@smartmemory/compose 0.3.8 → 0.4.1

package/.claude/skills/compose/SKILL.md

@@ -537,7 +537,7 @@ When `/compose` is invoked, always scan first:
 | `refactor` | Phase 7 — when review finds large files |
 | `update-docs` | Phase 9 |
 
-**Note on dependencies:** these skills are referenced by name and must be installed on the user's machine. See `## Dependencies` below for the install contract — `compose setup` only ships compose-owned skills today; external deps are documented but not auto-installed.
+**Note on dependencies:** these skills are referenced by name and must be installed on the user's machine. See `## Dependencies` below for the install contract — `compose setup` ships compose-owned skills and auto-installs the plugins behind missing REQUIRED external deps (COMP-DEPS-AUTOINSTALL); optional deps remain documented hints.
 
 ## Memory
 
@@ -559,11 +559,20 @@ After completing a feature OR bug-fix lifecycle, update project memory:
 | `stratum` | `compose/skills/stratum/` (if present) | Execution substrate |
 | `compose-explorer`, `compose-architect` | agents under `compose/.claude/agents/` | Required by Phases 1, 3, 4 |
 
-### External dependencies (NOT auto-installed)
+### External dependencies
 
 Authoritative list lives in `compose/.compose-deps.json`. Run `compose doctor` to see what's installed locally and `compose doctor --json` for machine-readable output. The manifest is the single source of truth for external dep IDs and per-dep `fallback` behavior — this SKILL.md never duplicates per-dep fallback strings.
 
-The manifest declares 12 external skills/commands across `superpowers:*`, `interface-design:*`, `codex:review`, `refactor`, and `update-docs`. Each entry carries `id`, `required_for`, `install`, `fallback` (or null), and `optional`.
+The manifest declares 12 external skills/commands across `superpowers:*`, `interface-design:*`, `codex:review`, `refactor`, and `update-docs`. Each entry carries `id`, `required_for`, `install`, `fallback` (or null), and `optional`, plus two optional fields used by auto-install: `plugin` (the `<plugin>@<marketplace>` spec passed to `claude plugin install`) and `marketplace_source` (the `owner/repo` registered first when that marketplace is not configured yet).
+
+**Auto-install (COMP-DEPS-AUTOINSTALL).** `compose setup` / `init` / `update` install the plugins behind missing **required** deps before printing the dep report, so the report describes the state you end up in rather than the state you started from. Rules:
+
+- Only deps with a `plugin` spec are installable. Deps whose `install` is prose (`refactor`, `update-docs`) stay hints.
+- **Optional deps are never auto-installed** — the ones we ship live in third-party marketplaces that each need a separate `marketplace add`, a larger consent step than pulling from a marketplace the user already has.
+- Specs are deduped: six `superpowers:*` deps produce one install.
+- On a machine with no marketplaces registered the first install fails; compose registers the declared `marketplace_source` and retries once.
+- Opt out with `--no-install-deps` or `COMPOSE_NO_PLUGIN_INSTALL=1`. Failures print the real stderr and never change the exit code.
+- `compose doctor` stays read-only; it reports, it never installs.
 
 The manifest also has an optional `external_binaries` array for CLI tools (not skills). Today it declares `rtk` ([Rust Token Killer](https://github.com/rtk-ai/rtk), COMP-RTK-INTEROP) — a lossy output compressor compose routes its one LLM-bound `git diff` (the Codex review diff) through when present, degrading byte-identically when absent. `compose doctor` reports binaries alongside skills and surfaces each binary's `recommend` (for rtk: `rtk init -g`, which installs RTK's Claude Code hook so the agent's *own* Bash output is compressed too — the larger token win). Binary entries carry `id`, `detect`, `install`, `recommend` (or null), and `optional`; all are optional and never block the lifecycle.
 

package/.compose-deps.json

@@ -3,84 +3,122 @@
   "external_skills": [
     {
       "id": "superpowers:systematic-debugging",
-      "required_for": ["bug-fix Phase F3", "any unexpected failure"],
+      "required_for": [
+        "bug-fix Phase F3",
+        "any unexpected failure"
+      ],
       "install": "claude plugin install superpowers",
+      "plugin": "superpowers@claude-plugins-official",
+      "marketplace_source": "anthropics/claude-plugins-official",
       "fallback": "general-purpose Agent with debugging prompt",
       "optional": false
     },
     {
       "id": "superpowers:test-driven-development",
-      "required_for": ["bug-fix Phase F2", "build Phase 7 step 1"],
+      "required_for": [
+        "bug-fix Phase F2",
+        "build Phase 7 step 1"
+      ],
       "install": "claude plugin install superpowers",
+      "plugin": "superpowers@claude-plugins-official",
+      "marketplace_source": "anthropics/claude-plugins-official",
       "fallback": "inline TDD instructions in SKILL.md",
       "optional": false
     },
     {
       "id": "superpowers:verification-before-completion",
-      "required_for": ["all phase exits"],
+      "required_for": [
+        "all phase exits"
+      ],
       "install": "claude plugin install superpowers",
+      "plugin": "superpowers@claude-plugins-official",
+      "marketplace_source": "anthropics/claude-plugins-official",
       "fallback": "inline verification checklist in SKILL.md",
       "optional": false
     },
     {
       "id": "superpowers:requesting-code-review",
-      "required_for": ["Phase 7 review fallback"],
+      "required_for": [
+        "Phase 7 review fallback"
+      ],
       "install": "claude plugin install superpowers",
+      "plugin": "superpowers@claude-plugins-official",
+      "marketplace_source": "anthropics/claude-plugins-official",
       "fallback": "general-purpose Agent reviewer with canonical ReviewResult prompt",
       "optional": true
     },
     {
       "id": "superpowers:executing-plans",
-      "required_for": ["Phase 7 sequential execution"],
+      "required_for": [
+        "Phase 7 sequential execution"
+      ],
       "install": "claude plugin install superpowers",
+      "plugin": "superpowers@claude-plugins-official",
+      "marketplace_source": "anthropics/claude-plugins-official",
       "fallback": "inline plan-execution instructions",
       "optional": false
     },
     {
       "id": "superpowers:dispatching-parallel-agents",
-      "required_for": ["Phase 7 parallel execution"],
+      "required_for": [
+        "Phase 7 parallel execution"
+      ],
       "install": "claude plugin install superpowers",
+      "plugin": "superpowers@claude-plugins-official",
+      "marketplace_source": "anthropics/claude-plugins-official",
       "fallback": "sequential execution",
       "optional": true
     },
     {
       "id": "interface-design:init",
-      "required_for": ["Phase 7 — new UI components"],
+      "required_for": [
+        "Phase 7 \u2014 new UI components"
+      ],
       "install": "claude plugin install interface-design",
       "fallback": null,
       "optional": true
     },
     {
       "id": "interface-design:critique",
-      "required_for": ["Phase 7 — UI critique pass"],
+      "required_for": [
+        "Phase 7 \u2014 UI critique pass"
+      ],
       "install": "claude plugin install interface-design",
       "fallback": null,
       "optional": true
     },
     {
       "id": "interface-design:audit",
-      "required_for": ["Phase 7 — UI design-system audit"],
+      "required_for": [
+        "Phase 7 \u2014 UI design-system audit"
+      ],
       "install": "claude plugin install interface-design",
       "fallback": null,
       "optional": true
     },
     {
       "id": "codex:review",
-      "required_for": ["Phase 7 review gate (human-driven)"],
+      "required_for": [
+        "Phase 7 review gate (human-driven)"
+      ],
       "install": "claude plugin install openai-codex",
       "fallback": "mcp__stratum__stratum_agent_run type=codex",
       "optional": true
     },
     {
       "id": "refactor",
-      "required_for": ["Phase 7 large-file split"],
+      "required_for": [
+        "Phase 7 large-file split"
+      ],
       "install": "user-installed skill at ~/.claude/skills/refactor/",
       "fallback": null,
       "optional": true
     },
     {
       "id": "update-docs",
-      "required_for": ["Phase 9 docs sync"],
+      "required_for": [
+        "Phase 9 docs sync"
+      ],
       "install": "user-installed skill at ~/.claude/skills/update-docs/",
       "fallback": "manual TODO surfaced in implementation report",
       "optional": true

package/README.md

@@ -76,7 +76,7 @@ compose plan "a tool that summarizes my team's standups"
 
