@techgoblin/gobstack 0.5.0-beta.3 → 0.5.0-beta.4

package/bin/goblin-init

@@ -636,8 +636,8 @@ fi
 CONFIG="$TARGET/.goblin/goblin.yaml"
 [ -f "$CONFIG" ] || { g_err "install wrote no .goblin/goblin.yaml at $TARGET"; exit 1; }
 if [ "$DRYRUN" -eq 0 ]; then
-  sed -i "s|^branch:.*|branch: $BRANCH|" "$CONFIG" || { g_err "cannot write the declared branch into $CONFIG"; exit 1; }
-  sed -i "s|^owner_email:.*|owner_email: $EMAIL|" "$CONFIG" || { g_err "cannot write the owner email into $CONFIG"; exit 1; }
+  g_sed_i "s|^branch:.*|branch: $BRANCH|" "$CONFIG" || { g_err "cannot write the declared branch into $CONFIG"; exit 1; }
+  g_sed_i "s|^owner_email:.*|owner_email: $EMAIL|" "$CONFIG" || { g_err "cannot write the owner email into $CONFIG"; exit 1; }
   TMP_CFG=$(mktemp) || { g_err "mktemp failed"; exit 2; }
   GATE_SUB=$(mktemp) || { g_err "mktemp failed"; exit 2; }
   # print the gate body once, read it as data: an & or / inside the command must not

package/bin/goblin-install

@@ -241,7 +241,7 @@ if [ "$RE_PIN" -eq 1 ]; then
   fi
   # One line, in place. Every other line of the config - comments included - is untouched, so
   # the `owned` contract holds for everything except the single value just asked for.
-  sed -i "s|^practice_sha256:.*|practice_sha256: $NEW_SHA|" "$CONFIG" \
+  g_sed_i "s|^practice_sha256:.*|practice_sha256: $NEW_SHA|" "$CONFIG" \
     || { g_err "could not rewrite the pin in $CONFIG"; exit 1; }
   # Fail closed: never report a re-pin that did not land. The failure this command exists to
   # remove is a hash nobody verified (measured at bf7e9c9: sed -i could not write to a read-only
@@ -793,7 +793,7 @@ if [ "$DRY_RUN" -eq 0 ]; then
         cur=$(g_yaml_scalar "$CONFIG" disabled)
         cur=${cur#[}; cur=${cur%]}
         new=$(printf '%s,%s' "$cur" "$p" | tr ',' '\n' | grep -v '^$' | sort -u | paste -sd, -)
-        sed -i "s|^disabled:.*|disabled: [$new]|" "$CONFIG"
+        g_sed_i "s|^disabled:.*|disabled: [$new]|" "$CONFIG"
       fi
     done
     g_info "recorded opt-out: $OPT_OUT"

package/bin/goblin-lib.sh

@@ -274,6 +274,21 @@ g_installed_scalar_options() {
   ' "$1"
 }
 
+# g_sed_i <sed-script> <file...> — in-place sed that works on BOTH sed families.
+# GNU sed takes -i with an optional suffix attached; BSD sed (macOS) REQUIRES an argument
+# after -i (the backup suffix), so a bare `sed -i 's|…|…|' file` makes BSD read the script
+# as the suffix and the file as the program — the client's `sed: 1: "...": command a
+# expects \ followed by text` (Mac, 2026-10-06). The empty-suffix form `-i ''` is a syntax
+# error on GNU, hence the branch. Callers: g_sed_i 's|a|b|' file
+g_sed_i() {
+  local script="$1"; shift
+  if sed --version >/dev/null 2>&1; then
+    sed -i "$script" "$@"
+  else
+    sed -i '' "$script" "$@"
+  fi
+}
+
 # ------------------------------------------------------------- self-test -----
 # Proves the parser actually parses. Every assertion is a real comparison against a
 # value written to a temp file in this function — blank the awk in g_yaml_scalar and

package/bin/goblin-upgrade

@@ -36,6 +36,14 @@ usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 
 g_err() { printf 'error: %s\n' "$*" >&2; }
 
+# g_sed_i <sed-script> <file...> — in-place sed on BOTH sed families (goblin-lib's
+# helper; duplicated here because this command is deliberately self-contained and
+# does not source goblin-lib.sh — the BSD sed bomb, client Mac 2026-10-06).
+g_sed_i() {
+  local script="$1"; shift
+  if sed --version >/dev/null 2>&1; then sed -i "$script" "$@"; else sed -i '' "$script" "$@"; fi
+}
+
 # g_expand_tilde <path> — ~ and ~/... to $HOME (the goblin-install:81 idiom).
 g_expand_tilde() {
   case "$1" in
@@ -403,7 +411,7 @@ else
     g_err "upgrade: $CONFIG has neither an active nor a commented engine_dir: line - not a 0.4.4 template; aborting"
     exit 2
   fi
-  sed -i "s|^# engine_dir:.*|$(active_engine_line | sed 's/[&|]/\\&/g')|" "$CONFIG"
+  g_sed_i "s|^# engine_dir:.*|$(active_engine_line | sed 's/[&|]/\\&/g')|" "$CONFIG"
 fi
 
 # ---- installed.json: engine block + drop exactly the 18 engine entries ----
@@ -476,7 +484,7 @@ if [ -f "$WF" ] && grep -q 'run: bash .goblin/bin/goblin-verify' "$WF"; then
   # a files-RECORDED artifact, so this rewrite re-hashes its record entry here,
   # in the same commit (IN-02 hashes every recorded file; a rewritten artifact
   # with a stale recorded hash would fail verify #2 — measured this session).
-  sed -i "s|run: bash .goblin/bin/goblin-verify|run: npx @techgoblin/gobstack@$CLI_VERSION run goblin-verify|" "$WF"
+  g_sed_i "s|run: bash .goblin/bin/goblin-verify|run: npx @techgoblin/gobstack@$CLI_VERSION run goblin-verify|" "$WF"
   WF_NEW=$(sha256 "$WF")
   python3 "$PYJ/rehash_record.py" "$INSTALLED" ".github/workflows/goblin-gate.yml" "$WF_NEW" || {
     g_err "upgrade: re-hashing the rewritten workflow in $INSTALLED failed - the tree is uncommitted; fix: git checkout ."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techgoblin/gobstack",
-  "version": "0.5.0-beta.3",
+  "version": "0.5.0-beta.4",
   "description": "Agent-discipline toolkit: one verify command, an enforcement matrix, and LIMITS. bash engine, npm shim.",
   "bin": {
     "goblin": "bin/goblin.js",