@multileaf/ai-workflow 0.1.2 → 0.1.3

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project are documented in this file. The format foll
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-09-12
+
+### Fixed
+
+- Invoke AI Workflow through `npx` in the generated `ai-init` instructions so fresh projects do not need a globally installed `aiw` binary.
+
 ## [0.1.2] - 2026-09-12
 
 ### Fixed
@@ -44,7 +50,8 @@ All notable changes to this project are documented in this file. The format foll
 
 - Path confinement, symlink protection, explicit permission gates, secret redaction, strict parsers, atomic migrations, and immutable execution checkpoints.
 
-[Unreleased]: https://github.com/MultiLeaf/aiw/compare/v0.1.2...HEAD
+[Unreleased]: https://github.com/MultiLeaf/aiw/compare/v0.1.3...HEAD
+[0.1.3]: https://github.com/MultiLeaf/aiw/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/MultiLeaf/aiw/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/MultiLeaf/aiw/releases/tag/v0.1.1
 [0.1.0]: https://github.com/MultiLeaf/aiw/releases/tag/v0.1.0

package/dist/adapter.js

@@ -41,9 +41,9 @@ This skill is the bootstrap for AI Workflow. The installer intentionally install
 ## First-run setup
 
 1. Inspect the repository's existing AI instructions and project structure. Preserve user-authored files and do not expose secrets.
-2. Run \`aiw scan\`. Explain the detected facts and their evidence; ask the user to confirm uncertain inferences before they influence generated content.
-3. Run \`aiw recommend\`, then read \`.aiw/recommendations.yml\` and \`.aiw/profile.yml\`. Explain why each suggested skill, rule, agent, hook, or template fits and identify external permissions. Ask which capabilities to install, and ask separately before granting an external permission such as \`network:external\`.
-4. Record the user's choices with \`aiw recommend --select=id,id\`; use \`aiw recommend --select=\` when all recommendations are declined. If at least one capability is selected, run \`aiw sync\`; when the user separately approved external network access, pass \`--allow=network:external\`. Sync installs only selected resources and fills supported project rules with detected stack and quality-tool details. Do not add unselected resources or overwrite existing files.
+2. Run \`npx --yes --package=@multileaf/ai-workflow -- aiw scan\`. Explain the detected facts and their evidence; ask the user to confirm uncertain inferences before they influence generated content.
+3. Run \`npx --yes --package=@multileaf/ai-workflow -- aiw recommend\`, then read \`.aiw/recommendations.yml\` and \`.aiw/profile.yml\`. Explain why each suggested skill, rule, agent, hook, or template fits and identify external permissions. Ask which capabilities to install, and ask separately before granting an external permission such as \`network:external\`.
+4. Record the user's choices with \`npx --yes --package=@multileaf/ai-workflow -- aiw recommend --select=id,id\`; use \`npx --yes --package=@multileaf/ai-workflow -- aiw recommend --select=\` when all recommendations are declined. If at least one capability is selected, run \`npx --yes --package=@multileaf/ai-workflow -- aiw sync\`; when the user separately approved external network access, add \`--allow=network:external\`. Sync installs only selected resources and fills supported project rules with detected stack and quality-tool details. Do not add unselected resources or overwrite existing files.
 5. Review the installed resource list and the generated project-specific files with the user. Ask before changing project policy or tailoring any other skill/rule.
 6. Introduce the selected workflow gates: brainstorming → specification → architecture decision when needed → implementation plan → implementation with tests → verification → traceability → review. Use only gates supported by the resources the user chose.
 
@@ -52,10 +52,10 @@ If the user declines all recommendations, leave the project with only the bootst
 ## For each feature request after setup
 
 - Start with the brainstorming skill when scope, users, constraints, or assumptions are unclear.
-- Create and complete a specification with stable requirement IDs and Given/When/Then acceptance criteria; pass \`aiw gate specification\` before planning.
-- Record consequential architecture choices as ADRs. Create an implementation plan that links tasks to requirements, tests, risks, and validation commands; pass \`aiw gate plan\` before coding.
+- Create and complete a specification with stable requirement IDs and Given/When/Then acceptance criteria; pass \`npx --yes --package=@multileaf/ai-workflow -- aiw gate specification\` before planning.
+- Record consequential architecture choices as ADRs. Create an implementation plan that links tasks to requirements, tests, risks, and validation commands; pass \`npx --yes --package=@multileaf/ai-workflow -- aiw gate plan\` before coding.
 - Follow the TDD policy and project quality rules. Use specialist agents for requirements, architecture, implementation, tests, security, documentation, and review when useful.
-- Run the declared checks, then \`aiw verify\`, \`aiw trace\`, and the review gate. Do not claim completion without evidence.
+- Run the declared checks, then \`npx --yes --package=@multileaf/ai-workflow -- aiw verify\`, \`npx --yes --package=@multileaf/ai-workflow -- aiw trace\`, and the review gate. Do not claim completion without evidence.
 
 ## Language policy
 

package/docs/package-model.md

@@ -26,7 +26,7 @@ package/
 
 Packages may come from local paths, Git repositories, npm-compatible providers, Vercel Skills, or a future Multileaf registry.
 
-The package distributed by AI Workflow is a catalog, not an automatic project install. `aiw install` writes only the target-specific `ai-init` bootstrap and neutral state. `/ai-init` scans the project, recommends matching capabilities, asks which to activate, and `aiw sync` renders only the selected resources. Supported rules and project-quality guidance are personalized from detected project tools; existing or user-edited files are preserved and reported as conflicts.
+The package distributed by AI Workflow is a catalog, not an automatic project install. `aiw install` writes only the target-specific `ai-init` bootstrap and neutral state. `/ai-init` runs CLI commands through `npx --yes --package=@multileaf/ai-workflow -- aiw <command>` because installation does not add a global `aiw` binary or a dependency to the consuming project. It scans the project, recommends matching capabilities, asks which to activate, and syncs only the selected resources. Supported rules and project-quality guidance are personalized from detected project tools; existing or user-edited files are preserved and reported as conflicts.
 
 Local directories and Git repositories are resolved with `aiw resolve --source=<source>`. A local source may be a package directory or its `package.yaml`; relative paths are resolved from the project. Git sources support `git+https`, HTTPS, SSH, and `file://` URLs. Git packages are cloned into an isolated temporary checkout, validated before the lockfile is changed, and removed after resolution. The lockfile records the selected provider and normalized source rather than trusting those fields from the fetched manifest. The legacy `--package=<path>` form remains available for direct manifest resolution.
 

package/docs/product-requirements.md

@@ -23,6 +23,7 @@
 - The user must select which capabilities to install.
 - Selected resources must be customized using confirmed project facts.
 - `/ai-init` must orchestrate scan → recommendations → user selection → selected-resource sync and summarize what it added.
+- The bootstrap must invoke CLI operations through the package runner; it cannot assume `aiw` is installed globally or in the consuming project's dependencies.
 
 ### Development workflow
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multileaf/ai-workflow",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Portable spec-driven development workflow for AI coding agents",
   "license": "MIT",
   "repository": {