 ## Quick install
 
-Prerequisites: Node.js 18+ and a [Stratum](https://github.com/smartmemory/stratum) checkout as a sibling directory (the TS engine runs from source; `compose init` detects its MCP entrypoint automatically — the python `stratum-mcp` PyPI package is retired). Codex steps additionally need the OpenAI `codex` CLI. Full prereqs in [docs/install.md](docs/install.md).
+Prerequisites: Node.js 18+. [Stratum](https://github.com/smartmemory/stratum) needs no separate install — `@smartmemory/stratum` is a dependency, and `compose init` registers the installed copy's MCP entrypoint automatically (a sibling `stratum/` checkout is a development convenience, not a requirement; the python `stratum-mcp` PyPI package is retired). Codex steps additionally need the OpenAI `codex` CLI. Full prereqs in [docs/install.md](docs/install.md).
 
 The package is published to npm as `@smartmemory/compose`. Pick one install style:
 
@@ -84,7 +84,7 @@ The package is published to npm as `@smartmemory/compose`. Pick one install styl
 
 ```bash
 npm install -g @smartmemory/compose
-compose setup                # install bundled skills + register the Stratum MCP server (alias: compose sync)
+compose setup                # install bundled skills, auto-install missing required plugins, register the Stratum MCP server (alias: compose sync)
 ```
 
