@litfamily/litopencode 1.0.10 → 1.0.12

package/dist/activation.d.ts

@@ -26,6 +26,8 @@ export type ChatMessageActivationOptions = {
     readonly onSkillActivation?: (sessionID: string, skillId: string, appendedLit?: boolean) => void | Promise<void>;
     /** Consumes the skill a trusted command activation recorded for this session, if any. */
     readonly trustedInjectedSkill?: (sessionID: string) => string | undefined;
+    /** Restores that skill after the root-turn reset; the command already showed its activation toast. */
+    readonly onTrustedSkillResume?: (sessionID: string, skillId: string) => void | Promise<void>;
     /** Consumes the mark `command.execute.before` left for this session's next message. */
     readonly isCommandTurn?: (sessionID: string) => boolean;
     readonly skillHint?: (sessionID: string, promptText: string) => Promise<JevSkillHintPart | undefined>;

package/dist/activation.js

@@ -100,7 +100,7 @@ export function createChatMessageActivationHook(projectRoot, options = {}) {
         if (!childSession) {
             await options.onRootUserTurn?.(input.sessionID);
             if (trustedInjectedSkill !== undefined) {
-                await options.onSkillActivation?.(input.sessionID, trustedInjectedSkill);
+                await options.onTrustedSkillResume?.(input.sessionID, trustedInjectedSkill);
                 return;
             }
         }

package/dist/jev-skill-hint.d.ts

@@ -22,6 +22,8 @@ export type JevSkillHintOptions = {
     readonly fetch?: JevFetch;
     readonly catalog?: readonly JevCatalogEntry[];
     readonly traceFile?: string;
+    /** Project root: every folder between it and the trace file must be a real folder, never a symlink. */
+    readonly traceRoot?: string;
     readonly now?: () => number;
 };
 export declare function jevSkillHintStatus(env?: NodeJS.ProcessEnv): JevSkillHintStatus;

package/dist/jev-skill-hint.js

@@ -155,6 +155,27 @@ function validatedAnswer(raw, allowed, threshold) {
         return { confidence };
     return { choice, confidence };
 }
+/**
+ * Walks the trace folder below the project root one level at a time, creating a missing folder
+ * without following links. Any symlink or non-folder on the way means no trace.
+ */
+async function realTraceFolder(root, folder) {
+    const relative = path.relative(root, folder);
+    if (relative.startsWith("..") || path.isAbsolute(relative))
+        return false;
+    let current = root;
+    for (const segment of relative.split(path.sep).filter((part) => part !== "")) {
+        current = path.join(current, segment);
+        let stat = await fs.lstat(current).catch(() => undefined);
+        if (stat === undefined) {
+            await fs.mkdir(current).catch(() => undefined);
+            stat = await fs.lstat(current).catch(() => undefined);
+        }
+        if (stat === undefined || stat.isSymbolicLink() || !stat.isDirectory())
+            return false;
+    }
+    return true;
+}
 export function createJevSkillHint(options = {}) {
     const env = options.env ?? process.env;
     const fetchImpl = options.fetch ?? ((url, init) => fetch(url, init));
@@ -163,8 +184,11 @@ export function createJevSkillHint(options = {}) {
     async function trace(record) {
         if (env[`${jevFlag}_TRACE`] !== "1" || options.traceFile === undefined)
             return;
+        const folder = path.dirname(options.traceFile);
+        const root = options.traceRoot ?? path.dirname(folder);
         try {
-            await fs.mkdir(path.dirname(options.traceFile), { recursive: true });
+            if (!(await realTraceFolder(root, folder)))
+                return;
             // Refuse a symlink or other non-file at the trace path; O_NOFOLLOW closes the lstat race.
             const existing = await fs.lstat(options.traceFile).catch(() => undefined);
             if (existing !== undefined && !existing.isFile())
@@ -172,6 +196,9 @@ export function createJevSkillHint(options = {}) {
             const flags = fsConstants.O_WRONLY | fsConstants.O_APPEND | fsConstants.O_CREAT | (fsConstants.O_NOFOLLOW ?? 0);
             const handle = await fs.open(options.traceFile, flags, 0o600);
             try {
+                // A folder swapped for a symlink after the first check still gets no record.
+                if (!(await realTraceFolder(root, folder)))
+                    return;
                 await handle.appendFile(`${JSON.stringify(record)}\n`, "utf8");
             }
             finally {

package/dist/knowledge.js

@@ -340,6 +340,9 @@ async function readRegularFileIfPresent(filePath, paths, options = {}) {
     try {
         await assertParentStable(parent, paths);
         const descriptorStat = await handle.stat();
+        if (descriptorStat.isFile() && descriptorStat.nlink === 0) {
+            throw new KnowledgeFileDisappearedError(`Knowledge file disappeared after descriptor open at ${filePath}.`);
+        }
         if (!descriptorStat.isFile() || !sameFileIdentity(fileIdentityOf(descriptorStat), fileIdentityOf(pathStat))) {
             throw new KnowledgeStoreError(`Unsafe knowledge file replacement at ${filePath}.`);
         }

