, Wayland, OpenCode, Qwen Code, Cline, Kimi Code, OpenClaw, Antigravity, and Aider.
+> Ferrox Labs · Local-first infrastructure for AI coding agents
+
+IJFW is Ferrox Labs' shared development infrastructure for AI-driven teams — shared memory across projects, smart model routing, cross-AI adversarial audits (Trident: Claude + Codex + Gemini in parallel), and a disciplined think-build-ship workflow. v1.5.5 closed 60 audit findings in a single milestone. This package wires it onto every AI coding agent on your machine.
+
+Full docs: [github.com/FerroxLabs/ijfw](https://github.com/FerroxLabs/ijfw)
+
+## Table of contents
+
+- [Install](#install)
+- [What it does](#what-it-does)
+- [Options](#options)
+- [Uninstall](#uninstall)
+- [Links](#links)
 
 ## Install
 
 ```bash
 npm install -g @ijfw/install
-ijfw demo
+ijfw install
 ```
 
-IJFW configures every agent on your machine. The options below let you customize the install location, branch, or skip specific steps -- all are optional.
+If no AI agents are detected, install Claude Code or Codex first, then re-run.
+
+## What it does
 
-### Options
+- Installs the IJFW source tree at `~/.ijfw/`
+- Wires the MCP server into 14 platforms via their config files
+- Adds Aider as a rules-only tier — 15 agents supported total
+- Sets up shared memory at `~/.ijfw/memory/` (plain markdown hot, SQLite FTS5 warm, optional vectors cold)
+- Runs an 8-gate preflight before declaring done
+
+## Options
 
 | Flag | Default | Notes |
 |------|---------|-------|
 | `--dir <path>` | `$IJFW_HOME` or `~/.ijfw` | Install location |
 | `--branch <name>` | latest released tag | Git branch or tag |
-| `--no-marketplace` | off | Skip settings.json edits |
-| `--yes` | off | Non-interactive |
+| `--no-marketplace` | enabled | Skip settings.json edits |
+| `--yes` | interactive | Non-interactive run |
 
-### Uninstall
+## Uninstall
 
 ```bash
 ijfw uninstall          # preserves ~/.ijfw/memory/
 ijfw uninstall --purge  # removes memory too
 ```
 
-If `ijfw` isn't on your PATH (e.g. you uninstalled the global `@ijfw/install`
-package already), invoke the bin directly:
+If `ijfw` is no longer on your PATH, invoke the bin directly:
 
 ```bash
 npx -p @ijfw/install ijfw-uninstall
 ```
 
-Memory is preserved across re-runs by default.
-
-## Preflight
-
-Requires `node >=18` and `git` (used for the initial repo clone). The
-installer is Node-native end to end -- no bash, no WSL, no Git for Windows
-shell. On native Windows use the PowerShell installer (PS 5.1+), which
-delegates to Node directly:
-
-```powershell
-iwr https://gitlab.com/therealseandonahoe/ijfw/-/raw/main/installer/src/install.ps1 -OutFile install.ps1
-.\install.ps1 -Dir $env:USERPROFILE\.ijfw
-```
-
-## Extension CLI
-
-IJFW ships a full extension system for installing and sandboxing third-party skills.
-
-```bash
-# Publisher key management
-ijfw extension keygen <author>              # Generate an Ed25519 publisher keypair
-ijfw extension trust <keyId> <publicKey>   # Add a publisher to your trusted store
-ijfw extension trust-registry [<url>]      # Pull + apply the hosted publisher registry
-ijfw extension untrust <keyId>             # Remove a publisher from your trusted store
-ijfw extension trusted                     # List all trusted publishers
-
-# Extension lifecycle
-ijfw extension add <source> [flags]        # Install an extension (npm name, local path, or https git URL)
-  --allow-unsigned                         #   Accept extensions with no signature
-  --accept-untrusted                       #   Accept extensions signed by an untrusted publisher (prompts on TTY)
-  --activate                               #   Auto-activate after install
-ijfw extension activate <name>             # Activate an installed extension (enforces declared permissions)
-ijfw extension deactivate                  # Deactivate the current extension
-
-# Admin / registry maintainer (rare)
-ijfw extension rotate-keys <oldKeyId> <newKeyId>   # Produce a signed rotation token
-ijfw extension keygen-meta <author>                # Generate the registry meta-keypair
-ijfw extension sign-registry <path>                # Sign a registry JSON file in place
-ijfw extension verify-registry <path>              # Verify a registry JSON signature
-ijfw extension registry-status                     # Show registry cache age + signature status
-```
-
-The rotation flow and registry maintainer docs live in `docs/REGISTRY-MAINTAINER.md`.
-
-## Build (contributors)
-
-```bash
-cd installer
-npm install
-npm run build   # outputs dist/install.js + dist/uninstall.js
-npm test
-npm run pack:check
-```
+## Links
 