 **Option B — git clone (for development):**
@@ -118,6 +118,11 @@ One command — auto-detects whether compose was installed via npm or git clone:
 compose update
 ```
 
+Versions across the three published packages move together: `@smartmemory/compose-mcp` carries
+compose's exact version, and `@smartmemory/compose` shares a minor with `@smartmemory/stratum`
+(patches move independently). So compose 0.4.x pairs with stratum 0.4.x. See
+[.claude/rules/versioning.md](.claude/rules/versioning.md).
+
 For npm installs, this runs `npm install -g @smartmemory/compose@latest`. For git clones, it runs `git pull --ff-only && npm install`. Either way it then refreshes the global skill and (if invoked from inside a Compose project) re-runs `compose init` to refresh `.mcp.json` and pipeline templates. Use `compose update --force` to bypass the dirty-tree check on git clones.
 
 Check what you're running:

package/bin/compose.js

@@ -90,7 +90,7 @@ function resolveCwdWithWorkspace(args) {
 // --team flag (COMP-TEAMS)
 // ---------------------------------------------------------------------------
 import { parseTeamFlag } from '../lib/team-flag.js';
-import { loadDeps, checkExternalSkills, printDepReport, buildDepReport, checkExternalBinaries, printBinaryReport, buildBinaryReport } from '../lib/deps.js';
+import { loadDeps, checkExternalSkills, printDepReport, buildDepReport, checkExternalBinaries, printBinaryReport, buildBinaryReport, installMissingPlugins, printInstallReport } from '../lib/deps.js';
 import {
   checkLatestVersion,
   checkPackageVersion,
@@ -172,7 +172,7 @@ function detectAgents() {
  *   - PACKAGE_ROOT/.claude/skills/*   (compose skill)
  *   - PACKAGE_ROOT/skills/*           (stratum base skill)
  */
-function syncSkills(agents) {
+function syncSkills(agents, setupFlags = []) {
   // Collect source skills: { name -> sourcePath }
   const sourceSkills = new Map()
   const skillSourceDirs = [
@@ -271,12 +271,28 @@ function syncSkills(agents) {
   // actionable install hints. Soft check: warnings only, exit code unaffected.
   const deps = loadDeps(PACKAGE_ROOT)
   if (deps) {
-    const result = checkExternalSkills(deps)
+    let result = checkExternalSkills(deps)
+    // COMP-DEPS-AUTOINSTALL: close the loop rather than printing a hint and
+    // running degraded. Only required deps with a `plugin` spec are installed.
+    // The report printed below is the POST-install scan, so what the user reads
+    // is the state they actually end up in, never the state we started from.
+    const installReport = installMissingPlugins(result, { enabled: pluginInstallEnabled(setupFlags) })
+    printInstallReport(installReport)
+    if (installReport.installed.length > 0) result = checkExternalSkills(deps)
     printDepReport(result)
     printBinaryReport(checkExternalBinaries(deps))
   }
 }
 
+/**
+ * COMP-DEPS-AUTOINSTALL opt-out. Off for `--no-install-deps` and for
+ * COMPOSE_NO_PLUGIN_INSTALL=1 (CI, sandboxes, anyone who manages plugins by hand).
+ */
+function pluginInstallEnabled(flags = []) {
+  if (process.env.COMPOSE_NO_PLUGIN_INSTALL === '1') return false
+  return !flags.includes('--no-install-deps')
+}
+
 // ---------------------------------------------------------------------------
 // compose doctor — re-run the external dep check
 // ---------------------------------------------------------------------------
@@ -578,7 +594,7 @@ async function runInit(flags, cwdOverride) {
   }
 
   // 9. Sync all compose-owned skills to detected agents
-  syncSkills(agents)
+  syncSkills(agents, flags)
 
   // 10. Summary
   console.log('')
@@ -592,7 +608,7 @@ async function runInit(flags, cwdOverride) {
 // compose setup — user-global skill setup
 // ---------------------------------------------------------------------------
 
-function runSetup() {
+function runSetup(setupFlags = []) {
   // 1. Sync all compose-owned skills to detected agents.
   //    If none detected, fall back to Claude — setup is unconditional
   //    "install global skill" per its help text.
@@ -600,7 +616,7 @@ function runSetup() {
   if (agents.length === 0) {
     agents = [{ name: 'claude', skillDir: join(homedir(), '.claude', 'skills', 'stratum') }]
   }
-  syncSkills(agents)
+  syncSkills(agents, setupFlags)
 
 }
 
@@ -713,7 +729,7 @@ async function runUpdate(flags) {
   // Refresh global skills.
   console.log('')
   console.log('Refreshing global skill installation...')
-  runSetup()
+  runSetup(args)
 
   // If invoked from inside a Compose project, refresh project artifacts too
   if (existsSync(join(cwd, '.compose', 'compose.json'))) {
@@ -828,7 +844,7 @@ if (cmd === 'setup' || cmd === 'sync') {
   // agent skill dirs. The name `sync` better signals
   // the idempotent "reconcile local skills with this install" job (run it after
   // editing skills locally, when there's no new version to `update` to).
-  runSetup()
+  runSetup(args)
   process.exit(0)
 }
 
@@ -882,7 +898,7 @@ if (cmd === 'migrate-anon') {
 if (cmd === 'install') {
   // Backwards-compat: run both init + setup
   await runInit(args)
-  runSetup()
+  runSetup(args)
