@warnyin/sdlc 0.14.1 → 0.14.2

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.14.2 (2026-09-19)
+
+- **Fix (init)**: `init` no longer disowns the tools it did not install that run. It rebuilt the
+  ownership manifest from scratch and wrote it wholesale, so running `init` a second time for a
+  different tool dropped every entry belonging to the first — the files stayed on disk, but
+  `update` could no longer recognise them. The damage showed up later: such a file was **never
+  refreshed again** (refresh needs the recorded hash to match what is on disk) and was reported
+  as `kept (user-modified)`, blaming you for an edit you never made. `init` now carries forward
+  every entry it does not rewrite. It still never prunes — only `update --tool <list>` removes
+  a tool, and now that a tool installed by its own `init` run is properly owned, deselecting it
+  there prunes its files as it always should have.
+- **If a project already hit this**, the fix cannot recover a hash nothing recorded. A disowned
+  file that still matches the current payload is re-claimed silently on your next `update`; one
+  that has already drifted stays frozen and keeps reporting `kept (user-modified)`. To recover
+  it, delete that file and run `update` — it is rewritten from the payload and owned again.
+
 ## 0.14.1 (2026-09-19)
 
 - **Fix (init)**: adding a tool to a project that already has `sdlc/` no longer loses it on the

package/bin/cli.mjs

@@ -373,7 +373,16 @@ export async function cmdInit(projectRoot, args) {
   };
   scaffoldSdlc(projectRoot, tools, ctx);
   installToolAdapters(projectRoot, tools, ctx);
-  writeManifestFile(projectRoot, ctx.manifest);
+  // Carry forward every entry this run did not rewrite. `init` installs only the tools it was
+  // given, so writing `ctx.manifest` alone would disown the files of every OTHER tool already
+  // installed here — they stay on disk, but `update` then sees files it has no record of,
+  // refuses to refresh them (its refresh branch needs disk hash === recorded hash), freezes
+  // them at their old payload version and reports them as user-modified. Same failure
+  // `installFile` documents fixing per-file, reached instead by never visiting the entry.
+  // The merge happens HERE, not by seeding `ctx.manifest`: that Map is also what the install
+  // summary counts, and it must keep describing only what this run installed. `cmdUpdate`
+  // deliberately does NOT do this — its wholesale replace is what tells prune a tool is gone.
+  writeManifestFile(projectRoot, new Map([...ctx.oldManifest, ...ctx.manifest]));
   ensureGitignore(projectRoot);
   for (const w of ctx.warnings) console.warn(`  ${style.yellow(symbols.warn)} ${w}`);
   printInitSummary(tools, ctx, style, symbols, { configExisted, toolsAdded });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warnyin/sdlc",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "Spec-driven, AI-driven SDLC framework — token-lean specs, contract-first changes, autonomous pipeline with managed hooks. Operationalizes the Day-1 'New SDLC with Vibe Coding' work process.",
   "type": "module",
   "bin": {