@jaguilar87/gaia 5.0.5 → 5.0.7

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "gaia-ops",
       "description": "Full DevOps orchestration for Claude Code. Eight specialized agents handle the complete development lifecycle — analysis, planning, execution, and deployment. Gaia-Ops scans your codebase to understand it and injects the right context into each sub-agent. Every command is classified by risk: read-only runs freely, state changes pause for your approval, and irreversible operations are permanently blocked.",
-      "version": "5.0.5",
+      "version": "5.0.7",
       "category": "devops",
       "author": {
         "name": "jaguilar87",
@@ -20,7 +20,7 @@
     {
       "name": "gaia-security",
       "description": "Keeps you in the loop only when it matters. Gaia Security analyzes every command and classifies it into risk tiers: read-only queries run freely, simulations and validations pass through, and state-changing operations (create, delete, apply, push) pause for your explicit approval before executing. Irreversible commands like dropping databases or deleting cloud infrastructure are permanently blocked.",
-      "version": "5.0.5",
+      "version": "5.0.7",
       "category": "security",
       "author": {
         "name": "jaguilar87",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gaia-ops",
-  "version": "5.0.5",
+  "version": "5.0.7",
   "description": "Security-first orchestrator with specialized agents, hooks, and governance for AI coding",
   "author": {
     "name": "jaguilar87",

package/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.0.7] - 2026-06-12
+
+### Fixed
+
+- `gaia doctor` now passes (rc=0) on a clean install: the `commands` symlink (a removed surface) was dropped from the symlink checks, and `memory_fts5_count` now reads the canonical gaia.db store instead of the legacy search.db — eliminating the two warnings that made a fresh install report "degraded" in 5.0.5/5.0.6.
+
+### Changed
+
+- Release pipeline: the sandbox validation harness is now a PRE-publish gate (runs against the packed tarball before `npm publish`), and the harness fails if `gaia doctor` returns rc>=1 — so a degraded build can no longer be published.
+
+## [5.0.6] - 2026-06-12
+
+### Fixed
+
+- **`gaia doctor` no longer reports a freshly-installed workspace as "degraded"
+  (rc=1)** — an empty project-context contracts table is now `info` (an advisory
+  to run `gaia scan`) instead of `warning`, so a clean install passes doctor with
+  rc=0. Fixes the post-publish sandbox-validation failure seen in 5.0.5.
+
 ## [5.0.5] - 2026-06-11
 
 ### Repository Hygiene, Python 3.11 Floor, v18 Schema Floor + Drift Guard, Release-Pipeline Hardening

package/bin/cli/_install_helpers.py

@@ -345,7 +345,7 @@ def merge_local_hooks(
 # ---------------------------------------------------------------------------
 
 # Directories the package exposes via .claude/<name> symlinks
-_SYMLINK_NAMES = ["agents", "tools", "hooks", "commands", "config", "skills"]
+_SYMLINK_NAMES = ["agents", "tools", "hooks", "config", "skills"]
 # Files (not dirs) we link or copy into .claude/
 _SYMLINK_FILES = ["CHANGELOG.md"]
 

package/bin/cli/doctor.py

@@ -762,7 +762,7 @@ def _extract_check_values(
 @register_check("Symlinks", order=50)
 def check_symlinks(project_root: Path) -> dict:
     """Check .claude/ symlinks resolve to package content."""
-    names = ["agents", "tools", "hooks", "commands", "config", "skills", "CHANGELOG.md"]
+    names = ["agents", "tools", "hooks", "config", "skills", "CHANGELOG.md"]
     critical = {"agents", "hooks", "skills"}
     valid = 0
     has_critical_missing = False
@@ -935,7 +935,7 @@ def check_project_context(project_root: Path) -> dict:
         return _result("project-context", "warning", f"DB read error: {exc}", "Run `gaia scan`")
 
     if count == 0:
-        return _result("project-context", "warning", "No contracts in DB", "Run `gaia scan`")
+        return _result("project-context", "info", "No contracts in DB", "Run `gaia scan`")
 
     if count < 3:
         return _result(
@@ -1053,34 +1053,36 @@ def check_memory_fts5_db(project_root: Path) -> dict:
 
 @register_check("memory_fts5_count", order=130)
 def check_memory_fts5_count(project_root: Path) -> dict:
-    """Check FTS5 indexed count against total episode count in index.json."""
-    index_path = project_root / ".claude" / "project-context" / "episodic-memory" / "index.json"
-
-    if not index_path.is_file():
-        return _result("memory_fts5_count", "info", "index.json not found — no episodes yet")
-
-    index_data = _read_json(index_path)
-    if not index_data:
-        return _result("memory_fts5_count", "info", "index.json unreadable")
-
-    total = len(index_data.get("episodes") or [])
+    """Check FTS5 indexed count against total episode count in gaia.db.
 