   process.exit(0)
 }
 

package/lib/deps.js

@@ -45,7 +45,16 @@ export function loadDeps(packageRoot) {
     const installOk = typeof dep?.install === 'string'
     const fallbackOk = dep?.fallback === null || typeof dep?.fallback === 'string'
     const optOk = typeof dep?.optional === 'boolean'
-    if (!(idOk && reqOk && installOk && fallbackOk && optOk)) {
+    // COMP-DEPS-AUTOINSTALL: `plugin` is optional and additive. When present it
+    // is the `<plugin>[@marketplace]` spec passed to `claude plugin install`.
+    // Its absence means "no automated install path" (several deps are prose,
+    // e.g. "user-installed skill at ~/.claude/skills/refactor/"), never an error.
+    const pluginOk = dep?.plugin === undefined || typeof dep?.plugin === 'string'
+    // `marketplace_source` is the `owner/repo` (or URL) used to register the
+    // marketplace when the plugin's marketplace is not configured yet — the
+    // normal state on a brand-new machine.
+    const srcOk = dep?.marketplace_source === undefined || typeof dep?.marketplace_source === 'string'
+    if (!(idOk && reqOk && installOk && fallbackOk && optOk && pluginOk && srcOk)) {
       console.warn(`Warning: skipping invalid dep entry in .compose-deps.json: ${JSON.stringify(dep)}`)
       continue
     }
@@ -93,6 +102,36 @@ export function loadDeps(packageRoot) {
  *   - <home>/.claude/plugins/marketplaces/<m>/.claude/commands/<n>.md           (pattern B')
  *   - <home>/.claude/plugins/cache/<marketplace>/<plugin>/<version>/skills/<s>/SKILL.md  (pattern C)
  */
+/**
+ * Read `~/.claude/plugins/installed_plugins.json` — Claude Code's authoritative
+ * record of which plugins are installed and where their tree lives.
+ *
+ * Returns `[{ plugin, installPath }]`, or `null` when the file is absent or
+ * unreadable, which the caller treats as "fall back to walking the cache".
+ * `null` and `[]` mean different things: `[]` is "nothing is installed".
+ */
+function readInstalledPluginPaths(home) {
+  const path = join(home, '.claude', 'plugins', 'installed_plugins.json')
+  if (!existsSync(path)) return null
+  let parsed
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf-8'))
+  } catch {
+    return null
+  }
+  const plugins = parsed?.plugins
+  if (!plugins || typeof plugins !== 'object') return null
+  const out = []
+  for (const [key, entries] of Object.entries(plugins)) {
+    // Key is "<plugin>@<marketplace>"; the namespace agents use is the plugin half.
+    const plugin = key.split('@')[0]
+    for (const entry of Array.isArray(entries) ? entries : []) {
+      if (typeof entry?.installPath === 'string') out.push({ plugin, installPath: entry.installPath })
+    }
+  }
+  return out
+}
+
 export function checkExternalSkills(deps, home = homedir()) {
   const userSkillsRoot = join(home, '.claude', 'skills')
   const marketplacesRoot = join(home, '.claude', 'plugins', 'marketplaces')
@@ -159,15 +198,34 @@ export function checkExternalSkills(deps, home = homedir()) {
   }
 
   // 3. Cache — pattern C: cache/<marketplace>/<plugin>/<version>/skills/<s>/SKILL.md
-  for (const marketplace of listDirs(cacheRoot)) {
-    for (const plugin of listDirs(join(cacheRoot, marketplace))) {
-      for (const version of listDirs(join(cacheRoot, marketplace, plugin))) {
-        const skillsDir = join(cacheRoot, marketplace, plugin, version, 'skills')
-        for (const s of listDirs(skillsDir)) {
-          if (existsSync(join(skillsDir, s, 'SKILL.md'))) addNs(plugin, s)
+  //
+  // COMP-DEPS-AUTOINSTALL: the cache OUTLIVES an uninstall — `claude plugin
+  // uninstall` drops the plugin from installed_plugins.json but leaves its
+  // cached tree on disk, so walking the cache alone reports an uninstalled
+  // plugin as present. Claude Code will not load it, and auto-install would
+  // never re-install it (nothing looks missing). When installed_plugins.json is
+  // readable it is the authority: only its recorded installPaths count. Older
+  // Claude Code versions have no such file — there, fall back to the cache walk
+  // rather than reporting every plugin missing.
+  const installedPaths = readInstalledPluginPaths(home)
+  if (installedPaths === null) {
+    for (const marketplace of listDirs(cacheRoot)) {
+      for (const plugin of listDirs(join(cacheRoot, marketplace))) {
+        for (const version of listDirs(join(cacheRoot, marketplace, plugin))) {
+          const skillsDir = join(cacheRoot, marketplace, plugin, version, 'skills')
+          for (const s of listDirs(skillsDir)) {
+            if (existsSync(join(skillsDir, s, 'SKILL.md'))) addNs(plugin, s)
+          }
         }
       }
     }
+  } else {
+    for (const { plugin, installPath } of installedPaths) {
+      const skillsDir = join(installPath, 'skills')
+      for (const s of listDirs(skillsDir)) {
+        if (existsSync(join(skillsDir, s, 'SKILL.md'))) addNs(plugin, s)
+      }
+    }
   }
 
   const present = []
@@ -206,6 +264,8 @@ export function buildDepReport(result) {
     id: d.id,
     required_for: d.required_for,
     install: d.install,
+    plugin: d.plugin ?? null,
