ai-consultants 2.23.0 → 2.24.0

package/CLAUDE.md

@@ -6,7 +6,7 @@ AI Consultants is a multi-model AI deliberation system that queries up to 11 AI
 
 **Self-Exclusion**: The invoking agent is automatically excluded from the panel to prevent self-consultation. Claude Code won't query Claude, Codex CLI won't query Codex, etc.
 
-**Version**: 2.23.0
+**Version**: 2.24.0
 
 ## Distribution
 
@@ -719,15 +719,21 @@ Manual lint of the full repo: `npm run lint`. Bypass the hook: `git commit --no-
 
 Every version bump **must** include a release note in `docs/releases/v<VERSION>.md`. Use the template below.
 
+**The whole flow is automated by the maintainer's `ai-consultants-release` skill — run `/ai-consultants-release <VERSION>` from anywhere inside this checkout.** It orchestrates the steps below and refuses to proceed when a surface is missing.
+
+That skill deliberately lives **outside this repository**, at `~/.claude/skills/ai-consultants-release/`, and is not distributed. `scripts/install.sh` git-clones this entire repo into `~/.claude/skills/ai-consultants`, so anything under a `.claude/skills/` directory here reaches every `curl | bash` user — and release tooling that pushes tags and deploys the showcase site must not. The skill's own `references/surfaces.md` is the authoritative map of every release surface; this section is the summary.
+
+Consequence worth knowing: the skill's `finalize.sh` re-verifies the same version surfaces `scripts/release.sh` owns, and the two now live in different places with nothing making them drift together. `finalize.sh` compares its arity against that script's `SURFACES` array on every run and aborts if they disagree — so **adding or removing a surface in `scripts/release.sh` will correctly fail the next release until the skill is updated to match.** That is the tradeoff for not shipping release tooling to users.
+
 ### Steps
 
-1. **Update version** in all files: `package.json`, `scripts/config.sh` (`AI_CONSULTANTS_VERSION`), `SKILL.md` (frontmatter + title), `README.md` (title + badge), `CLAUDE.md` (`**Version**`), `docs/cost_rates.json`, `docs/COST_RATES.md` (title)
-2. **Add `## Changelog` entry** in CLAUDE.md (developer-facing, long-form, rationale + line-level commentary)
-3. **Add `CHANGELOG.md` entry** at the top of `CHANGELOG.md` (Keep a Changelog format: `## [VERSION] - YYYY-MM-DD` with `### Added/Changed/Fixed/Removed/Deprecated/Security` subsections — user-facing, one-line bullets)
-4. **Create `docs/releases/v<VERSION>.md`** using the template below (highlights + upgrade guide — for GitHub releases / users)
-5. **Update workspace sync surfaces** if applicable: `aiconsultants.sh/index.html` (`softwareVersion` schema + badge), `../CLAUDE.md` workspace guide ("Latest at time of last sync" + Recent release line)
-6. **Run tests**: `npm test` must pass before committing
-7. **Commit, push**, and optionally create a GitHub release pointing to the release note
+1. **Preflight**: `~/.claude/skills/ai-consultants-release/scripts/preflight.sh <VERSION>` — read-only gate on both repos (branch, cleanliness, origin sync, forward semver, free tag, tooling)
+2. **Bump the version**: `scripts/release.sh <VERSION>` — rewrites 9 anchored surfaces across 7 files (`package.json`, `scripts/config.sh`, `SKILL.md` ×2, `README.md` ×2, `CLAUDE.md`, `docs/cost_rates.json`, `docs/COST_RATES.md`), validates them, and runs `npm test` + `npm run lint`. Never commits, tags, or publishes.
+3. **Write the three changelogs** (hand-written — see "Why three changelog surfaces?" below): `CHANGELOG.md` entry at the top, `## Changelog` entry in this file, and `docs/releases/v<VERSION>.md`
+4. **Update workspace sync surfaces**: `../CLAUDE.md` workspace guide ("Latest at time of last sync" + Recent release line)
+5. **Finalize**: `~/.claude/skills/ai-consultants-release/scripts/finalize.sh <VERSION> --message-file … --tag-message-file …` — re-verifies all 9 version surfaces *and* the 3 doc surfaces, re-runs the gate, then commits, creates the annotated tag, and pushes both
+6. **Publishing is automatic**: pushing the `v*` tag triggers `.github/workflows/publish.yml`, which re-runs the gate, verifies the tag matches `package.json`, publishes to npm via **Trusted Publishing (OIDC — no `NPM_TOKEN`)** with provenance, and creates the GitHub release from the release note. Both terminal steps are idempotent, so a failed run can be re-run after a fix — **never move or delete a pushed tag**, and never `npm publish` from a workstation.
+7. **Sync the showcase site last**: `~/.claude/skills/ai-consultants-release/scripts/sync_site.sh <VERSION> --message-file …` waits for npm to actually serve the version, bumps `index.html` (`softwareVersion` schema + badge), then commits and pushes. Editorial copy (roster, feature cards, presets table, install commands) is hand-edited before running it. The wait enforces the npx timing rule: a subcommand advertised as `npx ai-consultants <cmd>` before publication does not error — `bin/` routes an unknown argument to `consult_all.sh`, starting a real **billable** consultation.
 