+    T6 migration: replaced legacy search_store.count()/index.json check
+    (which read search.db and ignored GAIA_DATA_DIR) with queries against
+    the canonical gaia.db -- episodes_fts for indexed, episodes for total.
+    """
     try:
         import sys as _sys
-        # Ensure package root is on path for lazy import
         pkg_root = str(_package_root())
         if pkg_root not in _sys.path:
             _sys.path.insert(0, pkg_root)
-        from tools.memory import search_store  # noqa: PLC0415
-        indexed = search_store.count()
+        from gaia.store.writer import _connect as _store_connect
     except ImportError:
         return _result(
             "memory_fts5_count",
             "info",
-            "tools.memory.search_store not importable — FTS5 count skipped",
+            "gaia.store.writer not importable — FTS5 count skipped",
         )
+
+    try:
+        con = _store_connect()
+        try:
+            indexed_row = con.execute("SELECT COUNT(*) FROM episodes_fts").fetchone()
+            indexed = indexed_row[0] if indexed_row else 0
+            total_row = con.execute("SELECT COUNT(*) FROM episodes").fetchone()
+            total = total_row[0] if total_row else 0
+        finally:
+            con.close()
     except Exception as exc:
-        return _result("memory_fts5_count", "info", f"Could not query FTS5 count: {exc}")
+        return _result("memory_fts5_count", "info", f"Could not query FTS5 count from gaia.db: {exc}")
 
     if total == 0:
         return _result("memory_fts5_count", "pass", "No episodes to index")

package/bin/validate-sandbox.sh

@@ -590,11 +590,16 @@ else
   rc=$?
 fi
 ms=$(( $(now_ms) - t0 ))
-# doctor may exit 1 on warnings; allow rc=0 or rc=1 if json is parseable
-if python3 -c "import json,sys; d=json.loads(sys.argv[1]); c=d['checks']; p=sum(1 for r in c if r['severity']=='pass'); t=len(c); sys.exit(0 if t>=5 and p>=max(1,t-3) else 1)" "${out}" 2>/dev/null; then
+# The harness gate must not pass a degraded doctor: a non-zero rc means at
+# least one check is warning/error, so treat rc>=1 as a hard FAILURE. Only a
+# clean rc=0 (all checks pass/info) with parseable JSON counts as PASS.
+if [[ "${rc}" -ne 0 ]]; then
+  nonpass="$(python3 -c "import json,sys; d=json.loads(sys.argv[1]); print(', '.join(f\"{r['name']}={r['severity']}\" for r in d['checks'] if r['severity'] not in ('pass','info')))" "${out}" 2>/dev/null || echo "unparseable output")"
+  record "gaia doctor --json" "FAIL" "doctor returned rc=${rc}; non-pass: ${nonpass:-none}" "${ms}"
+elif python3 -c "import json,sys; d=json.loads(sys.argv[1]); c=d['checks']; t=len(c); sys.exit(0 if t>=5 else 1)" "${out}" 2>/dev/null; then
   total=$(python3 -c "import json,sys; d=json.loads(sys.argv[1]); print(len(d['checks']))" "${out}")
   passed=$(python3 -c "import json,sys; d=json.loads(sys.argv[1]); print(sum(1 for r in d['checks'] if r['severity']=='pass'))" "${out}")
-  record "gaia doctor --json" "PASS" "${passed}/${total} checks passed" "${ms}"
+  record "gaia doctor --json" "PASS" "rc=0, ${passed}/${total} checks passed" "${ms}"
 else
   record "gaia doctor --json" "FAIL" "parse/threshold failure (rc=${rc})" "${ms}"
 fi

package/dist/gaia-ops/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gaia-ops",
-  "version": "5.0.5",
+  "version": "5.0.7",
   "description": "Full DevOps orchestration for Claude Code. Eight specialized agents handle the complete development lifecycle \u2014 analysis, planning, execution, and deployment. Gaia-Ops scans your codebase to understand it and injects the right context into each sub-agent. Every command is classified by risk: read-only runs freely, state changes pause for your approval, and irreversible operations are permanently blocked.",
   "author": {
     "name": "jaguilar87",

package/dist/gaia-ops/skills/gaia-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gaia-patterns
-description: Use when building or modifying gaia-ops components -- agents, skills, hooks, CLI tools, commands, or routing config
+description: Use when building or modifying gaia-ops components -- agents, skills, hooks, CLI tools, or routing config
 metadata:
   user-invocable: false
   type: domain
@@ -77,10 +77,6 @@ Agents get instantiated as: identity (.md) + skills (injected from frontmatter)
 
 CLI tools live in `bin/` and are registered in `package.json` `bin` field. Pattern: parse args, resolve paths (follow symlinks to source), run checks, exit with code. `gaia doctor` is the diagnostic model -- read it first.
 
-## Command Patterns
-
-Slash commands live in `commands/<name>.md` -- markdown files that instruct the orchestrator on `/<name>`. To add: create the `.md`, add to `build/<plugin>.manifest.json`.
-
 ## Documentation Drift Awareness
 
 When you modify any Gaia component (hook, skill, agent definition, routing config, security rule), check if existing reference docs describe that component's behavior. If drift exists, report it via `cross_layer_impacts` in your agent_contract_handoff. The orchestrator then decides whether to dispatch a documentation update task.
@@ -91,7 +87,7 @@ When you modify any Gaia component (hook, skill, agent definition, routing confi
 - Changed `_is_protected()` paths in `adapters/claude_code.py` → check `security-tiers/SKILL.md` for path documentation
 - Added a new agent definition → check `gaia-patterns/reference.md` for agents table
 - Modified hook enforcement logic → check `security-tiers` and `agent-protocol` references
-- When adding or modifying files in agents/, skills/, hooks/, commands/, config/, bin/, tests/, build/ or the repo root, load Skill('readme-writing') to update the relevant README.md
+- When adding or modifying files in agents/, skills/, hooks/, config/, bin/, tests/, build/ or the repo root, load Skill('readme-writing') to update the relevant README.md
 
 **Format:** In `cross_layer_impacts`, list the doc file and the behavior change, e.g.:
 ```

package/dist/gaia-ops/skills/gaia-patterns/reference.md

@@ -80,14 +80,6 @@ SessionStart emits a one-shot `hookSpecificOutput.additionalContext` manifest (E
 | `skill-creation/` | Technique | Injected (gaia-system) |
 | `skills/reference.md` | Reference | On-demand (shared security-tiers ref) |
 
-### Commands (slash commands)
-
-| Command | File | Purpose |
-|---------|------|---------|
-| `/gaia` | `commands/gaia.md` | Invoke gaia meta-agent |
-| `/scan-project` | `commands/scan-project.md` | Scan project, update project context in ~/.gaia/gaia.db |
-| `/gaia-plan` | `commands/gaia-plan.md` | Plan a feature, create brief, decompose into tasks |
-
 ### Tools (7 subsystems)
 
 | Subsystem | Location | Purpose |
@@ -139,7 +131,7 @@ The package ships a single `gaia` binary (`bin/gaia.js`) that dispatches to Pyth
 
 | Mode | Package | What ships |
 |------|---------|-----------|
-| `gaia-ops` | `@jaguilar87/gaia` (full) | All hooks, all modules, all agents, all skills, all commands, all tools, all config |
+| `gaia-ops` | `@jaguilar87/gaia` (full) | All hooks, all modules, all agents, all skills, all tools, all config |
 | `gaia-security` | `@jaguilar87/gaia` (security dist) | 6 hooks (`pre_tool_use`, `post_tool_use`, `stop_hook`, `user_prompt_submit`, `session_start`, `session_end_hook`), all modules, no agents, no skills, no config |
 
 ### Detection Cascade (`hooks/modules/core/plugin_mode.py`)
@@ -159,7 +151,6 @@ The package ships a single `gaia` binary (`bin/gaia.js`) that dispatches to Pyth
 | T3 approval | Claude Code native dialog (`permissionDecision: ask`) | Hook blocks with nonce, orchestrator approval flow |
 | Agents | None | 8 agents routed by orchestrator |
 | Skills | None | 24 skills injected per frontmatter |
-| Commands | None | 7 slash commands |
 | PreToolUse matchers | `Bash` only | `Bash`, `Task`, `Agent`, `SendMessage`, multi-tool |
 | File write protection | `_is_protected()` blocks hooks/ and settings*.json for Edit/Write tools | Same -- fires regardless of permissionMode |
 
@@ -206,7 +197,7 @@ npm publish                    # publishes @jaguilar87/gaia
 3. Run `scripts/bootstrap_database.sh` -- seeds the schema (v17), agent rows, and `schema_version`. Fail-loud: any non-zero exit writes `~/.gaia/last-install-error.json` and propagates the error.
 4. Merge permissions, env vars, and agent key into `settings.local.json` (preserves user config).
 5. Merge hooks from `hooks.json` into `settings.local.json` via the consolidated `merge_hooks` step.
-6. Create `.claude/{agents, tools, hooks, commands, templates, config, skills}` symlinks (7) plus `CHANGELOG.md` file link.
+6. Create `.claude/{agents, tools, hooks, config, skills}` symlinks (5) plus `CHANGELOG.md` file link.
 7. Write `plugin-registry.json` with `installed[].name == "gaia-ops"` (or `gaia-security`).
 8. Verification.
 
@@ -229,8 +220,6 @@ The hook invoker is `python3 <script>` rather than executing the script directly
 .claude/agents    -> node_modules/@jaguilar87/gaia/agents/
 .claude/tools     -> node_modules/@jaguilar87/gaia/tools/
 .claude/hooks     -> node_modules/@jaguilar87/gaia/hooks/
-.claude/commands  -> node_modules/@jaguilar87/gaia/commands/
-.claude/templates -> node_modules/@jaguilar87/gaia/templates/
 .claude/config    -> node_modules/@jaguilar87/gaia/config/
 .claude/skills    -> node_modules/@jaguilar87/gaia/skills/
 .claude/CHANGELOG.md (file link) -> node_modules/@jaguilar87/gaia/CHANGELOG.md
@@ -333,7 +322,6 @@ ln -sf /home/jorge/ws/me/gaia-dev/agents   .claude/agents
 ln -sf /home/jorge/ws/me/gaia-dev/hooks    .claude/hooks
 ln -sf /home/jorge/ws/me/gaia-dev/skills   .claude/skills
 ln -sf /home/jorge/ws/me/gaia-dev/tools    .claude/tools
-ln -sf /home/jorge/ws/me/gaia-dev/commands .claude/commands
 ln -sf /home/jorge/ws/me/gaia-dev/config   .claude/config
 ```
 

package/dist/gaia-security/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gaia-security",
-  "version": "5.0.5",
+  "version": "5.0.7",
   "description": "Keeps you in the loop only when it matters. Gaia Security analyzes every command and classifies it into risk tiers: read-only queries run freely, simulations and validations pass through, and state-changing operations (create, delete, apply, push) pause for your explicit approval before executing. Irreversible commands like dropping databases or deleting cloud infrastructure are permanently blocked.",
   "author": {
     "name": "jaguilar87",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaguilar87/gaia",
-  "version": "5.0.5",
+  "version": "5.0.7",
   "description": "Multi-agent orchestration system for Claude Code - DevOps automation toolkit",
   "main": "index.js",
   "type": "module",

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gaia"
-version = "5.0.5"
+version = "5.0.7"
 description = "Multi-agent orchestration system for Claude Code - DevOps automation toolkit"
 requires-python = ">=3.11"
 license = {text = "MIT"}

package/skills/gaia-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gaia-patterns
-description: Use when building or modifying gaia-ops components -- agents, skills, hooks, CLI tools, commands, or routing config
+description: Use when building or modifying gaia-ops components -- agents, skills, hooks, CLI tools, or routing config
 metadata:
   user-invocable: false
   type: domain
@@ -77,10 +77,6 @@ Agents get instantiated as: identity (.md) + skills (injected from frontmatter)
 
 CLI tools live in `bin/` and are registered in `package.json` `bin` field. Pattern: parse args, resolve paths (follow symlinks to source), run checks, exit with code. `gaia doctor` is the diagnostic model -- read it first.
 
-## Command Patterns
-
-Slash commands live in `commands/<name>.md` -- markdown files that instruct the orchestrator on `/<name>`. To add: create the `.md`, add to `build/<plugin>.manifest.json`.
-
 ## Documentation Drift Awareness
 
 When you modify any Gaia component (hook, skill, agent definition, routing config, security rule), check if existing reference docs describe that component's behavior. If drift exists, report it via `cross_layer_impacts` in your agent_contract_handoff. The orchestrator then decides whether to dispatch a documentation update task.
@@ -91,7 +87,7 @@ When you modify any Gaia component (hook, skill, agent definition, routing confi
 - Changed `_is_protected()` paths in `adapters/claude_code.py` → check `security-tiers/SKILL.md` for path documentation
 - Added a new agent definition → check `gaia-patterns/reference.md` for agents table
 - Modified hook enforcement logic → check `security-tiers` and `agent-protocol` references
-- When adding or modifying files in agents/, skills/, hooks/, commands/, config/, bin/, tests/, build/ or the repo root, load Skill('readme-writing') to update the relevant README.md
+- When adding or modifying files in agents/, skills/, hooks/, config/, bin/, tests/, build/ or the repo root, load Skill('readme-writing') to update the relevant README.md
 