package/dist/server.js

@@ -54,7 +54,10 @@ export function createLitOpenCodePlugin(autoUpdateRunner = runPluginAutoUpdate)
             ignitionState.activate(sessionID, skillId, !appendedLit);
         };
         const boundedAuthorityEvent = createBoundedAuthorityEventHook(root, input?.client, loaded.config.boundedAuthority);
-        const skillHint = createJevSkillHint({ traceFile: path.join(loaded.paths.logsDir, "jev-skill-hint.jsonl") });
+        const skillHint = createJevSkillHint({
+            traceFile: path.join(loaded.paths.logsDir, "jev-skill-hint.jsonl"),
+            traceRoot: loaded.paths.projectRoot
+        });
         // Keyed by session: the host resolves command parts into a new array before chat.message runs.
         const pendingCommand = new Set();
         const trustedCommandActivations = new Map();
@@ -96,6 +99,9 @@ export function createLitOpenCodePlugin(autoUpdateRunner = runPluginAutoUpdate)
                     const skillId = trustedCommandActivations.get(sessionID);
                     trustedCommandActivations.delete(sessionID);
                     return skillId;
+                },
+                onTrustedSkillResume: (sessionID, skillId) => {
+                    ignitionState.activate(sessionID, skillId);
                 }
             }),
             "command.execute.before": async (commandInput, commandOutput) => {

package/docs/assets/readme/badge-version.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="146" height="20" role="img" aria-label="release: 1.0.10"><title>release: 1.0.10</title><g shape-rendering="crispEdges"><rect width="49" height="20" fill="#080d14"/><rect x="49" width="97" height="20" fill="#ff6337"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><text x="255" y="140" textLength="390" transform="scale(.1)">release</text><text x="965" y="140" textLength="870" transform="scale(.1)" fill="#080D14">1.0.10</text></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="146" height="20" role="img" aria-label="release: 1.0.12"><title>release: 1.0.12</title><g shape-rendering="crispEdges"><rect width="49" height="20" fill="#080d14"/><rect x="49" width="97" height="20" fill="#ff6337"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><text x="255" y="140" textLength="390" transform="scale(.1)">release</text><text x="965" y="140" textLength="870" transform="scale(.1)" fill="#080D14">1.0.12</text></g></svg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litfamily/litopencode",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "LitOpenCode OpenCode plugin bootstrap package.",
   "license": "MIT",
   "repository": {
@@ -28,10 +28,12 @@
     "build": "node tools/run-build.mjs",
     "check:pack-payload": "npm run build && npm pack --dry-run --json --ignore-scripts | node tools/check-pack-payload.mjs --stdin",
     "check:version": "node tools/check-version-lockstep.mjs",
+    "check:npm-readme": "node tools/readme-for-npm.mjs check",
     "check:managed-skill-manifest": "node tools/gen-managed-skill-manifest.mjs --check",
     "gen:managed-skill-manifest": "node tools/gen-managed-skill-manifest.mjs",
     "prepublishOnly": "node tools/prepublish-test-gate.mjs",
-    "prepack": "npm run build",
+    "prepack": "npm run build && node tools/readme-for-npm.mjs apply",
+    "postpack": "node tools/readme-for-npm.mjs restore",
     "pretest": "npm run build",
     "qa:behavior-replacement": "node tools/run-behavior-replacement-probes.mjs",
     "qa:installed-resource-tamper": "node tools/run-installed-resource-tamper-probe.mjs",

package/skills/lit-typographic-motion/package-lock.json

@@ -10,7 +10,7 @@
       "dependencies": {
         "opentype.js": "1.3.4",
         "playwright-core": "1.55.1",
-        "ws": "8.18.3"
+        "ws": "8.22.0"
       }
     },
     "node_modules/opentype.js": {
@@ -54,9 +54,9 @@
       "license": "MIT"
     },
     "node_modules/ws": {
-      "version": "8.18.3",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.3.tgz",
-      "integrity": "sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==",
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
+      "integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package/skills/lit-typographic-motion/package.json

@@ -6,6 +6,6 @@
   "dependencies": {
     "opentype.js": "1.3.4",
     "playwright-core": "1.55.1",
-    "ws": "8.18.3"
+    "ws": "8.22.0"
   }
 }

package/skills/managed-skill-manifest.json

@@ -3273,11 +3273,11 @@
         },
         {
           "path": "package-lock.json",
-          "sha256": "20c343e515fe08f7e4b0cf07a5ba0b91462d0f22b4ff3531448206ac24a475f1"
+          "sha256": "141539ca253c3cf4f81988db6f69aaf78574d0c8ca9e9d7e45f56af8f2e96cac"
         },
         {
           "path": "package.json",
-          "sha256": "e75e13ba0060e99b21e8e8c945710ecf3a65e44f851f3ebde54ab7f562c96400"
+          "sha256": "5962e5607dba2b2d8e08fbf51e982e8517ee26a84c43ac838934e8394f3551cd"
         },
         {
           "path": "probe.mjs",

