@kontextmind/kxm 0.7.109 → 0.7.111

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.109",
+      "version": "0.7.111",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.109",
+  "version": "0.7.111",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.109",
+  "version": "0.7.111",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/mcp-server.js

@@ -17313,7 +17313,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.109";
+var VERSION = "0.7.111";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.109",
+  "version": "0.7.111",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.109";
+const VERSION = "0.7.111";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();

package/scripts/check-generated.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -22,6 +22,55 @@ export const STATIC_GENERATED_ARTIFACTS = Object.freeze([
   "GEMINI.md",
 ]);
 
+/**
+ * Packages whose installed version differs from `package-lock.json`.
+ *
+ * The generated bundles embed dependency **bytes and paths**, so a
+ * `node_modules` that has drifted from the lock produces artifacts that pass
+ * this check locally and fail in CI — which installs from the lock on every
+ * leg. That asymmetry is worse than a broken build: it lets a machine ship a
+ * bundle nobody else can reproduce. Refuse before the build, naming the
+ * packages, instead of reporting a diff the developer cannot act on.
+ *
+ * @param {string} [repository]
+ * @returns {string[]}
+ */
+export function findLockfileDrift(repository = process.cwd()) {
+  const root = resolve(repository);
+  if (!existsSync(resolve(root, "node_modules"))) return [];
+  const lockPath = resolve(root, "package-lock.json");
+  if (!existsSync(lockPath)) return [];
+  let lock;
+  try {
+    lock = JSON.parse(readFileSync(lockPath, "utf8"));
+  } catch {
+    return ["package-lock.json is unreadable"];
+  }
+  const packages = lock?.packages;
+  if (!packages || typeof packages !== "object") return [];
+  const drifted = [];
+  for (const [key, entry] of Object.entries(packages)) {
+    if (!key.startsWith("node_modules/")) continue; // the root importer and workspaces
+    if (entry?.link) continue; // a symlinked workspace, not an installed version
+    const name = key.split("node_modules/").pop();
+    const manifest = resolve(root, key, "package.json");
+    if (!existsSync(manifest)) {
+      if (!entry.optional) drifted.push(`${name}@${entry.version} is not installed`);
+      continue;
+    }
+    let installed;
+    try {
+      installed = JSON.parse(readFileSync(manifest, "utf8")).version;
+    } catch {
+      installed = undefined;
+    }
+    if (installed !== entry.version) {
+      drifted.push(`${name}: lock ${entry.version}, installed ${installed ?? "unreadable"}`);
+    }
+  }
+  return drifted;
+}
+
 /**
  * Compute the generated artifact list from the committed suite manifest.
  * The manifest is required; missing or invalid manifests fail closed.
@@ -65,6 +114,16 @@ export function checkGeneratedArtifacts(repository = process.cwd()) {
   const root = resolve(topLevel);
   const artifacts = computeGeneratedArtifacts(root);
 
+  const drifted = findLockfileDrift(root);
+  if (drifted.length > 0) {
+    const shown = drifted.slice(0, 8).map((line) => `  ${line}`).join("\n");
+    throw new Error(
+      `node_modules does not match package-lock.json (${drifted.length} package(s)); `
+      + "the generated bundles embed dependency bytes, so CI — which runs npm ci — will rebuild them differently.\n"
+      + `${shown}${drifted.length > 8 ? "\n  …" : ""}\nRun: npm ci`,
+    );
+  }
+
   const missing = artifacts.filter((path) => !existsSync(resolve(root, path)));
   if (missing.length > 0) {
     throw new Error(`generated artifacts are missing: ${missing.join(", ")}`);