@lyupro/codex-bridge 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.1] - 2026-09-07
+
+### Fixed
+
+- `update` names the package it acted from. Standing in a clone while an older copy answers from
+  PATH, the command compared the home against its own files and said `codex-bridge is up to date` —
+  true about the package that ran, silent about the one on screen, and the cause had to be found by
+  hand. Every outcome now carries the name, version and path of the copy that answered, and when
+  that copy is not the checkout the operator is standing in, a second line names both versions and
+  the command that changes which one answers.
+- `permissions add` reports the state of the rule set instead of the size of its own change. A
+  complete set answered `Added 0 permission rule strings.`, where zero reads as a refusal rather
+  than as "all of them are already there".
+
 ## [0.6.0] - 2026-09-07
 
 ### Added

package/README.md

@@ -62,7 +62,7 @@ If a global install and a clone coexist, you have two package copies. `codex-bri
 - **Every run leaves an audit folder.** The verbatim task, scope, before/after git state, events, report, verdict, and reason remain together.
 - **Zero runtime dependencies and zero build steps.** The package is plain `.mjs` on the Node.js standard library.
 
-The current suite contains **961 automated tests: 960 passing and 1 skipped**.
+The current suite contains **963 automated tests: 962 passing and 1 skipped**.
 
 ## Verify
 

package/cli/doctor.mjs

@@ -2,6 +2,7 @@
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
+import { packageSource } from './package-source.mjs';
 import { readInstallRecord, packageInfo } from './manifest.mjs';
 import { recordTarget } from './install-record.mjs';
 import { runsRoot } from '../src/home/lib/runner/runs-root.mjs';
@@ -26,22 +27,6 @@ function bridgeCommandCheck(result) {
     : check('command', 'warn', `codex-bridge does not resolve on PATH (${result.value}); run npm i -g @lyupro/codex-bridge`);
 }
 
-/**
- * Which copy of the package is answering. Plan_19 gives the CLI a second name, and a global install
- * puts a second copy of the package on the machine beside any clone. `update` copies host files
- * from whichever copy launched it, so `codexb update` from PATH silently reverts a host that
- * `npm run dev:install` from the clone had just refreshed — and every line below this one describes
- * the host as seen by THIS copy. An operator comparing two diagnoses has no other way to tell them
- * apart.
- */
-function packageSource() {
-  const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  return {
-    root,
-    kind: root.split(/[\\/]/).includes('node_modules') ? 'installed copy' : 'clone',
-  };
-}
-
 function sourceCheck() {
   const source = packageSource();
   return check('source', 'ok', `${source.root} (${source.kind === 'installed copy' ? 'installed package' : source.kind})`);

package/cli/package-source.mjs

@@ -0,0 +1,59 @@
+/**
+ * Which copy of the package is answering, and whether the operator is standing in another one.
+ *
+ * Plan_19 gives the CLI a second name, and a global install puts a second copy of the package on
+ * the machine beside any clone. Every command copies host files from whichever copy launched it,
+ * so the answer depends on which copy that was — and until 2026-09-07 only `doctor` said so. That
+ * day the operator ran `codex-bridge update --force` from a 0.6.0 clone while PATH still held the
+ * previous release: the command compared the home against its OWN files, found them current, and
+ * answered "codex-bridge is up to date" without naming the package it meant. The fix is not a
+ * second detector — it is this one, shared.
+ */
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readJsonFileSync } from '../src/home/lib/json-file.mjs';
+
+const PACKAGE_NAME = '@lyupro/codex-bridge';
+
+/** The kind of the copy at a known root. A path separator on Windows is a backslash too. */
+export function sourceAt(root) {
+  const resolved = path.resolve(root);
+  return {
+    root: resolved,
+    kind: resolved.split(/[\\/]/).includes('node_modules') ? 'installed copy' : 'clone',
+  };
+}
+
+export function packageSource() {
+  return sourceAt(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'));
+}
+
+function readPackage(file) {
+  try {
+    const value = readJsonFileSync(file);
+    return value?.name === PACKAGE_NAME && typeof value.version === 'string' ? value : null;
+  } catch {
+    // A directory that merely holds an unreadable package.json is not a checkout of this package.
+    return null;
+  }
+}
+
+/**
+ * The checkout the operator is standing in, when that is a different copy than the one running.
+ * Walking up from the working directory is how the case reproduces: the operator was inside the
+ * clone, the command came from PATH, and nothing in the answer connected the two.
+ */
+export function checkoutAt(cwd = process.cwd(), source = packageSource()) {
+  let directory = path.resolve(cwd);
+  for (;;) {
+    const found = readPackage(path.join(directory, 'package.json'));
+    if (found) {
+      return path.resolve(directory) === path.resolve(source.root)
+        ? null
+        : { root: directory, version: found.version, name: found.name };
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) return null;
+    directory = parent;
+  }
+}

package/cli/permissions.mjs

@@ -150,8 +150,8 @@ export async function removePermissionRules(settingsPath, { dryRun = false } = {
   });
 }
 