 **Why three changelog surfaces?** They serve different audiences:
 - `CLAUDE.md ## Changelog` — what the *next maintainer* needs (file/line references, rationale, latent bugs uncovered)
@@ -795,6 +801,17 @@ curl -fsSL https://raw.githubusercontent.com/matteoscurati/ai-consultants/main/s
 
 ## Changelog
 
+### v2.24.0
+- **Stale slash commands are finally removed on install/update, on both entry points.** `scripts/install.sh` and `bin/ai-consultants install` only ever `cp`'d `.claude/commands/*.md` into `~/.claude/commands`, never pruning — so a command deleted from the repo lived on the user's machine indefinitely. Measured on a real installation: **14 `ai-consultants:*.md` installed, 4 of which this repo still ships.** The other ten were dropped by `9ae73e3` (v2.10.0, "command consolidation") and had been dead for 13 releases. Not inert — they stay invocable, and `config-features.md` tells the user to set `ENABLE_REFLECTION`, removed in v2.23.0 and now rejected by `configure --set` with a non-zero exit. New `prune_removed_commands()` in `install.sh` plus an inline equivalent in `bin/ai-consultants`; both scoped to the `ai-consultants:*.md` namespace. **Known and accepted bound**: within that namespace it also removes a user-authored command, because nothing distinguishes it from one of ours deleted upstream. Documented in `CHANGELOG.md` rather than worked around.
+- **`bin/ai-consultants install` was initially missed** — the first cut of the fix landed only in `install.sh`, leaving npx users (the path the shipped `bin` help and `docs/releases/v2.19.2.md` advertise) with exactly the stale commands the fix targeted. Caught by the `/code-review max` pass, not by tests.
+- **`install.sh` gained a define-only source guard, and its first placement was destructive.** The guard (`AI_CONSULTANTS_INSTALL_DEFINE_ONLY`) exists so `test_install.sh` can source the file for its helpers without the installer running. It was placed at line 240 — *below* the argument parser (line 145) and *below* the uninstall block (line 179). A sourced script inherits the **caller's** positional parameters, so `bash scripts/test_install.sh --uninstall` had `install.sh` parse the suite's own flag and execute the real uninstall: `rm -rf` on the installed skill plus every `~/.claude/commands/ai-consultants*.md`. Reproduced in a sandboxed `HOME` with a canary file before fixing, and re-verified after. The guard and `prune_removed_commands()` now sit above the parser, with the invariant stated inline: nothing above the guard may act, and anything below it must be safe to skip. Milder instance of the same root cause: `./scripts/test_install.sh --verbose` exited 1 printing `install.sh`'s help.
+- **`scripts/release.sh` dropped from the npm tarball** (`package.json` `files` gains `!scripts/release.sh`). It is the last maintainer-only artifact in the package now that `.claude/skills/` is gone; `bin/ai-consultants` does not route it, so `npx ai-consultants release` reaches the consult fallback, not the script. **Deliberately kept** after checking their consumers: `roster_audit.sh` (backs the shipped `roster-audit` slash command and `doctor --roster-audit`), `roster_calibrate.sh` / `taste_elo.sh` / `run_calibration.sh` (documented for users in the shipped `docs/SMART_ROUTING.md`), `install-hooks.sh` (wired to a `package.json` script, and `CHANGELOG.md` records it as safe for tarball consumption).
+- **Release tooling moved out of the repository entirely** (`6a4e70d`, `95d2e29`, `384a1cd`). `scripts/install.sh` git-clones the whole repo into `~/.claude/skills/ai-consultants`, making `.claude/skills/` a distribution channel — confirmed on a real install, which carried both `release` and `verify`. Shipping tooling that pushes tags and deploys the showcase site to end users is both useless and dangerous, so the release and verify skills now live in the maintainer's `~/.claude/skills/`, and this repo has **no** `.claude/skills/` directory. Keep it that way; if a future skill must be in-tree, prune it in `install.sh` after the clone. New `.github/workflows/publish.yml` publishes to npm via **Trusted Publishing (OIDC, no `NPM_TOKEN`)** on a `v*` tag push and creates the GitHub release from `docs/releases/v<VERSION>.md`; it re-runs the full gate because `ci.yml` only covers branches and PRs, and verifies all nine version surfaces server-side (checking only `package.json` would let a hand-bumped tag publish a package whose `config.sh`/`SKILL.md`/`README.md` still report the previous version — unfixable, since npm forbids republishing).