-Tarball target: **<100 KB**.
+- Source, issues, and docs: [github.com/FerroxLabs/ijfw](https://github.com/FerroxLabs/ijfw)
+- npm package: [@ijfw/install](https://www.npmjs.com/package/@ijfw/install)
+- License: MIT

package/dist/hub-index-snippet.json

@@ -0,0 +1,49 @@
+{
+  "name": "ijfw",
+  "displayName": "IJFW — AI Efficiency Layer",
+  "version": "1.5.5",
+  "description": "One install, every AI coding agent, zero config. Unifies 15 CLIs under a shared MCP memory layer so context follows you across Claude, Codex, Gemini, Cursor, Windsurf, and 10 more.",
+  "author": "Sean Donahoe",
+  "icon": "assets/ijfw-logo.svg",
+  "dist": {
+    "tarball": "extensions/ijfw-1.5.5.zip",
+    "integrity": "sha512-vm3ot0+GhXYy0/HcStB/xmFjZhSXWG7jzSLuIPe43/Dla8qhyR9gsCwBI/8+RsUJqMXiPgc0GuxrgwW2f5DDWA==",
+    "unpackedSize": 3312
+  },
+  "engines": {
+    "wayland": ">=0.6.0"
+  },
+  "hubs": [
+    "acpAdapters",
+    "mcpServers"
+  ],
+  "contributes": {
+    "acpAdapters": [
+      "claude",
+      "codex",
+      "gemini",
+      "cursor",
+      "windsurf",
+      "copilot",
+      "hermes",
+      "wayland",
+      "aider",
+      "opencode",
+      "qwencode",
+      "cline",
+      "kimicode",
+      "openclaw",
+      "antigravity"
+    ],
+    "mcpServers": [
+      "ijfw-memory"
+    ]
+  },
+  "tags": [
+    "ai",
+    "coding",
+    "mcp",
+    "memory",
+    "multi-agent"
+  ]
+}