-function statusOutput(status) {
-  const moved = status.askCount
+function statusOutput(status, action) {
+  const moved = status.askCount && action !== 'add'
     ? `; ${status.askCount} own string(s) in ask, which outranks allow`
     : '';
   return `Permissions: ${status.state} (${status.present}/${status.total} own strings in ${RULE_LIST_NAMES}${moved}).`;
@@ -161,7 +161,7 @@ async function permissionsInRun({ host, action } = {}) {
   if (!host?.settingsPath) throw new TypeError('permissions requires a resolved host');
   if (!action) {
     const status = await inspectPermissions(host.settingsPath);
-    return { exitCode: 0, output: statusOutput(status), ...status };
+    return { exitCode: 0, output: statusOutput(status, action), ...status };
   }
   if (action === 'add') {
     const result = await addPermissionRules(host.settingsPath);
@@ -172,9 +172,13 @@ async function permissionsInRun({ host, action } = {}) {
     const conflict = status.askCount
       ? ` ${status.askCount} own string(s) also sit in ask, which outranks allow; they were left there.`
       : '';
+    // The 2026-09-07, 0.6.0 install incident mistook a zero delta for failure; report the set too.
+    const added = result.added > 0
+      ? `Added ${result.added} permission rule string${result.added === 1 ? '' : 's'}. `
+      : '';
     return {
       exitCode: 0,
-      output: `Added ${result.added} permission rule string${result.added === 1 ? '' : 's'}.${conflict}`,
+      output: `${added}${statusOutput(status, action)}${conflict}`,
       ...result,
       askCount: status.askCount,
     };

package/cli/update.mjs

@@ -1,6 +1,7 @@
 /** Updates a recorded installation without overwriting unapproved host changes. */
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { packageSource, sourceAt, checkoutAt } from './package-source.mjs';
 import { install } from './install.mjs';
 import {
   buildInstallPlan,
@@ -197,6 +198,18 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
   }
 
   const currentPackage = await packageInfo(packageRoot);
+  // The 2026-09-07, 0.6.0 install incident hid which package's files update actually compared.
+  const resolved = packageRoot ? sourceAt(packageRoot) : packageSource();
+  const source = `${currentPackage.name}@${currentPackage.version} from ${resolved.root}`
+    + ` (${resolved.kind === 'installed copy' ? 'installed package' : resolved.kind})`;
+  // Standing in one checkout while another copy answers is how that install went wrong: the reply
+  // was true about the package that ran and silent about the one the operator had on screen.
+  const elsewhere = checkoutAt(env.CODEX_BRIDGE_CWD ?? process.cwd(), resolved);
+  const mismatch = elsewhere && elsewhere.version !== currentPackage.version
+    ? `\nRun from ${currentPackage.version}; the checkout at ${elsewhere.root} is ${elsewhere.version}.`
+      + ' The home was updated from the copy that answered, not from that checkout'
+      + ` (npm i -g ${currentPackage.name}@${elsewhere.version} changes which one that is).`
+    : '';
   const targets = hookTargets(host, env, currentPackage.version);
   const inspectedHooks = await Promise.all(targets.map(async (target) => ({
     target,
@@ -217,10 +230,10 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
       // it on this path costs nothing when there is nothing left to retire.
       await retireLegacyLayout(host);
     }
-    return { exitCode: 0, output: 'codex-bridge is up to date' };
+    return { exitCode: 0, output: `codex-bridge is up to date with ${source}${mismatch}` };
   }
   if (dryRun) {
-    return { exitCode: 0, output: dryRunOutput(states, inspectedHooks, legacy, oldHooks) };
+    return { exitCode: 0, output: `Would update codex-bridge with ${source}.${mismatch}\n${dryRunOutput(states, inspectedHooks, legacy, oldHooks)}` };
   }
 
   for (const state of orphanStates) {
@@ -236,7 +249,7 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
   const installed = await install({ host, force: true, packageRoot, env });
   if (installed.exitCode !== 0) return installed;
   await retireLegacyLayout(host);
-  return { exitCode: 0, output: appliedOutput(states) };
+  return { exitCode: 0, output: `${appliedOutput(states)}\nSource: ${source}${mismatch}` };
 }
 
 export async function update(options = {}) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lyupro/codex-bridge",
-  "version": "0.6.0",
-  "description": "Claude Code-to-Codex delegation with 6 guards, 961 tests, zero runtime dependencies, and zero build steps.",
+  "version": "0.6.1",
+  "description": "Claude Code-to-Codex delegation with 6 guards, 963 tests, zero runtime dependencies, and zero build steps.",
   "keywords": [
     "claude-code",
     "codex",