 **Format:** In `cross_layer_impacts`, list the doc file and the behavior change, e.g.:
 ```

package/skills/gaia-patterns/reference.md

@@ -80,14 +80,6 @@ SessionStart emits a one-shot `hookSpecificOutput.additionalContext` manifest (E
 | `skill-creation/` | Technique | Injected (gaia-system) |
 | `skills/reference.md` | Reference | On-demand (shared security-tiers ref) |
 
-### Commands (slash commands)
-
-| Command | File | Purpose |
-|---------|------|---------|
-| `/gaia` | `commands/gaia.md` | Invoke gaia meta-agent |
-| `/scan-project` | `commands/scan-project.md` | Scan project, update project context in ~/.gaia/gaia.db |
-| `/gaia-plan` | `commands/gaia-plan.md` | Plan a feature, create brief, decompose into tasks |
-
 ### Tools (7 subsystems)
 
 | Subsystem | Location | Purpose |
@@ -139,7 +131,7 @@ The package ships a single `gaia` binary (`bin/gaia.js`) that dispatches to Pyth
 
 | Mode | Package | What ships |
 |------|---------|-----------|
-| `gaia-ops` | `@jaguilar87/gaia` (full) | All hooks, all modules, all agents, all skills, all commands, all tools, all config |
+| `gaia-ops` | `@jaguilar87/gaia` (full) | All hooks, all modules, all agents, all skills, all tools, all config |
 | `gaia-security` | `@jaguilar87/gaia` (security dist) | 6 hooks (`pre_tool_use`, `post_tool_use`, `stop_hook`, `user_prompt_submit`, `session_start`, `session_end_hook`), all modules, no agents, no skills, no config |
 
 ### Detection Cascade (`hooks/modules/core/plugin_mode.py`)
@@ -159,7 +151,6 @@ The package ships a single `gaia` binary (`bin/gaia.js`) that dispatches to Pyth
 | T3 approval | Claude Code native dialog (`permissionDecision: ask`) | Hook blocks with nonce, orchestrator approval flow |
 | Agents | None | 8 agents routed by orchestrator |
 | Skills | None | 24 skills injected per frontmatter |
-| Commands | None | 7 slash commands |
 | PreToolUse matchers | `Bash` only | `Bash`, `Task`, `Agent`, `SendMessage`, multi-tool |
 | File write protection | `_is_protected()` blocks hooks/ and settings*.json for Edit/Write tools | Same -- fires regardless of permissionMode |
 
@@ -206,7 +197,7 @@ npm publish                    # publishes @jaguilar87/gaia
 3. Run `scripts/bootstrap_database.sh` -- seeds the schema (v17), agent rows, and `schema_version`. Fail-loud: any non-zero exit writes `~/.gaia/last-install-error.json` and propagates the error.
 4. Merge permissions, env vars, and agent key into `settings.local.json` (preserves user config).
 5. Merge hooks from `hooks.json` into `settings.local.json` via the consolidated `merge_hooks` step.
-6. Create `.claude/{agents, tools, hooks, commands, templates, config, skills}` symlinks (7) plus `CHANGELOG.md` file link.
+6. Create `.claude/{agents, tools, hooks, config, skills}` symlinks (5) plus `CHANGELOG.md` file link.
 7. Write `plugin-registry.json` with `installed[].name == "gaia-ops"` (or `gaia-security`).
 8. Verification.
 
@@ -229,8 +220,6 @@ The hook invoker is `python3 <script>` rather than executing the script directly
 .claude/agents    -> node_modules/@jaguilar87/gaia/agents/
 .claude/tools     -> node_modules/@jaguilar87/gaia/tools/
 .claude/hooks     -> node_modules/@jaguilar87/gaia/hooks/
-.claude/commands  -> node_modules/@jaguilar87/gaia/commands/
-.claude/templates -> node_modules/@jaguilar87/gaia/templates/
 .claude/config    -> node_modules/@jaguilar87/gaia/config/
 .claude/skills    -> node_modules/@jaguilar87/gaia/skills/
 .claude/CHANGELOG.md (file link) -> node_modules/@jaguilar87/gaia/CHANGELOG.md
@@ -333,7 +322,6 @@ ln -sf /home/jorge/ws/me/gaia-dev/agents   .claude/agents
 ln -sf /home/jorge/ws/me/gaia-dev/hooks    .claude/hooks
 ln -sf /home/jorge/ws/me/gaia-dev/skills   .claude/skills
 ln -sf /home/jorge/ws/me/gaia-dev/tools    .claude/tools
-ln -sf /home/jorge/ws/me/gaia-dev/commands .claude/commands
 ln -sf /home/jorge/ws/me/gaia-dev/config   .claude/config
 ```