@logicseek/hello-cc 1.1.4 → 1.1.5

package/CHANGELOG.md

@@ -7,6 +7,7 @@ Before publishing, run:
 
 ```bash
 npm run release:check
+npm run release:artifact:check
 npm run release:notes
 npm run release:github:dry-run
 ```
@@ -16,6 +17,27 @@ the release description from the current changelog section. Use
 `npm run release:github` with `GH_TOKEN` or `GITHUB_TOKEN` only for local
 backfills.
 
+## 1.1.5
+
+### Summary
+
+Require a verified immutable package before npm publication or GitHub Release
+creation so a missing release manifest fails before publication.
+
+### Highlights
+
+- Check the versioned frozen manifest, archive digest, packaged files and modes
+  before publishing. Reject a requested version that differs from the package.
+- Include the frozen npm archive and file manifest used by release-mode
+  DeepSeek Harness acceptance; preserve all previously published tags and files.
+- Keep the 1.1.4 runtime behavior, including opted-in App inbox listener recovery.
+
+### Validation
+
+Release preflight tests cover a matching immutable package, missing manifests,
+source drift and version mismatches. DeepSeek Harness 0.2.0-rc.2 and 0.2.1-rc.3
+are checked on Linux and macOS alongside repository, Web and native workflows.
+
 ## 1.1.4
 
 ### Summary

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logicseek/hello-cc",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "Local control plane for coordinating Claude Code, Codex, and other coding CLI sessions.",
   "type": "module",
   "bin": {
@@ -27,6 +27,7 @@
   "scripts": {
     "release:notes": "node ./scripts/release-notes.mjs",
     "release:check": "node ./scripts/release-notes.mjs --check",
+    "release:artifact:check": "node ./scripts/dsh-package-provenance.mjs --check-release",
     "release:github": "node ./scripts/github-release.mjs",
     "release:github:dry-run": "node ./scripts/github-release.mjs --dry-run",
     "smoke": "node ./bin/hcc.mjs --help",
@@ -41,7 +42,7 @@
     "build:native:cwd-handoff": "node ./scripts/build-cwd-handoff.mjs",
     "release:native:verify": "node ./scripts/verify-cwd-handoff-package.mjs",
     "release:native:pack": "node ./scripts/pack-cwd-handoff.mjs",
-    "prepublishOnly": "npm run release:native:verify"
+    "prepublishOnly": "npm run release:check && npm run release:artifact:check && npm run release:native:verify"
   },
   "repository": {
     "type": "git",

package/scripts/dsh-package-provenance.mjs

@@ -2,11 +2,13 @@
 // Harness, calling a model, changing an archive, or publishing a package.
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { DSH_BASELINE_VERSION, DSH_SUPPORTED_VERSIONS } from '../lib/integrations/dsh-versions.mjs';
+import { normalizeVersion } from '../lib/release/release-notes.mjs';
 
 const ARCHIVED_BASELINE = 'docs/verification/dsh-1.0.3-package.json';
 const hash = file => createHash('sha256').update(fs.readFileSync(file)).digest('hex');
@@ -69,7 +71,9 @@ export function freezeAcceptancePackage({ root, repo = fileURLToPath(new URL('..
   const run = (command, args) => execFileSync(command, args, { cwd: repo, env: childEnv, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
   const npm = args => env.npm_execpath
     ? run(process.execPath, [env.npm_execpath, ...args]) : run('npm', args);
-  const metadata = JSON.parse(npm(['pack', '--ignore-scripts', '--json', '--pack-destination', path.join(root, 'candidate')]))[0];
+  // A parent npm publish --dry-run exports npm_config_dry_run. The preflight
+  // still needs real local archive bytes in order to verify the package.
+  const metadata = JSON.parse(npm(['pack', '--ignore-scripts', '--dry-run=false', '--json', '--pack-destination', path.join(root, 'candidate')]))[0];
   if (env.GITHUB_REF?.startsWith('refs/tags/v')) {
     assert.equal(mode, 'release', 'Version tags require immutable release acceptance');
     assert.equal(env.GITHUB_REF.slice('refs/tags/v'.length), metadata.version, 'Version tag must match the package version');
@@ -103,17 +107,40 @@ export function freezeAcceptancePackage({ root, repo = fileURLToPath(new URL('..
   return receipt;
 }
 
+export function checkReleaseArtifact({ repo, env = process.env, version } = {}) {
+  const expectedVersion = version ? normalizeVersion(version) : null;
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-release-artifact-check-'));
+  try {
+    const receipt = freezeAcceptancePackage({ repo, root, mode: 'release',
+      env: { ...env, GITHUB_OUTPUT: '' } });
+    if (expectedVersion) assert.equal(receipt.package.version, expectedVersion,
+      'Requested release must match the checked package version');
+    return receipt;
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
 if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) {
   try {
     const options = new Map();
-    for (let index = 2; index < process.argv.length; index += 2) {
-      const key = process.argv[index], value = process.argv[index + 1];
-      assert.ok(['--mode', '--output-dir'].includes(key) && value && !value.startsWith('--'), `Invalid option: ${key}`);
+    for (let index = 2; index < process.argv.length; index += 1) {
+      const key = process.argv[index];
+      if (key === '--check-release') { options.set(key, true); continue; }
+      const value = process.argv[++index];
+      assert.ok(['--mode', '--output-dir', '--version'].includes(key) && value && !value.startsWith('--'), `Invalid option: ${key}`);
       options.set(key, value);
     }
-    const mode = options.get('--mode') || resolveAcceptanceMode({ eventName: process.env.GITHUB_EVENT_NAME,
-      ref: process.env.GITHUB_REF, dispatchMode: process.env.HCC_DSH_DISPATCH_MODE });
-    console.log(JSON.stringify(freezeAcceptancePackage({ root: options.get('--output-dir') || process.env.HCC_DSH_ACCEPTANCE_ROOT, mode }), null, 2));
+    if (options.get('--check-release')) {
+      assert.ok(!options.has('--mode') && !options.has('--output-dir'),
+        '--check-release uses release mode and its own temporary directory');
+      console.log(JSON.stringify(checkReleaseArtifact({ version: options.get('--version') }), null, 2));
+    } else {
+      assert.ok(!options.has('--version'), '--version requires --check-release');
+      const mode = options.get('--mode') || resolveAcceptanceMode({ eventName: process.env.GITHUB_EVENT_NAME,
+        ref: process.env.GITHUB_REF, dispatchMode: process.env.HCC_DSH_DISPATCH_MODE });
+      console.log(JSON.stringify(freezeAcceptancePackage({ root: options.get('--output-dir') || process.env.HCC_DSH_ACCEPTANCE_ROOT, mode }), null, 2));
+    }
   } catch (error) {
     const details = String(error.stack || error.message || error).replaceAll('%', '%25').replaceAll('\r', '%0D').replaceAll('\n', '%0A');
     console.error(`::error::${details}`); process.exitCode = 1;