+- **Two test-harness weaknesses fixed, both found by breaking them on purpose.** `lib/test_helpers.sh::test_summary` now fails a suite that ran zero assertions: `run_test` takes `"<name>" <function>`, and given the function alone the name absorbs it, `shift` empties the list, `"$@"` expands to nothing — no test runs and the suite exits 0. That is the v2.23.0 `test_functions.sh` fix one level up (that one scored a test by its last assertion; this one scored a suite that had none). The guard only covers suites calling `test_summary`, so `test_routing_parity.sh` got the same check inline, and `test_set_e_safety.sh` — a static lint with no assertion counter — now asserts its scan corpus is non-empty, since a lint that scans nothing reports "zero occurrences" and passes forever.
+- **`test_configure.sh`'s parameter-contract scan correctly flagged the new test hook.** It walks every `${VAR:-}` in non-test scripts and demands each be a declared config parameter; `AI_CONSULTANTS_INSTALL_DEFINE_ONLY` joins the existing internal hooks (`SKIP_GATE`, `ROOT`, `FORCE`) in its exclusion list. The test did its job on a change it had no knowledge of.
+- **New `scripts/test_install.sh`** (12 assertions, `npm test` now 21 suites): prunes what upstream dropped, keeps what it ships, ignores other tools' commands and lookalike filenames, no-ops on a fresh install (glob matches nothing) and on an absent commands directory, and asserts the define-only guard is still present so a refactor that drops it fails loudly rather than making `npm test` clone.
+- **Cosmetic, found while sweeping for dead code**: three SKIP lines in `test_context_optimization.sh` used plain `echo` with `${C_YELLOW}`, which under bash prints a literal `\033[33m` instead of colour (zsh's builtin `echo` interprets escapes, which masked it during the first check). Now `echo -e`. `C_YELLOW` itself is **not** dead despite shellcheck SC2034 — that suite sources `test_helpers.sh` and uses it; shellcheck analyses one file at a time, which is why its message says "or export if used externally".
+
 ### v2.23.0
 - **`lib/reflection.sh` deleted (452 lines) and `ENABLE_REFLECTION` / `REFLECTION_CYCLES` removed.** The module was never sourced — `grep -rn 'reflection\.sh' scripts/` matched only the file's own header — so the generate-critique-refine loop had never executed. The two flags were declared at `config.sh` and exported by four presets (`high-stakes`, `max_quality`, `fast`, `_disable_all_consultants`) with no consumer anywhere. It had also aged past the codebase: `_exec_consultant` hardcoded a Gemini/Codex/Mistral case (3 of 11 consultants; the rest hit `*) return 1`) and its Gemini branch still used the pre-`agy` CLI syntax retired in v2.15.0 — so wiring it up as written would have produced partial reflection with a broken Gemini path. Removed rather than implemented because v2.16's `converge`/`adversarial` shapes already run critique-refine off measured consensus rather than a fixed cycle count. Worth noting for archaeology: the module was *maintained* in at least three review passes (v2.15.1 de-fencing, the `--model` parity change, the v2.10.9 `((var++))` sweep) — effort spent on code that never ran.
 - **The release gate had been red since 2.22.0 and nobody could see it.** `scripts/release.sh:26` sources `lib/common.sh` → `config.sh` → `load_user_config` *before* `npm test` at line 194, so `_apply_env_file`'s `export "$key=$value"` put the maintainer's entire `~/.config/ai-consultants/.env` into the test environment. Two suites were not hermetic against that, and the first aborted the run before the second could surface:

package/README.md

@@ -1,8 +1,8 @@
-# AI Consultants v2.23.0
+# AI Consultants v2.24.0
 
 > **A harness for every question.** A panel of up to 11 frontier models that writes its own playbook per question — fan out, debate to convergence, cross-examine under adversarial review, or run a tournament — and checks its work before it reaches you.
 
-[![Version](https://img.shields.io/badge/version-2.23.0-blue.svg)](https://github.com/matteoscurati/ai-consultants)
+[![Version](https://img.shields.io/badge/version-2.24.0-blue.svg)](https://github.com/matteoscurati/ai-consultants)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Claude Code Skill](https://img.shields.io/badge/Claude%20Code-Skill-orange.svg)](https://docs.anthropic.com/en/docs/claude-code/skills)
 [![GitHub stars](https://img.shields.io/github/stars/matteoscurati/ai-consultants?style=social)](https://github.com/matteoscurati/ai-consultants)

package/SKILL.md

@@ -5,10 +5,10 @@ license: MIT
 compatibility: Requires bash, jq, and at least 2 AI CLI tools (agy, codex, vibe, etc.). macOS and Linux.
 metadata:
   author: matteoscurati
-  version: 2.23.0
+  version: 2.24.0
 ---
 
-# AI Consultants v2.23.0 - AI Expert Panel
+# AI Consultants v2.24.0 - AI Expert Panel
 
 **A harness for every question.** Convene a panel of AI "consultants" for coding questions — and let the engine pick *how* they deliberate: a quick read, a convergence loop, an adversarial refutation gate, a tournament, or an exhaustive sweep. Each consultant has a **configurable persona** that shapes its analysis.
 

package/bin/ai-consultants

@@ -185,6 +185,25 @@ EOF
       exit 1
     fi
     mkdir -p "$COMMANDS_DST"
+
+    # Prune commands this project no longer ships, before copying the current
+    # set in. Copying alone leaves a removed command installed forever: the
+    # v2.10.0 consolidation dropped ten, and config-features among them still
+    # tells users to set ENABLE_REFLECTION, which v2.23.0 removed and
+    # `configure --set` now rejects. scripts/install.sh does the same for the
+    # curl | bash path — both entry points must prune or npx users keep them.
+    pruned=0
+    for f in "$COMMANDS_DST"/ai-consultants:*.md; do
+      [ -e "$f" ] || continue
+      if [ ! -f "$COMMANDS_SRC/$(basename "$f")" ]; then
+        rm -f "$f"
+        pruned=$((pruned + 1))
+      fi
+    done
+    if [ "$pruned" -gt 0 ]; then
+      echo "Pruned $pruned slash command(s) removed in a previous release"
+    fi
+
     copied=0
     for f in "$COMMANDS_SRC"/ai-consultants:*.md; do
       [ -f "$f" ] || continue

package/docs/COST_RATES.md

@@ -1,4 +1,4 @@
-# Cost Rates - AI Consultants v2.23.0
+# Cost Rates - AI Consultants v2.24.0
 
 This page documents the per-token rates used by the cost tracking system.
 