+    marketplace_source: d.marketplace_source ?? null,
     fallback: d.fallback ?? null,
     optional: d.optional,
   })
@@ -263,6 +323,103 @@ export function buildBinaryReport(result) {
   }
 }
 
+/**
+ * COMP-DEPS-AUTOINSTALL — install the plugins that provide missing REQUIRED deps.
+ *
+ * Only deps carrying a `plugin` spec are installable; everything else stays a
+ * printed hint. Optional deps are never auto-installed: the ones we ship
+ * (interface-design, openai-codex) live in third-party marketplaces that would
+ * each need a `claude plugin marketplace add` first, which is a consent step of
+ * a different size than pulling a plugin from a marketplace the user already has.
+ *
+ * Several deps resolve to the SAME plugin (six superpowers skills, one plugin),
+ * so specs are deduped — six missing deps produce one install.
+ *
+ * Never throws and never blocks: a missing `claude` binary, a non-zero exit or a
+ * timeout all come back as data for the caller to print. `-y` is required
+ * whenever stdin/stdout is not a TTY, so it is always passed.
+ *
+ * @param {object} result - from checkExternalSkills
+ * @param {object} [opts]
+ * @param {(cmd:string,args:string[])=>{status:number|null,stderr?:string,error?:Error}} [opts.spawn]
+ * @param {boolean} [opts.enabled] - false short-circuits to a skip (opt-out flag / env)
+ * @returns {{installed:string[], failed:{spec:string,reason:string}[], skipped:string|null}}
+ */
+export function installMissingPlugins(result, opts = {}) {
+  const none = { installed: [], failed: [], skipped: null }
+  if (opts.enabled === false) return { ...none, skipped: 'disabled' }
+
+  const specs = [...new Set(
+    result.missing.filter(d => !d.optional && typeof d.plugin === 'string' && d.plugin).map(d => d.plugin),
+  )]
+  if (specs.length === 0) return none
+
+  const spawn = opts.spawn ?? ((cmd, args) => {
+    // 120s: installing clones a git repo, which is slow on a cold cache.
+    try {
+      return spawnSync(cmd, args, { encoding: 'utf-8', timeout: 120000, stdio: 'pipe' })
+    } catch (error) {
+      return { status: null, error }
+    }
+  })
+
+  // spec -> marketplace source, for the add-then-retry path below.
+  const sourceFor = new Map()
+  for (const d of result.missing) {
+    if (d.plugin && d.marketplace_source && !sourceFor.has(d.plugin)) {
+      sourceFor.set(d.plugin, d.marketplace_source)
+    }
+  }
+
+  const installed = []
+  const failed = []
+  const install = (spec) => spawn('claude', ['plugin', 'install', spec, '-y', '--scope', 'user'])
+
+  for (const spec of specs) {
+    let res = install(spec)
+
+    // A brand-new machine has no marketplaces registered, so the first install
+    // fails with "not found in marketplace". Register the declared source and
+    // retry exactly once — measured against a clean HOME, where the un-retried
+    // path leaves every required dep missing. Only ever adds the marketplace the
+    // manifest names, never one derived from the failure text.
+    const notFound = /not found in marketplace|marketplace .* not found|unknown marketplace/i
+      .test(`${res?.stderr ?? ''}${res?.stdout ?? ''}`)
+    if (res?.status !== 0 && notFound && sourceFor.has(spec)) {
+      const add = spawn('claude', ['plugin', 'marketplace', 'add', sourceFor.get(spec)])
+      if (add?.status === 0) res = install(spec)
+    }
+
+    if (res?.status === 0) { installed.push(spec); continue }
+    // ENOENT on the `claude` binary is a skip for the whole batch, not a failure
+    // of this spec: there is no install path at all on this machine.
+    if (res?.error?.code === 'ENOENT') {
+      return { installed, failed, skipped: 'the `claude` CLI is not on PATH' }
+    }
+    const reason = (res?.stderr || '').trim()
+      || res?.error?.message
+      || `exit ${res?.status ?? 'unknown'}`
+    failed.push({ spec, reason })
+  }
+  return { installed, failed, skipped: null }
+}
+
+/**
+ * Print what installMissingPlugins did. Returns nothing; the caller re-scans and
+ * prints the authoritative dep report afterwards.
+ */
+export function printInstallReport(report) {
+  if (report.skipped === 'disabled') return
+  if (!report.installed.length && !report.failed.length && !report.skipped) return
+
+  console.log('\nInstalling missing required plugins:')
+  for (const spec of report.installed) console.log(`  + ${spec}`)
+  for (const { spec, reason } of report.failed) {
+    console.log(`  ! ${spec} — install failed: ${reason}`)
+  }
+  if (report.skipped) console.log(`  - skipped: ${report.skipped}`)
+}
+
 /**
  * Print a human-readable external-binary report. Returns true if all required
  * (non-optional) binaries are present. Prints nothing when no binaries are declared.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartmemory/compose",
-  "version": "0.3.8",
+  "version": "0.4.1",
   "description": "Structured AI dev pipeline: your agent writes the code, Compose makes it prove it. Gated design decisions, enforced postconditions, and independent review from goal to shipped code.",
   "author": "SmartMemory",
   "license": "MIT",