@tekyzinc/gsd-t 5.20.10 → 5.20.11

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [5.20.11] - 2026-09-17
+
+### Fixed — `update-all` treated a downgrade as an upgrade and rolled 34 projects back
+
+Releasing 5.20.10, npm's cached package listing still named 5.19.11 as `@latest` for
+several minutes after publish. `upgradeGlobalBinary()` installed the older release over
+the running one, printed "upgraded: v5.20.10 → v5.19.11", handed off to the OLD binary,
+and that binary rewrote `~/.claude/commands` and every registered project with the
+previous version. It happened twice in one release.
+
+- `bin/gsd-t.js`: numeric `versionCmp`; a downgrade now HALTS (exit 1) before the
+  "upgraded" branch and names the fix (`npm cache clean --force`, wait for the tarball
+  to serve 200, reinstall the current release). Never hands off to an older binary.
+- `commands/cpua.md`: Step 6 polls the tarball URL until it returns 200, cleans the npm
+  cache, installs, and checks `dist-tags.latest` equals the new version BEFORE `update-all`.
+- `test/update-all-downgrade-halt.test.js`: the compare is numeric (5.9 < 5.10) and the
+  downgrade branch exits instead of re-exec'ing.
+
 ## [5.20.10] - 2026-09-17
 
 ### Changed — `/gsd-t-estimate` is the sheet only, and the sheet now has a written spec

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v5.20.10** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v5.20.11** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/bin/gsd-t.js

@@ -3466,6 +3466,20 @@ async function doUpdateAll() {
   );
 }
 
+// Numeric dotted-version compare: negative when a < b, 0 when equal, positive when a > b.
+// GSD-T versions are plain Major.Minor.Patch integers (patch always ≥ 10), so a
+// segment-wise numeric compare is exact; no prerelease tags exist.
+function versionCmp(a, b) {
+  const pa = String(a).split(".").map((n) => parseInt(n, 10));
+  const pb = String(b).split(".").map((n) => parseInt(n, 10));
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const x = Number.isNaN(pa[i]) ? 0 : pa[i];
+    const y = Number.isNaN(pb[i]) ? 0 : pb[i];
+    if (x !== y) return x - y;
+  }
+  return 0;
+}
+
 // Upgrade the globally-installed @tekyzinc/gsd-t to @latest. Returns
 // { upgraded: bool, reexec: bool, error?: string }.
 // - reexec=true when the on-disk version after `npm install -g` is newer than
@@ -3499,6 +3513,19 @@ async function upgradeGlobalBinary() {
     // Best-effort; fall through.
   }
 
+  if (newVersion && versionCmp(newVersion, PKG_VERSION) < 0) {
+    // v5.20.10 (2026-09-17): right after `npm publish`, npm's cached package
+    // listing still named the PREVIOUS version as @latest, so this step
+    // installed 5.19.11 over a running 5.20.10, reported it as an "upgrade",
+    // handed off to the OLD binary, and that binary overwrote ~/.claude/commands
+    // and every project with the old release. A downgrade is never an upgrade —
+    // HALT and say how to fix it, never continue on a stale listing.
+    error(`HALT: npm installed v${newVersion} over the running v${PKG_VERSION} — @latest resolved to an OLDER release.`);
+    info("npm's cached package listing is stale. Run `npm cache clean --force`, wait until");
+    info(`\`curl -sI https://registry.npmjs.org/@tekyzinc/gsd-t/-/gsd-t-${PKG_VERSION}.tgz\` returns 200, then re-run update-all.`);
+    info(`Restore the current release first: npm install -g @tekyzinc/gsd-t@${PKG_VERSION}`);
+    process.exit(1);
+  }
   if (newVersion && newVersion !== PKG_VERSION) {
     success(`Global binary upgraded: v${PKG_VERSION} → v${newVersion}`);
     info("Handing off to the newly-installed binary for propagation...");

package/commands/cpua.md

@@ -120,6 +120,19 @@ G="$(npm root -g)/@tekyzinc/gsd-t"
 #    the pre-publish package listing cached and `@tekyzinc/gsd-t@{NEW}` returns ETARGET
 #    for minutes while `npm view` already shows the version (v5.17.14, 2026-09-03).
 #    The tarball URL bypasses the cached listing and is deterministic.
+# 1b. WAIT until the registry actually SERVES the tarball, then CLEAR npm's cached listing.
+#    v5.20.10 (2026-09-17): `npm publish` printed "+ @tekyzinc/gsd-t@5.20.10" and `npm view`
+#    showed it, but the tarball URL 404'd for ~4 minutes. Worse, npm's cached package
+#    listing still said latest = the PREVIOUS version, so `gsd-t update-all` (which runs
+#    `npm install -g @tekyzinc/gsd-t@latest`) DOWNGRADED the global, handed off to the old
+#    binary, and that binary rewrote ~/.claude/commands and 34 projects with the old release
+#    — twice. Poll the tarball, then clean the cache, then install. Never skip either.
+for i in $(seq 1 60); do
+  [ "$(curl -s -o /dev/null -w '%{http_code}' "https://registry.npmjs.org/@tekyzinc/gsd-t/-/gsd-t-{NEW_VERSION}.tgz")" = "200" ] && break
+  sleep 10
+done
+[ "$(curl -s -o /dev/null -w '%{http_code}' "https://registry.npmjs.org/@tekyzinc/gsd-t/-/gsd-t-{NEW_VERSION}.tgz")" = "200" ] || { echo "HALT: tarball still 404 after 10 min"; exit 1; }
+npm cache clean --force
 npm install -g "https://registry.npmjs.org/@tekyzinc/gsd-t/-/gsd-t-{NEW_VERSION}.tgz"
 # 2. VERIFY ON DISK — never trust npm's exit code for this step. On v5.17.13 `npm install -g`
 #    reported success and left the OLD version in place; `update-all` then ran from the
@@ -140,7 +153,11 @@ fi
 #    file and the command files; only then does update-all see the new release.
 gsd-t install 2>&1 | tail -5
 [ "$(cat ~/.claude/.gsd-t-version)" = "{NEW_VERSION}" ] || { echo "HALT: ~/.claude/.gsd-t-version did not advance"; exit 1; }
-# 4. Propagate, then prove the global is STILL the new version and a NEW file reached a project.
+# 4. Prove `@latest` now resolves to the NEW version (update-all installs `@latest`; a stale
+#    listing here is the downgrade path — since v5.20.11 update-all HALTS on a downgrade
+#    instead of handing off, but do not rely on the halt: check first).
+[ "$(npm view @tekyzinc/gsd-t dist-tags.latest)" = "{NEW_VERSION}" ] || { echo "HALT: registry latest is not {NEW_VERSION}"; exit 1; }
+# 5. Propagate, then prove the global is STILL the new version and a NEW file reached a project.
 gsd-t update-all 2>&1 | tail -30
 [ "$(node -p "require('$G/package.json').version")" = "{NEW_VERSION}" ] || { echo "HALT: global package reverted during update-all"; exit 1; }
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "5.20.10",
+  "version": "5.20.11",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",