package/dist/ijfw.js

@@ -2110,7 +2110,7 @@ __export(upgrade_smoke_exports, {
   severity: () => severity11
 });
 import { spawnSync as spawnSync11 } from "node:child_process";
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, readFileSync as readFileSync4, existsSync as existsSync4 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, readFileSync as readFileSync4, existsSync as existsSync4, cpSync } from "node:fs";
 import { join as join10, resolve as resolve2 } from "node:path";
 import { tmpdir as tmpdir3 } from "node:os";
 async function run11(ctx) {
@@ -2199,30 +2199,94 @@ async function run11(ctx) {
         durationMs: Date.now() - t0
       };
     }
-    const settingsPath = join10(claudeDir, "settings.json");
-    if (existsSync4(settingsPath)) {
-      let settings;
-      try {
-        settings = JSON.parse(readFileSync4(settingsPath, "utf8"));
-      } catch (e) {
-        return {
-          name: "upgrade-smoke",
-          status: "FAIL",
-          message: "upgrade-smoke: settings.json is not valid JSON",
-          details: [e.message],
-          durationMs: Date.now() - t0
-        };
+    const targetIjfwHome = join10(fakeHome, ".ijfw");
+    mkdirSync4(targetIjfwHome, { recursive: true });
+    for (const sub of ["claude", "mcp-server"]) {
+      const src = join10(ctx.repoRoot, sub);
+      if (existsSync4(src)) {
+        cpSync(src, join10(targetIjfwHome, sub), { recursive: true });
       }
-      const hasWrongKey = JSON.stringify(settings).includes("ijfw-core");
-      if (hasWrongKey) {
-        return {
-          name: "upgrade-smoke",
-          status: "FAIL",
-          message: 'upgrade-smoke: settings.json still uses deprecated "ijfw-core" key',
-          details: [`Found "ijfw-core" in: ${settingsPath}`],
-          durationMs: Date.now() - t0
-        };
+    }
+    const installerPkgSrc = join10(ctx.repoRoot, "installer", "package.json");
+    if (existsSync4(installerPkgSrc)) {
+      mkdirSync4(join10(targetIjfwHome, "installer"), { recursive: true });
+      cpSync(installerPkgSrc, join10(targetIjfwHome, "installer", "package.json"));
+    }
+    const runInstaller = spawnSync11(installerBin, ["--yes"], {
+      encoding: "utf8",
+      cwd: installDir,
+      timeout: 12e4,
+      env: {
+        ...cleanEnv,
+        HOME: fakeHome,
+        USERPROFILE: fakeHome,
+        IJFW_HOME: targetIjfwHome,
+        // Hermetic: install.js refuses any network attempt under this flag
+        // (TR-001). The gate's contract is "the installer either completes
+        // without network or fails clearly". The marketplace merge step
+        // (which is what we actually want to verify) does NOT need network.
+        CI: "1",
+        IJFW_SKIP_NETWORK: "1"
+      },
+      shell: process.platform === "win32"
+    });
+    if (runInstaller.status !== 0 || runInstaller.signal) {
+      const stderrLines = (runInstaller.stderr || "").split("\n").filter(Boolean);
+      const lastStderrLine = stderrLines.length > 0 ? stderrLines[stderrLines.length - 1].slice(0, 200) : "(no stderr)";
+      let cat;
+      if (runInstaller.signal) {
+        cat = `killed by ${runInstaller.signal}`;
+      } else if (runInstaller.status === 137 || runInstaller.status === 124) {
+        cat = `timed out (exit ${runInstaller.status})`;
+      } else if (runInstaller.status === null) {
+        cat = "timed out (status null)";
+      } else {
+        cat = `exited ${runInstaller.status}`;
       }
+      return {
+        name: "upgrade-smoke",
+        status: "FAIL",
+        message: `upgrade-smoke: installer ${cat}. Last stderr line: ${lastStderrLine}`,
+        details: ((runInstaller.stdout || "") + (runInstaller.stderr || "")).split("\n").filter(Boolean).slice(0, 15),
+        durationMs: Date.now() - t0
+      };
+    }
+    const settingsPath = join10(claudeDir, "settings.json");
+    if (!existsSync4(settingsPath)) {
+      return {
+        name: "upgrade-smoke",
+        status: "FAIL",
+        message: "upgrade-smoke: installer did not write ~/.claude/settings.json",
+        details: [
+          `expected: ${settingsPath}`,
+          "The installer ran (exit 0) but the marketplace merge never produced settings.json.",
+          "This is the false-pass shape TR-001 retired \u2014 the gate must observe the write.",
+          ...((runInstaller.stdout || "") + (runInstaller.stderr || "")).split("\n").filter(Boolean).slice(0, 8)
+        ],
+        durationMs: Date.now() - t0
+      };
+    }
+    let settings;
+    try {
+      settings = JSON.parse(readFileSync4(settingsPath, "utf8"));
+    } catch (e) {
+      return {
+        name: "upgrade-smoke",
+        status: "FAIL",
+        message: "upgrade-smoke: settings.json is not valid JSON",
+        details: [e.message],
+        durationMs: Date.now() - t0
+      };
+    }
+    const hasWrongKey = JSON.stringify(settings).includes("ijfw-core");
+    if (hasWrongKey) {
+      return {
+        name: "upgrade-smoke",
+        status: "FAIL",
+        message: 'upgrade-smoke: settings.json still uses deprecated "ijfw-core" key',
+        details: [`Found "ijfw-core" in: ${settingsPath}`],
+        durationMs: Date.now() - t0
+      };
     }
     const marketplaceSrc = join10(installerDir, "src", "marketplace.js");
     if (existsSync4(marketplaceSrc)) {
@@ -3782,6 +3846,16 @@ var COMMAND_REGISTRY = Object.freeze([
     helpGroup: "EXPLORE"
   },
   // ---------- TIER 2: COORDINATION (shown in `ijfw commands`) ----------
+  {
+    name: "pack-hub-extension",
+    tier: "coordination",
+    owner: "installer-direct",
+    description: "Pack the Wayland Hub Extension (zip + SHA-512 + manifest snippet). Used by Wayland's prebuild sync.",
+    aliases: [],
+    since: "1.5.4",
+    status: "active",
+    helpGroup: "BUILD"
+  },
   {
     name: "status",
     tier: "coordination",
@@ -4246,6 +4320,12 @@ async function main() {
       process.exit(r.status ?? 1);
       break;
     }
+    case "pack-hub-extension": {
+      const packScript = resolve4(__dirname2, "..", "scripts", "pack-hub-extension.js");
+      const r = spawnSync12("node", [packScript, ...argv.slice(3)], { stdio: "inherit" });
+      process.exit(r.status ?? 1);
+      break;
+    }
     case "uninstall": {
       const uninstallBin = resolve4(__dirname2, "..", "dist", "uninstall.js");
       const r = spawnSync12("node", [uninstallBin, ...argv.slice(3)], { stdio: "inherit" });