package/docs/cost_rates.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.23.0",
+  "version": "2.24.0",
   "updated": "2026-07-16",
   "models": {
     "_comment_units": "All rates are USD per 1,000 tokens (per-1K). lib/costs.sh computes cost as (token_count / 1000) * rate, so every value here MUST be a per-1K rate = (provider $/1M price) / 1000. Do NOT paste $/MTok figures directly.",

package/docs/releases/v2.24.0.md

@@ -0,0 +1,88 @@
+# Release v2.24.0
+
+**Date:** 2026-07-20
+**Type:** Minor — installing now removes slash commands that were deleted in earlier releases
+**Previous:** v2.23.0
+
+## Highlights
+
+- Installing or updating now **removes** `ai-consultants:*.md` slash commands this project no longer ships. Previously they were only ever copied in, so a command deleted upstream stayed on your machine forever.
+- Ten such commands have been dead since v2.10.0 and are still installed on every setup predating it. One of them, `ai-consultants:config-features`, tells you to set `ENABLE_REFLECTION` — removed in v2.23.0, and now rejected by `configure --set`.
+- **Read the breaking-change note below if you wrote your own commands under the `ai-consultants:` prefix.**
+- Both entry points are fixed: `curl | bash` (`scripts/install.sh`) and npx (`ai-consultants install`).
+- `scripts/release.sh` is no longer shipped in the npm package.
+
+## What's New
+
+### Stale slash commands are pruned on install and update
+
+Both installers used to `cp` the current commands into `~/.claude/commands` and nothing else. Nothing ever removed one that had been deleted from the project, so obsolete commands accumulated and stayed invocable.
+
+Measured on a real installation: **14 `ai-consultants:*.md` files present, 4 of which this project still ships.** The other ten were removed by the v2.10.0 command consolidation, thirteen releases ago:
+
+```
+ask-experts       config-check      config-preset     config-strategy
+config-api        config-features   config-status     config-wizard
+config-budget     config-personas
+```
+
+They are not merely clutter. `config-features` instructs you to set `ENABLE_REFLECTION`, a setting v2.23.0 removed; `ai-consultants configure --set ENABLE_REFLECTION=...` now exits non-zero. Following that command's instructions fails.
+
+Both paths now prune before copying and report what they removed:
+
+```
+Pruned 10 slash command(s) removed in a previous release
+Installed 4 slash commands to /Users/you/.claude/commands
+```
+
+### `scripts/release.sh` removed from the npm package
+
+Maintainer-only version-bump automation. `bin/ai-consultants` does not route it, so it was never reachable from the CLI — `npx ai-consultants release` starts a consultation, it does not run the script.
+
+Other scripts that look maintainer-only are **deliberately kept**, having checked what depends on them: `roster_audit.sh` backs the shipped `roster-audit` slash command and `doctor --roster-audit`; `roster_calibrate.sh`, `taste_elo.sh` and `run_calibration.sh` are documented for your own use in `docs/SMART_ROUTING.md`; `install-hooks.sh` is wired to a `package.json` script.
+
+## Breaking Changes
+
+**The prune removes any `ai-consultants:*.md` this project does not ship — including a command you wrote yourself under that prefix.**
+
+There is no way to distinguish a command you authored in this namespace from one of ours that was deleted upstream: both are simply files we do not ship. The `ai-consultants:` prefix is this project's namespace, and the prune treats it as such.
+
+If you have custom commands there, **rename them out of the prefix before upgrading**:
+
+```bash
+mv ~/.claude/commands/ai-consultants:mine.md ~/.claude/commands/my-consultants:mine.md
+```
+
+Commands belonging to other tools are never considered — only the `ai-consultants:` prefix is examined.
+
+## Upgrade Guide
+
+```bash
+# npx (no install)
+npx ai-consultants "question"
+
+# refresh the slash commands (this is what prunes)
+npx ai-consultants install
+
+# git clone install
+cd ~/.claude/skills/ai-consultants && git pull
+
+# curl | bash install
+curl -fsSL https://raw.githubusercontent.com/matteoscurati/ai-consultants/main/scripts/install.sh | bash
+```
+
+No configuration changes required.
+
+Note for `git pull` users: pulling updates the checkout but does **not** re-run the installer, so it does not prune. Run `scripts/install.sh` or `ai-consultants install` afterwards to refresh the installed commands.
+
+## Commits
+
+- `315afb6` fix: harden the release and install tooling after a max code review
+- `48892e4` fix(install): prune slash commands removed in earlier releases
+- `384a1cd` chore: move the verify skill out of the distributed repo
+- `95d2e29` chore(release): move the release skill out of the distributed repo
+- `6a4e70d` chore(release): automate the release and publish pipeline
+
+## Contributors
+
+- Matteo Scurati

