@semacode/cli 2.3.1 → 3.5.0

package/docs/rollback.md

@@ -1,7 +1,7 @@
 # Rollback Boundary
 
-Public rollback covers both the npm CLI and the separately installed Codex
-bootstrap skill.
+Public rollback covers the npm CLI, managed launcher, bundled global skill, and
+the optional Codex plugin channel.
 
 For a failed pre-publication candidate:
 
@@ -11,16 +11,23 @@ For a failed pre-publication candidate:
 3. Re-run `npm run release:preparar-publica`.
 
 If a bad commit was already pushed, revert it with a normal Git revert and push
-the corrective commit. Refresh the marketplace and reinstall the skill:
+the corrective commit. Install the corrected npm version and resynchronize its
+managed distribution:
 
 ```bash
-codex plugin marketplace upgrade sema
-codex plugin remove sema@sema
-codex plugin add sema@sema
+npm install -g @semacode/cli@<corrected-version>
+sema skill sync --json
 ```
 
-Open a new Codex task before validating the reinstalled skill. Already-open
-tasks keep the plugin/skill catalog they started with.
+The same sequence may install an explicitly selected previous version. The
+installed npm version is authoritative: `sema skill sync --json` aligns the
+runtime, managed launcher, and bundled skill to the version that is actually
+installed. This is synchronization, not a promise to block an intentional
+downgrade.
+
+If the optional plugin channel was also affected, upgrade or reinstall it after
+the corrected commit is public. Open a new task before validating the repaired
+skill; already-open tasks keep the catalog they started with.
 
 If a bad npm version was published, do not overwrite it. Publish a corrected
 version and direct users to that version. Verify the final registry/GitHub state

package/docs/security.md

@@ -7,9 +7,31 @@ Local Sema execution does not need a credential, login, activation key, license
 token, billing token, or control-panel session. Do not introduce one as a
 condition for reading or governing a local workspace.
 
-The official Codex bootstrap skill contains instructions only. It must not
-bundle an MCP server, app connector, remote workspace bridge, credential flow,
-or a second copy of the repository governance that belongs in `AGENTS.md`.
+The official bootstrap skill contains instructions only. The global npm
+postinstall may atomically update the managed launcher under `~/.sema/bin`, the
+canonical copy under `~/.agents/skills/sema`, and a Claude mirror under
+`~/.claude/skills/sema` when Claude is already detected. It must not scan the
+home recursively, overwrite an unowned destination, follow symlinks or
+junctions, write into a plugin cache, bundle an MCP server, add a credential
+flow, or duplicate the repository governance that belongs in `AGENTS.md`.
+
+Status output exposes symbolic paths such as `$HOME/.sema/bin/sema`,
+`$HOME/.sema/bin/sema.ps1`, `$HOME/.sema/bin/sema.cmd`, and
+`$HOME/.sema/bin/sema-managed.ps1`, never the real home, Node.js executable, or
+package path. On Windows, PowerShell resolves `sema.ps1` from `PATH`, `cmd.exe`
+resolves `sema.cmd`, and the fallback runs `sema-managed.ps1` through
+`%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe`. A managed receipt
+detects isolated corruption of the launchers and companion; it is integrity
+recovery, not authentication against a hostile process running as the same
+user. Private absolute paths are not published in JSON or logs.
+
+The public-package factory rejects pre-existing symlinks, junctions, and
+reparse points in source, stage, and output chains and revalidates filesystem
+identity around each path-based operation. This is fail-closed hardening, not a
+native sandbox: Node.js does not expose cross-platform `openat`/`linkat`-style
+operations anchored to directory handles, so a hostile process running as the
+same operating-system user can still race a parent-path swap. Do not present
+the private package stage as a security boundary against that attacker.
 
 Do not publish: