@neurodock/cli 0.4.3 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,133 @@
 # @neurodock/cli changelog
 
+## 0.6.1
+
+### Fixed — `npm install` was broken for every fresh user (workspace: protocol leaked)
+
+`@neurodock/cli@0.6.0` was published with `npm publish`, which does NOT
+rewrite pnpm's `workspace:` protocol into a real semver range. The
+resulting tarball's `package.json` carried:
+
+```json
+"@neurodock/native-host": "workspace:^0.1.0"
+```
+
+…which npm/yarn cannot resolve, so the very first `npx --yes
+@neurodock/cli@latest <anything>` failed with `EUNSUPPORTEDPROTOCOL`
+on every fresh machine. The CLI was effectively unpublishable for the
+~14 hours between 0.6.0 hitting npm and this patch.
+
+**The fix:** 0.6.1 is published via `pnpm publish`, which rewrites
+the `workspace:` prefix to the real version pinned in the workspace
+(`^0.1.0`). Verified locally by `pnpm pack` + inspecting the
+extracted `package.json`.
+
+**Belt-and-braces:** a new release-gate script,
+[`scripts/verify-published-tarball.mjs`](../../scripts/verify-published-tarball.mjs),
+fetches the freshly-published tarball from the registry, runs
+`npx --yes @neurodock/cli@<version> --version` against it from a
+scratch directory, and exits non-zero if resolution fails. Wire this
+into the publish pipeline so the next instance of this bug class
+fails the release instead of poisoning `@latest`.
+
+0.6.0 has been deprecated on the registry with a pointer to 0.6.1.
+
+No code changes vs 0.6.0. Same surface, same behaviour, just an
+installable tarball.
+
+## 0.6.0
+
+### Added — `neurodock install-hooks` (proactive guardrails Phases 1 + 3)
+
+One command wires NeuroDock's proactive-guardrail layer into a fresh
+install. Bundled self-contained Python scripts ship with the npm
+package — no extra `pip install` step.
+
+```sh
+neurodock install-hooks --self-test
+neurodock install-hooks --install-daemon --self-test
+neurodock install-hooks --uninstall
+neurodock install-hooks --dry-run
+```
+
+The command:
+
+1. Copies `proactive_guardrail.py` to `~/.neurodock/hooks/` (Phase 1
+   Claude Code hook; auto-fires chronometric / rumination /
+   sycophancy checks on every Nth tool use, banners on stderr).
+2. Copies `neurodock_daemon.py` to the same dir (Phase 3 host-agnostic
+   poller; same heuristics, native OS notifications).
+3. Idempotently merges 4 entries into `~/.claude/settings.json`
+   (`SessionStart`, `PreToolUse`, `PostToolUse`, `Stop`), preserving
+   any existing hooks from other tools.
+4. With `--install-daemon`, registers the daemon at user-login
+   autostart: HKCU Run on Windows, LaunchAgent on macOS, systemd
+   `--user` unit on Linux.
+5. With `--self-test`, runs both scripts' built-in smoke test to
+   verify Python is on PATH and the heuristics fire.
+
+**Opt-out:**
+
+```sh
+neurodock install-hooks --uninstall        # removes hook + daemon entries
+export NEURODOCK_GUARDRAILS=off            # disables without removing
+```
+
+### Fixed — Windows path-escape lockout (regression-pinned)
+
+Pre-0.6.0 the hook command written into `settings.json` used
+backslashes on Windows. Bash-style shells (Git Bash / MinGW — what
+Claude Code uses for hooks on Windows) interpret `\U`, `\h`, `\p`
+etc. as escape sequences and strip them, mangling the path to
+`pythonscript.py` and causing every PreToolUse hook to fail, which
+**blocks every tool call** until the user manually edits
+`settings.json`. The 0.0.22 install command hit this. Twice.
+
+0.6.0 always normalises the script path to forward slashes (Python
+accepts them on Windows) and always wraps it in double quotes. The
+new install summary also echoes the exact hook command string so the
+bug class can't recur silently.
+
+Regression test: `packages/cli/tests/install-hooks.test.ts` pins the
+contract — the test fails if any hook entry contains a backslash in
+its script-path portion.
+
+### Internals
+
+- New build step `scripts/copy-assets.mjs` copies `src/assets/` into
+  `dist/assets/` after `tsc`, so the published npm tarball contains
+  the bundled Python scripts.
+- `package.json` `files` array already includes `dist/`, so no
+  manifest change needed.
+
+## 0.5.0
+
+### Changed (breaking)
+
+- `neurodock update` now upgrades NeuroDock to the latest version
+  (re-installs the six MCP servers via `pip install --upgrade` or
+  `uv tool install` and re-wires clients). Previously, `update` only
+  re-shaped client config JSON without touching package versions —
+  which confused users who expected `update` to behave like every
+  other CLI's `update` verb.
+- The previous behavior moved to a new verb: `neurodock sync`. Same
+  flags (`--client`, `--dry-run`), same code path, same semantics.
+- The new `update` command accepts the same flags as `install-all`
+  (`--client`, `--profile`, `--installer`, `--skip-install`, `--yes`,
+  `--dry-run`, `--no-native-host`).
+
+### Added
+
+- README now has a dedicated `## Update` section documenting the
+  one-liner: `npx --yes @neurodock/cli update`.
+
+### Migration
+
+If you scripted against `neurodock update --client X --dry-run` to
+reconcile client configs, rename the call to `neurodock sync` — the
+old flags still work there. If you wanted package upgrades, the new
+`neurodock update` is what you were looking for.
+
 ## 0.4.3
 
 ### Changed

package/README.md

@@ -2,16 +2,16 @@
 
 The `neurodock` installer and diagnostic CLI for [NeuroDock](https://neurodock.org/) — a local-first cognitive substrate for neurodivergent professionals.
 
