@kujolang/paperclip 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -1,18 +1,18 @@
 # Changelog
 
+## 0.1.2 - 2026-09-02
+
+- Publish through npm trusted publishing with short-lived GitHub Actions identity tokens instead of a stored npm token.
+- Verify the published package through a clean public-registry installation before creating the GitHub release.
+
+## 0.1.1 - 2026-09-02
+
+- Work around Paperclip `2026.831.1` reporting host version `0.0.0` to the plugin loader while retaining the documented `2026.824.1` support floor.
+- Complete Windows component fallbacks and cross-platform npm verification.
+
 ## 0.1.0 - 2026-09-02
 
 - Add Review Pack, Failure Evidence, and Context Pack tools and UI actions for Paperclip.
 - Bundle and verify ChangeBucket, PatchBrief, CaseFile, and Scent component snapshots.
 - Enforce company-scoped state, feature policy, stale-context rejection, workspace bounds, hostile Git configuration suppression, and process-tree cleanup.
 - Add cross-platform compatibility, dependency review, CodeQL, SBOM, provenance, signed-tag, and exact-tarball release controls.
-
-## 0.1.0
-
-- Initial Paperclip-native Review Pack, Failure Evidence, and Context Pack.
-- Lifecycle-script-free Kujo runtime resolution and deterministic component bundle.
-- Strict workspace, process, output, redaction, schema, provenance, and stale-state boundaries.
-- Monochrome project badges and install-first ecosystem documentation.
-- Root agent, contribution, security, and version contracts.
-- Reproducible lockfile-based CI and npm release gates.
-- Exact Kujo `1.2.2` runtime dependency with the restored Windows package build.

package/README.md

@@ -1,6 +1,6 @@
 # Kujo for Paperclip
 
-[![Version](https://img.shields.io/badge/version-0.1.0-black)](https://github.com/kujolang/paperclip/releases/tag/v0.1.0)
+[![Version](https://img.shields.io/badge/version-0.1.2-black)](https://github.com/kujolang/paperclip/releases/tag/v0.1.2)
 [![License](https://img.shields.io/badge/license-MIT-lightgrey)](LICENSE)
 [![built with Kujo](https://img.shields.io/badge/built%20with-Kujo-white.svg)](https://github.com/kujolang/kujo)
 

package/VERSION

@@ -1 +1 @@
-0.1.0
+0.1.2

package/dist/manifest.js

@@ -14527,8 +14527,8 @@ var DEFAULT_LIMITS = {
   maxInputLogBytes: 2e5,
   maxContextFileBytes: 2e3
 };
-var PLUGIN_VERSION = "0.1.0";
-var MINIMUM_HOST_VERSION = "2026.824.1";
+var PLUGIN_VERSION = "0.1.2";
+var MINIMUM_HOST_VERSION = "0.0.0";
 
 // src/config/schema.ts
 var pluginConfigSchema = external_exports.object({

package/dist/worker.js

@@ -28926,7 +28926,7 @@ var CONTEXT_BUDGETS = {
   focused: 16e3,
   broad: 4e4
 };
-var PLUGIN_VERSION = "0.1.0";
+var PLUGIN_VERSION = "0.1.2";
 var PAPERCLIP_API_VERSION = 1;
 
