@ssheleg/agent-sync 1.18.6 → 1.18.7

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+## v1.18.7 — the evals stop being a claim, and the manifests say what shapes them
+
+Wave-3 close-out of the 2026-08-29 family audit (ASY-03, ASY-09). No behavior
+changes; a measurement that did not exist now does, and two manifests declare
+their schemas.
+
+- **ASY-03 — the behavioral evals were executed, dated, and the numbers are worse
+  than silence pretended.** `test/evals/RESULTS.md` had one row: "no run yet".
+  It now carries two dated rows (2026-08-31, haiku and sonnet): 24 blind
+  fresh-context trigger probes — one per query per model, the query verbatim plus
+  the installed family list, nothing else — and all six scenario lines driven as
+  real agent sessions against scratch repositories, end states verified on disk.
+  Both models score 11/12 on triggers (train 6/6, validation 5/6) and fail the
+  SAME query: **q06, the submodule-finish positive, 0/3 samples on each model** —
+  the description has no submodule vocabulary to catch it. That gap is filed as
+  ASY-10 (a description change is a minor release, not this patch). The Method
+  section states the harness limits out loud: n=1 sampling except the failing
+  query, the operator's routing doctrine present in probe context, fs-backend
+  `reserve` refusing by design in s02, model aliases rather than pinned snapshot
+  ids. SKILL-CARD.md's "never executed" line now points at the dated rows.
+- **ASY-09 — both plugin manifests declare `$schema`.**
+  `.claude-plugin/marketplace.json` names
+  `https://json.schemastore.org/claude-code-marketplace.json` and
+  `plugins/agent-sync/.claude-plugin/plugin.json` names
+  `https://json.schemastore.org/claude-code-plugin-manifest.json`; both files
+  validate against the schemas those addresses serve (fetched and checked at
+  edit time), and `claude plugin validate --strict` stays green on both. The
+  repo's own no-host-address rule refused the plugin manifest — correctly, by
+  its letter — so `json.schemastore.org` joined `ALLOWED_HOSTS` beside
+  `json-schema.org`: a vendor-neutral public schema registry, not an instance
+  address. The planted `leaked host` self-test still proves the check can fail.
+
 ## v1.18.6 — the guard keeps its own header's promise, and /clear gets its own identity
 
 Wave-2 hardening from the 2026-08-29 family audit (ASY-07, ASY-08, ASY-06, ASY-01).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/agent-sync",
-  "version": "1.18.6",
+  "version": "1.18.7",
   "description": "Let concurrent coding agents share one project without colliding — leases with TTL, race-free id reservation, a run journal and a generated board, over a pluggable knowledge cloud.",
   "bin": {
     "agent-sync": "bin/agent-sync.js"

package/plugins/agent-sync/.claude-plugin/plugin.json

@@ -1,7 +1,8 @@
 {
+  "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "agent-sync",
   "displayName": "Agent Sync",
-  "version": "1.18.6",
+  "version": "1.18.7",
   "description": "Coordination layer for multi-agent repositories — leases with TTL, race-free ID reservation, a run journal, a cross-repo signal feed and a generated board, over a pluggable knowledge cloud.",
   "author": {
     "name": "ssheleg",

package/plugins/agent-sync/skills/agent-sync/SKILL.md

@@ -4,7 +4,7 @@ description: "Use when several coding agents work one repository at the same tim
 compatibility: "Requires the task-pipeline skill for its stages (npx sshlg-skills install). Needs python3 3.9+ (stdlib only, HTTP included - nothing to pip install) and bash for the hooks. The knowledge backend is configured per project; with none configured it degrades to git-file leases. Enforcement hooks are Claude Code only - on other agents the same checks run as a self-check."
 license: MIT
 metadata:
-  version: "1.18.6"
+  version: "1.18.7"
   author: ssheleg
 ---
 

package/plugins/agent-sync/skills/agent-sync/scripts/agent_sync.py

@@ -33,7 +33,7 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
-VERSION = "1.18.6"
+VERSION = "1.18.7"
 
 CONFIG_PATH = Path(".claude/agent-sync.json")
 ENV_FILE = Path(".env.agent-sync")