-Status: **v0.4.3**.
+Status: **v0.6.0**.
 
 ## Quickstart
 
 ```bash
 # From a published package:
-npx --yes @neurodock/cli install-all
+npx --yes @neurodock/cli@latest install-all
 
 # Or step-by-step, also from npm:
-npx --yes @neurodock/cli init
+npx --yes @neurodock/cli@latest init
 
 # From a fresh clone of the monorepo:
 pnpm install
@@ -38,7 +38,8 @@ install, `install-all` runs the `pip install` step automatically.
 | `neurodock init`             | Install MCP servers into Claude Desktop / Claude Code / Cursor (the wiring half of `install-all`).                         |
 | `neurodock doctor`           | Diagnose your install — profile validity, client wiring, tool availability.                                                |
 | `neurodock validate`         | Schema-validate a profile file (`~/.neurodock/profile.yaml` by default).                                                   |
-| `neurodock update`           | Re-run install adapters; rewrite stale NeuroDock MCP entries in client configs. Non-NeuroDock entries are preserved.       |
+| `neurodock update`           | Upgrade NeuroDock to the latest version — re-installs the six MCP servers via pip/uv and re-wires client configs.          |
+| `neurodock sync`             | Re-shape stale NeuroDock MCP entries in existing client configs. No package upgrade. Non-NeuroDock entries are preserved.  |
 | `neurodock uninstall`        | Reverse `init` — remove NeuroDock MCP entries from each client config. Optionally purge `~/.neurodock/`.                   |
 | `neurodock examples`         | Print a copy-pasteable prompt cheat-sheet that exercises every wired NeuroDock MCP tool.                                   |
 | `neurodock host install`     | Register the optional Chrome Native Messaging host so the browser extension can read `~/.neurodock/profile.yaml` directly. |
@@ -51,6 +52,7 @@ install, `install-all` runs the `pip install` step automatically.
 | `neurodock plugin enable`    | Activate an installed plugin (writes a `.enabled` marker file).                                                            |
 | `neurodock plugin disable`   | Deactivate an installed plugin without deleting its files.                                                                 |
 | `neurodock plugin validate`  | Schema-validate a plugin manifest without installing.                                                                      |
+| `neurodock install-hooks`    | Wire the proactive-guardrail hook into Claude Code, optionally autostart the Phase 3 daemon. See `--self-test`, `--install-daemon`, `--uninstall`, `--dry-run`. |
 
 ### `neurodock install-all`
 
@@ -92,21 +94,47 @@ What `init` does, in order:
 Idempotent. Re-running with no changes is a no-op. Collisions on a previous
 key are skipped unless `--yes` is supplied.
 
-### `neurodock validate` / `update` / `uninstall`
+### `neurodock update`
+
+```
+neurodock update [--client=claude-desktop|claude-code|cursor|all] \
+                 [--profile=minimal|example] \
+                 [--installer=uv|pip|auto] \
+                 [--skip-install] [--yes] [--dry-run] [--no-native-host]
+```
+
+One-command upgrade. Same code path as `install-all` — re-runs
+`pip install --upgrade` (or `uv tool install`) for every NeuroDock MCP
+server, re-wires the detected MCP clients, and re-registers the
+optional native-messaging host. Exit codes match `install-all`:
+`0` ok, `1` an entrypoint is missing from PATH, `2` init failed.
+
+### `neurodock sync`
+
+```
+neurodock sync [--client <id>] [--dry-run]
+```
+
+Re-shape stale NeuroDock MCP entries in existing client configs
+(version drift, command/args/cwd changes) without upgrading any
+packages. Non-NeuroDock entries round-trip untouched. Useful when the
+desired wiring shape changed but you don't need a package upgrade.
+
+Before 0.5.0 this lived under `neurodock update`. The verb moved
+because users typed `neurodock update` expecting a version upgrade.
+
+### `neurodock validate` / `uninstall`
 
 ```
 neurodock validate [--file <path>] [--strict]
-neurodock update [--client <id>] [--dry-run]
 neurodock uninstall [--client <id>] [--yes] [--purge] [--dry-run]
 ```
 
 `validate` runs Ajv against `profile.schema.json` and reports field-path
-violations. `update` rewrites stale NeuroDock MCP entries (version drift,
-command/args/cwd changes); non-NeuroDock entries round-trip untouched.
-`uninstall` removes NeuroDock entries from every detected client config;
-asks (interactively) whether to delete `~/.neurodock/profile.yaml` and
-`~/.neurodock/cognitive-graph.sqlite` (default: no). `--purge` deletes
-those without prompting.
+violations. `uninstall` removes NeuroDock entries from every detected
+client config; asks (interactively) whether to delete
+`~/.neurodock/profile.yaml` and `~/.neurodock/cognitive-graph.sqlite`
+(default: no). `--purge` deletes those without prompting.
 
 ### `neurodock examples`