@ikon85/agent-workflow-kit 0.27.0 → 0.27.1

package/README.md

@@ -330,6 +330,10 @@ still reference. Flags: `--force` (overwrite pre-existing files on `init`),
 
 ## Release notes
 
+### 0.27.1
+
+- changed: `scripts/release-parity.mjs`
+
 ### 0.27.0
 
 - removed: `.agents/skills/zoom-out/SKILL.md`

package/agent-workflow-kit.package.json

@@ -1,5 +1,5 @@
 {
-  "kitVersion": "0.27.0",
+  "kitVersion": "0.27.1",
   "files": [
     {
       "path": ".agents/skills/ask-matt/SKILL.md",
@@ -2539,7 +2539,7 @@
       "path": "scripts/release-parity.mjs",
       "kind": "script",
       "installRole": "consumer",
-      "sha256": "faa4a1d1116d58f69c8541a586ebd6076ebc3f7af7809e9e4a53928f49298365",
+      "sha256": "32f61bf776974be63a017e90f428d4dab6098a9e2ba0c25c865d18ea3bd3e89e",
       "mode": 420,
       "origin": "kit"
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikon85/agent-workflow-kit",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "Portable AI-agent workflow skills (plan → execute → land → learn) for Claude Code & Codex — grilling, TDD, diagnosis, two-axis code review, cross-model Codex review, design & domain-modeling, plus a skill router (ask-matt). npx init/update/diff/uninstall.",
   "type": "module",
   "bin": {

package/scripts/release-parity.mjs

@@ -50,3 +50,37 @@ export function assertReleaseParity(identities) {
   }
   return identities.local;
 }
+
+// Consumer-side identity: an unpacked installation cannot be re-packed
+// byte-identically (npm normalizes at publish/unpack), so the installed copy
+// proves itself by content — never by a fresh tarball hash.
+const INSTALLED_FIELDS = ['name', 'version', 'manifestSha256'];
+
+export async function installedIdentityFromDir(kitRoot) {
+  const packageJson = JSON.parse(await readFile(`${kitRoot}/package.json`, 'utf8'));
+  const manifest = await readFile(`${kitRoot}/agent-workflow-kit.package.json`);
+  if (packageJson.version !== JSON.parse(manifest).kitVersion) {
+    throw new Error('installed package and manifest versions mismatch');
+  }
+  return {
+    name: packageJson.name,
+    version: packageJson.version,
+    manifestSha256: digest('sha256', manifest),
+  };
+}
+
+export function assertConsumerReleaseParity({ installed, npm, github }) {
+  validate('npm', npm);
+  validate('github', github);
+  for (const field of FIELDS) {
+    if (github[field] !== npm[field]) throw new Error(`github ${field} mismatch`);
+  }
+  if (!installed || typeof installed !== 'object') throw new Error('installed release identity missing');
+  for (const field of INSTALLED_FIELDS) {
+    if (typeof installed[field] !== 'string' || !installed[field]) {
+      throw new Error(`installed ${field} missing`);
+    }
+    if (installed[field] !== npm[field]) throw new Error(`installed ${field} mismatch`);
+  }
+  return npm;
+}

package/scripts/release-parity.test.mjs

@@ -51,3 +51,40 @@ test('a package tarball produces a deterministic content identity', async () =>
     assert.deepEqual(first, second);
   } finally { await rm(root, { recursive: true, force: true }); }
 });
+
+test('consumer parity proves npm↔github and matches the installed copy without re-packing', async () => {
+  const { assertConsumerReleaseParity } = await import('./release-parity.mjs');
+  const installed = { name: identity.name, version: identity.version, manifestSha256: identity.manifestSha256 };
+  assert.deepEqual(
+    assertConsumerReleaseParity({ installed, npm: { ...identity }, github: { ...identity } }),
+    identity,
+  );
+  assert.throws(() => assertConsumerReleaseParity({
+    installed, npm: { ...identity }, github: { ...identity, tarballIntegrity: 'different' },
+  }), /github tarballIntegrity mismatch/);
+  assert.throws(() => assertConsumerReleaseParity({
+    installed: { ...installed, manifestSha256: 'different' },
+    npm: { ...identity }, github: { ...identity },
+  }), /installed manifestSha256 mismatch/);
+  assert.throws(() => assertConsumerReleaseParity({
+    installed: { ...installed, version: '9.9.9' },
+    npm: { ...identity }, github: { ...identity },
+  }), /installed version mismatch/);
+});
+
+test('an installed kit directory yields a content identity without npm pack', async () => {
+  const { installedIdentityFromDir } = await import('./release-parity.mjs');
+  const root = await mkdtemp(join(tmpdir(), 'release-parity-installed-'));
+  try {
+    const manifest = JSON.stringify({ kitVersion: '1.2.3', files: [] });
+    await writeFile(join(root, 'package.json'), JSON.stringify({ name: identity.name, version: '1.2.3' }));
+    await writeFile(join(root, 'agent-workflow-kit.package.json'), manifest);
+    const installed = await installedIdentityFromDir(root);
+    assert.equal(installed.name, identity.name);
+    assert.equal(installed.version, '1.2.3');
+    assert.equal(typeof installed.manifestSha256, 'string');
+    assert.equal('tarballIntegrity' in installed, false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/cli.mjs

@@ -7,6 +7,7 @@ import { update } from './commands/update.mjs';
 import { diff } from './commands/diff.mjs';
 import { uninstall } from './commands/uninstall.mjs';
 import { createCommandAdapter } from '../scripts/release-state.mjs';
+import { installedIdentityFromDir } from '../scripts/release-parity.mjs';
 
 const KIT_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const consumerRoot = process.cwd();
@@ -87,8 +88,10 @@ async function readUpdateRelease() {
     env: { ...process.env, GH_REPO: 'iKon85/agent-workflow-kit' },
   });
   try {
-    const local = (await adapter.local()).identity;
-    return { local, npm: await adapter.npm(local), github: await adapter.github(local) };
+    // Re-packing an unpacked install is never byte-identical to the registry
+    // tarball — the installed copy proves itself by content identity instead.
+    const installed = await installedIdentityFromDir(KIT_ROOT);
+    return { installed, npm: await adapter.npm(installed), github: await adapter.github(installed) };
   } finally {
     await adapter.dispose();
   }

package/src/commands/update.mjs

@@ -1,6 +1,6 @@
 import { readFile, rm } from 'node:fs/promises';
 import { join } from 'node:path';
-import { assertReleaseParity } from '../../scripts/release-parity.mjs';
+import { assertConsumerReleaseParity } from '../../scripts/release-parity.mjs';
 import { activateCandidate, stageConsumer, verifyCandidate } from '../lib/updateCandidate.mjs';
 import { reconcile } from '../lib/updateReconcile.mjs';
 import {
@@ -86,7 +86,7 @@ async function applyTransaction(context) {
 }
 
 function verifyRelease(identities, kitVersion) {
-  const release = assertReleaseParity(identities);
+  const release = assertConsumerReleaseParity(identities);
   if (release.name !== RELEASE_NAME) throw new Error(`invalid release origin: ${release.name}`);
   if (release.version !== kitVersion) {
     throw new Error(`release version ${release.version} does not match kit ${kitVersion}`);