@webpresso/agent-kit 0.21.3 → 0.21.4

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Webpresso agent-kit Claude Code plugin: blueprints, skills, hooks, MCP server",
-    "version": "0.21.0"
+    "version": "0.21.4"
   },
   "plugins": [
     {
@@ -23,5 +23,5 @@
       ]
     }
   ],
-  "version": "0.21.0"
+  "version": "0.21.4"
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "webpresso",
-  "version": "0.21.0",
+  "version": "0.21.3",
   "description": "Webpresso agent-kit: blueprints, skills, lore commit protocol, tech-debt lifecycle",
   "skills": "./skills",
   "commands": "./commands",

package/catalog/AGENTS.md.tpl

@@ -166,7 +166,9 @@ All packages in the webpresso public umbrella use **Changesets**. Never push
 To ship a change:
 1. `vp run changeset` — describe the change and select the bump type.
 2. Commit the generated `.changeset/<name>.md` alongside your code.
-3. Merge to `main`. The release workflow versions the package and publishes it
+3. Merge to `main`. The release workflow opens or updates a **Version Packages**
+   PR.
+4. Merge the **Version Packages** PR. The workflow then publishes the package
    to the public npm registry.
 
 ```bash

package/catalog/agent/rules/changeset-release.md

@@ -50,24 +50,20 @@ Steps 2-3 happen on the feature branch alongside the code change. There is
 no manual `vp run changeset version` or `vp run changeset publish` step in the
 normal path — CI owns those for this repository.
 
-## How releases work (CI-driven, direct-publish on push to `main`)
-
-**This repo uses a direct-publish flow — there is no \"Version Packages\" PR.**
+## How releases work (CI-driven Version PR + publish on merge)
 
 When a feature branch with a `.changeset/<slug>.md` file merges to `main`,
 `release.yml` runs the following sequence automatically:
 
-1. `vp run version` — runs `changeset version &&
-   vp run sync-marketplace-version`. This bumps `package.json`, updates
-   `CHANGELOG.md`, removes the consumed `.changeset/<slug>.md` files, and
-   syncs `.claude-plugin/marketplace.json` to match the new version.
-2. `npm publish --provenance --access public` — publishes
-   `@webpresso/agent-kit` to the public npm registry using the workflow-owned
-   publish path.
-3. `git push` — commits the version bump back to `main` only after publish
-   succeeds or the version is already published.
-4. CI creates a `release/v<version>` branch with compiled `dist/` committed
-   for Claude Code marketplace consumers.
+1. `changesets/action` opens or updates a **Version Packages** PR.
+2. The action runs `pnpm run version`, which preserves the canonical version
+   path: `changeset version && vp run sync-marketplace-version`.
+3. When the Version PR is merged, CI runs `pnpm run release:publish`, which
+   calls `npm publish --provenance --access public`.
+4. After publish, CI verifies the `v<version>` tag on the mainline version-bump
+   commit and creates `release/v<version>` as the separate dist-carrying
+   compatibility branch for marketplace consumers.
+5. GitHub Release objects are disabled in the initial rollout.
 
 The workflow supports a manual dry-run trigger:
 ```bash
@@ -102,8 +98,9 @@ git add .changeset/ && git commit -m "chore: add initial changeset"
 ```
 
 **Do NOT run `vp run changeset version` or `vp run changeset publish` manually**
-for established repos — CI owns both steps. Manual execution bypasses the
-`sync-marketplace-version` script and the release branch flow.
+for established repos — CI owns both steps through `changesets/action`. Manual
+execution bypasses the Version PR flow, the release branch contract, and the
+evidence gates.
 
 ## Release workflow (self-contained Changesets)
 

package/dist/esm/blueprint/db/enums.d.ts

@@ -65,8 +65,8 @@ export declare const reviewCadenceSchema: z.ZodEnum<{
     quarterly: "quarterly";
 }>;
 export declare const visibilitySchema: z.ZodEnum<{
-    private: "private";
     public: "public";
+    private: "private";
 }>;
 export declare const taskFileOpSchema: z.ZodEnum<{
     create: "create";

package/dist/esm/secret-gate/runner.js

@@ -5,9 +5,13 @@ const SIGNAL_TO_EXIT_CODE = {
     SIGKILL: 9,
     SIGTERM: 15,
 };
+const DIRECT_ENV_PROFILES = new Set(['none', 'public']);
 export function buildSecretGateCommand(options) {
     const runner = options.runner?.trim() || 'with-secrets';
     const envProfile = options.envProfile?.trim();
+    if (runner === 'with-secrets' && envProfile && DIRECT_ENV_PROFILES.has(envProfile)) {
+        return { command: options.command, args: [...(options.args ?? [])] };
+    }
     const args = envProfile
         ? ['--env-profile', envProfile, '--', options.command, ...(options.args ?? [])]
         : ['--', options.command, ...(options.args ?? [])];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpresso/agent-kit",
-  "version": "0.21.3",
+  "version": "0.21.4",
   "private": false,
   "repository": {
     "type": "git",
@@ -523,6 +523,7 @@
     "generate-skills": "bun src/build/generate-skills-dir.ts",
     "sync-marketplace-version": "bun scripts/sync-marketplace-version.ts",
     "version": "changeset version && vp run sync-marketplace-version",
+    "release:publish": "pnpm run build && npm publish --provenance --access public",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:mutation": "bun stryker run stryker.config.ts",