@ikon85/agent-workflow-kit 0.36.4 → 0.36.5

package/README.md

@@ -445,6 +445,13 @@ the old way. Decision record:
 
 ## Release notes
 
+### 0.36.5
+
+- changed: `src/lib/updateCandidate.mjs`
+- changed: `src/lib/updateReconcile.mjs`
+- changed: `src/lib/verifyUpdateCandidate.mjs`
+- changed: `src/lib/verifyUpdateCandidateTransaction.mjs`
+
 ### 0.36.4
 
 - changed: `scripts/release-delta-guard.mjs`

package/agent-workflow-kit.package.json

@@ -1,5 +1,5 @@
 {
-  "kitVersion": "0.36.4",
+  "kitVersion": "0.36.5",
   "files": [
     {
       "path": ".agents/skills/ask-matt/SKILL.md",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikon85/agent-workflow-kit",
-  "version": "0.36.4",
+  "version": "0.36.5",
   "description": "Portable AI-agent workflow skills (plan → execute → land → learn) for Claude Code & Codex — grilling, TDD, diagnosis, two-axis code review, cross-model Codex review, design & domain-modeling, plus a skill router (ask-matt). npx init/update/diff/uninstall.",
   "type": "module",
   "bin": {

package/src/lib/updateCandidate.mjs

@@ -351,6 +351,14 @@ async function assertConsumerStillMatchesPreview(consumerRoot, preview) {
       throw new Error(`consumer changed during verification: ${path}`);
     }
   }
+  for (const snapshot of preview.userModifiedSnapshots ?? []) {
+    const target = join(consumerRoot, snapshot.path);
+    const current = await exists(target) ? await sha256File(target) : null;
+    const mode = current === null ? null : (await lstat(target)).mode & 0o777;
+    if (current !== snapshot.sha256 || mode !== snapshot.mode) {
+      throw new Error(`consumer changed during verification: ${snapshot.path}`);
+    }
+  }
 }
 
 /** Seed only newly declared, decision-free project-layer stubs in a staged candidate. */

package/src/lib/updateReconcile.mjs

@@ -156,6 +156,11 @@ export async function reconcile({ kitRoot, consumerRoot, decide = () => false, d
     } else if (userEdited) {
       nextInstalled.push(withInstallRole(prior));
       result.userModified.push(file.path);
+      result.userModifiedSnapshots.push({
+        path: file.path,
+        sha256: current,
+        mode: currentMode,
+      });
     } else {
       nextInstalled.push(withInstallRole(prior));
       result.unchanged.push(file.path);
@@ -202,6 +207,7 @@ export async function reconcile({ kitRoot, consumerRoot, decide = () => false, d
 function emptyResult() {
   return {
     unchanged: [], updated: [], conflicts: [], collisions: [], collisionResolutions: [], userModified: [],
+    userModifiedSnapshots: [],
     ownershipStates: [],
     bridgeRetired: [],
     added: [], deleted: [], keptDeleted: [], consumerOwned: [], manifestChanged: false,

package/src/lib/verifyUpdateCandidate.mjs

@@ -61,11 +61,14 @@ export async function verifyCandidateMetadata(candidateRoot, context) {
     if (!state.isFile()) {
       throw new Error(`candidate invariant artifact: not a regular file ${entry.path}`);
     }
-    if (tracked.origin === KIT_ORIGIN && (state.mode & 0o777) !== entry.mode) {
+    const localSnapshot = (context.preview.userModifiedSnapshots ?? [])
+      .find(({ path }) => path === entry.path);
+    const expectedMode = localSnapshot?.mode ?? entry.mode;
+    if (tracked.origin === KIT_ORIGIN && (state.mode & 0o777) !== expectedMode) {
       throw new Error(`candidate invariant artifact: mode mismatch ${entry.path}`);
     }
-    const expectedHash = tracked.origin === CONSUMER_ORIGIN
-      ? tracked.installedSha256 : entry.sha256;
+    const expectedHash = localSnapshot?.sha256 ?? (tracked.origin === CONSUMER_ORIGIN
+      ? tracked.installedSha256 : entry.sha256);
     if (await sha256File(join(candidateRoot, entry.path)) !== expectedHash) {
       throw new Error(`candidate invariant artifact: hash mismatch ${entry.path}`);
     }

package/src/lib/verifyUpdateCandidateTransaction.mjs

@@ -44,7 +44,7 @@ export function verifyTransactionPreview(preview, installable, installed) {
   const installablePaths = new Set(installable.map(({ path }) => path));
   const owners = new Map();
   const actionSets = new Map();
-  for (const key of ['added', 'updated', 'deleted', 'generated', 'keptDeleted']) {
+  for (const key of ['added', 'updated', 'deleted', 'generated', 'keptDeleted', 'userModified']) {
     if (!Array.isArray(preview[key] ?? [])) {
       throw new Error(`candidate invariant transaction: ${key} must be an array`);
     }
@@ -54,12 +54,34 @@ export function verifyTransactionPreview(preview, installable, installed) {
       if (['added', 'updated'].includes(key) && !installablePaths.has(path)) {
         throw new Error(`candidate invariant transaction: unmanaged ${key} path ${path}`);
       }
+      if (key === 'userModified' && !installablePaths.has(path)) {
+        throw new Error(`candidate invariant transaction: unmanaged userModified path ${path}`);
+      }
       if (key === 'deleted' && installablePaths.has(path)) {
         throw new Error(`candidate invariant transaction: deletes current package path ${path}`);
       }
     }
     actionSets.set(key, local);
   }
+  if (!Array.isArray(preview.userModifiedSnapshots ?? [])) {
+    throw new Error('candidate invariant transaction: userModifiedSnapshots must be an array');
+  }
+  const modified = actionSets.get('userModified');
+  const snapshots = new Set();
+  for (const snapshot of preview.userModifiedSnapshots ?? []) {
+    const path = snapshot?.path;
+    claimTransactionPath(path, 'userModifiedSnapshots', snapshots);
+    if (!modified.has(path)
+        || !HASH.test(snapshot.sha256 ?? '')
+        || !Number.isInteger(snapshot.mode)
+        || snapshot.mode < 0
+        || snapshot.mode > 0o777) {
+      throw new Error(`candidate invariant transaction: invalid local snapshot ${path}`);
+    }
+  }
+  if (snapshots.size !== modified.size) {
+    throw new Error('candidate invariant transaction: missing local snapshot');
+  }
   if (!Array.isArray(preview.bridgeRetired ?? [])) {
     throw new Error('candidate invariant transaction: bridgeRetired must be an array');
   }