package/tools/check-pack-payload.mjs

@@ -13,6 +13,9 @@ const FORBIDDEN_PATH_RULES = [
   { label: "repository cover vector", pattern: /^docs\/assets\/cover\.svg$/u },
   { label: "unapproved README presentation asset", pattern: /^docs\/assets\/readme\/(?!(?:ascii-readme|badge-version|badge-license|lucide-book-open|lucide-play|lucide-shield-check)\.svg$|litopencode-wordmark\.svg$|litopencode-clay-icon\.png$|(?:litfamily-machines|poster)\.png$|ignition-film\.mp4$|ignition-readme\.gif$|(?:Lucide-LICENSE|JetBrainsMono-OFL)\.txt$)/u },
   { label: "maintainer release checklist", pattern: /^docs\/release-checklist\.md$/u },
+  { label: "npm README source (packed as README.md / README-Ko-KR.md)", pattern: /^README-npm(?:-Ko-KR)?\.md$/u },
+  { label: "GitHub README backup from the npm README swap", pattern: /^\.readme-npm-backup(?:\/|$)/u },
+  { label: "npm README swap script", pattern: /^tools\/readme-for-npm\.mjs$/u },
   { label: "internal recon/spec document", pattern: /^docs\/(?:recon|spec)(\/|$)/u },
   { label: "implementation plan", pattern: /(^|\/)plans(\/|$)/u },
   { label: ".litcodex runtime state", pattern: /(^|\/)\.litcodex(\/|$)/u },
@@ -70,18 +73,33 @@ const REQUIRED_README_PATHS = [
   "docs/assets/readme/poster.png"
 ];
 
-// Every image the bilingual READMEs load from the package CDN must ship in the tarball.
+// Every image the READMEs show must ship: the npm pages load pinned package-CDN copies, and the
+// GitHub pages load the same files by relative path. Inside a packed artifact the npm sources
+// are absent and README.md / README-Ko-KR.md already hold the npm pages.
 async function readmeImagePaths() {
   const { version } = JSON.parse(await fs.readFile("package.json", "utf8"));
   const prefix = `https://cdn.jsdelivr.net/npm/@litfamily/litopencode@${version}/`;
   const paths = new Set();
-  for (const file of ["README.md", "README-Ko-KR.md"]) {
+  const sources = [];
+  for (const [npmSource, target] of [["README-npm.md", "README.md"], ["README-npm-Ko-KR.md", "README-Ko-KR.md"]]) {
+    sources.push(target);
+    try {
+      await fs.access(npmSource);
+      sources.push(npmSource);
+    } catch {
+      // Packed artifact: the target already is the npm page.
+    }
+  }
+  for (const file of sources) {
     const text = await fs.readFile(file, "utf8");
     const targets = [
       ...[...text.matchAll(/!\[[^\]]*\]\(([^)\s]+)\)/gu)].map((match) => match[1]),
       ...[...text.matchAll(/\b(?:src|srcset)="([^"\s]+)"/gu)].map((match) => match[1])
     ];
-    for (const target of targets) if (target.startsWith(prefix)) paths.add(target.slice(prefix.length));
+    for (const target of targets) {
+      if (target.startsWith(prefix)) paths.add(target.slice(prefix.length));
+      else if (target.startsWith("./")) paths.add(target.slice(2));
+    }
   }
   return [...paths];
 }

package/tools/version-manifests.json

@@ -11,14 +11,26 @@
     {
       "path": "README-Ko-KR.md",
       "kind": "pinned",
-      "occurrences": 102,
-      "why": "The bilingual landing pages pin artwork and package links to the current package version."
+      "occurrences": 2,
+      "why": "The GitHub landing pages load assets by relative path; the release badge alt text and the checkout-version note repeat the package version."
+    },
+    {
+      "path": "README-npm-Ko-KR.md",
+      "kind": "pinned",
+      "occurrences": 18,
+      "why": "The npm package pages pin artwork and package links to the current package version; tools/readme-for-npm.mjs copies them over README.md and README-Ko-KR.md at pack time."
+    },
+    {
+      "path": "README-npm.md",
+      "kind": "pinned",
+      "occurrences": 18,
+      "why": "The npm package pages pin artwork and package links to the current package version; tools/readme-for-npm.mjs copies them over README.md and README-Ko-KR.md at pack time."
     },
     {
       "path": "README.md",
       "kind": "pinned",
-      "occurrences": 101,
-      "why": "The bilingual landing pages pin artwork and package links to the current package version."
+      "occurrences": 2,
+      "why": "The GitHub landing pages load assets by relative path; the release badge alt text and the checkout-version note repeat the package version."
     },
     {
       "path": "docs/assets/readme/badge-version.svg",