 // src/config/schema.ts
@@ -29440,7 +29440,7 @@ async function runComponent(input) {
     executable: runtime.executable,
     cwd: input.cwd,
     args: invocation,
-    timeoutMs: input.config.limits.timeoutMs,
+    timeoutMs: Math.min(input.timeoutMs ?? input.config.limits.timeoutMs, input.config.limits.timeoutMs),
     maxStdoutBytes: input.config.limits.maxStdoutBytes,
     maxStderrBytes: input.config.limits.maxStderrBytes
   });
@@ -29610,7 +29610,7 @@ async function prepareContextWorkspace(cwd, task) {
       timeout: 1e4,
       windowsHide: true
     });
-    return { path: mirror, cleanup: async () => await removeTree(mirror) };
+    return { path: mirror, selectedPaths: paths, cleanup: async () => await removeTree(mirror) };
   } catch (error51) {
     await removeTree(mirror);
     throw error51;
@@ -30070,14 +30070,33 @@ async function generateContextPack(input) {
     if (process.platform !== "win32") {
       for (const exclusion of EXCLUSIONS) args.push("--exclude", exclusion);
     }
-    const result = await runComponent({
-      component: "context",
-      cwd: workspace.path,
-      args,
-      config: input.config,
-      acceptExitCodes: process.platform === "win32" ? [0, 1] : [0]
-    });
-    const output = JSON.parse(await readFile4(join5(temp, "context.json"), "utf8"));
+    let result;
+    let output;
+    try {
+      result = await runComponent({
+        component: "context",
+        cwd: workspace.path,
+        args,
+        config: input.config,
+        acceptExitCodes: process.platform === "win32" ? [0, 1] : [0],
+        timeoutMs: 8e3
+      });
+      output = JSON.parse(await readFile4(join5(temp, "context.json"), "utf8"));
+    } catch (error51) {
+      if (!(error51 instanceof KujoPluginError) || error51.code !== "KUJO_EXEC_TIMEOUT") throw error51;
+      const selected = workspace.selectedPaths.slice(0, MAX_FILES2[input.depth]);
+      output = {
+        selected_files: selected.map((path2, index) => ({
+          path: path2,
+          reason: "Selected by Paperclip's bounded task-path fallback",
+          score: Math.max(1, selected.length - index)
+        })),
+        estimated_tokens: selected.length * Math.ceil(DEFAULT_LIMITS.maxContextFileBytes / 4),
+        excluded: workspace.selectedPaths.slice(selected.length),
+        truncated: workspace.selectedPaths.length >= selected.length,
+        warnings: ["Canonical context selection exceeded its bounded execution window"]
+      };
+    }
     const files = (output.selected_files ?? []).flatMap((file2) => {
       if (typeof file2.path !== "string") return [];
       return [{
@@ -30089,7 +30108,7 @@ async function generateContextPack(input) {
     });
     const estimatedTokens = typeof output.estimated_tokens === "number" ? Math.max(0, Math.trunc(output.estimated_tokens)) : 0;
     const truncated = output.truncated === true || estimatedTokens > budget || files.length >= MAX_FILES2[input.depth];
-    const cacheKey = createHash3("sha256").update(`${input.workspaceId}\0${snapshot.fingerprint}\0${task.toLowerCase()}\0${input.depth}\0${result.componentVersion}`).digest("hex");
+    const cacheKey = createHash3("sha256").update(`${input.workspaceId}\0${snapshot.fingerprint}\0${task.toLowerCase()}\0${input.depth}\0${result?.componentVersion ?? PLUGIN_VERSION}`).digest("hex");
     return contextPackSchema.parse({
       schemaVersion: 1,
       id: `context_${randomUUID3()}`,
@@ -30110,10 +30129,10 @@ async function generateContextPack(input) {
       cacheKey,
       provenance: {
         pluginVersion: PLUGIN_VERSION,
-        kujoRuntimeVersion: result.runtimeVersion,
-        componentId: result.component,
-        componentVersion: result.componentVersion,
-        componentCommit: result.componentCommit
+        kujoRuntimeVersion: result?.runtimeVersion ?? "bounded-fallback",
+        componentId: result?.component ?? "paperclip-context-fallback",
+        componentVersion: result?.componentVersion ?? PLUGIN_VERSION,
+        componentCommit: result?.componentCommit ?? "bundled"
       }
     });
   } finally {

package/docs/COMPATIBILITY.md

@@ -13,6 +13,7 @@ The plugin supports macOS arm64/x64, Linux arm64/x64, and Windows x64. CI runs t
 ## Change rules
 
 - Patch releases keep the same artifact schemas and minimum host train.
+- Paperclip `2026.831.1` reports `0.0.0` to its plugin loader. The manifest gate is neutralized for that host defect; install documentation and the tested SDK matrix remain authoritative for the supported host floor.
 - Before 1.0, a minor release may add fields or raise a minimum version. The changelog must call out either change.
 - Readers accept additive fields but reject unknown schema versions.
 - Context content requires the same company, project, workspace, and Git snapshot that produced the pack.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kujolang/paperclip",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Make Paperclip agent work easier to scope, review, reproduce, and verify.",
   "license": "MIT",
   "homepage": "https://github.com/kujolang/paperclip#readme",