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-consultants",
-  "version": "2.23.0",
+  "version": "2.24.0",
   "description": "A harness for every question - a panel of up to 11 AI models that picks its own deliberation strategy per question (convergence, adversarial verification, tournament) and checks its work before answering",
   "bin": {
     "ai-consultants": "bin/ai-consultants"
@@ -11,6 +11,7 @@
     "!scripts/test_*.sh",
     "!scripts/test_fixtures/",
     "!scripts/lib/test_helpers.sh",
+    "!scripts/release.sh",
     "templates/",
     ".env.example",
     ".claude/commands/",

package/scripts/config.sh

@@ -861,4 +861,4 @@ EOF
 # VERSION
 # =============================================================================
 
-AI_CONSULTANTS_VERSION="2.23.0"
+AI_CONSULTANTS_VERSION="2.24.0"

package/scripts/install.sh

@@ -138,6 +138,51 @@ check_dependencies() {
     return 0
 }
 
+# Remove installed slash commands that this project no longer ships.
+#
+# The install step only copies files in, so a command deleted from the repo
+# would live in the user's commands directory forever. v2.10.0's command
+# consolidation dropped ten of them, and every install predating it still
+# carries all ten — including config-features, which instructs users to set
+# ENABLE_REFLECTION, a setting v2.23.0 removed and `configure --set` now
+# rejects with a non-zero exit.
+#
+# Scoped to this project's own "ai-consultants:*.md" namespace, so another
+# tool's commands are never considered. Within that namespace it removes
+# anything this repo does not ship — including a command the user authored
+# under the same prefix. That is the intended bound: the prefix is this
+# project's namespace, and there is no way to tell a user's file there from
+# one of ours that was deleted upstream.
+# Sets PRUNED_COUNT rather than echoing, so log output can't be mistaken for it.
+prune_removed_commands() {
+    local commands_dir="$1" repo_commands_dir="$2" installed
+    PRUNED_COUNT=0
+
+    [[ -d "$commands_dir" ]] || return 0
+
+    for installed in "$commands_dir"/ai-consultants:*.md; do
+        [[ -e "$installed" ]] || continue   # glob didn't match: nothing installed yet
+        if [[ ! -f "$repo_commands_dir/$(basename "$installed")" ]]; then
+            rm -f "$installed"
+            PRUNED_COUNT=$((PRUNED_COUNT + 1))
+        fi
+    done
+}
+
+# Test hook: `AI_CONSULTANTS_INSTALL_DEFINE_ONLY=1 source scripts/install.sh`
+# yields the functions above and nothing else.
+#
+# It sits HERE — above the argument parser and the uninstall block — because a
+# sourced script inherits the CALLER's positional parameters. With the guard
+# below them, `bash scripts/test_install.sh --uninstall` had install.sh parse
+# the suite's own flag and run the real uninstall: rm -rf on the user's
+# installed skill plus every ~/.claude/commands/ai-consultants*.md. Anything
+# added below this point must be safe to skip, and nothing above it may act.
+if [[ -n "${AI_CONSULTANTS_INSTALL_DEFINE_ONLY:-}" ]]; then
+    # shellcheck disable=SC2317  # exit fallback for script-mode load
+    return 0 2>/dev/null || exit 0
+fi
+
 # =============================================================================
 # ARGUMENT PARSING
 # =============================================================================
@@ -203,10 +248,6 @@ if [[ "$UNINSTALL_MODE" == "true" ]]; then
     exit 0
 fi
 
-# =============================================================================
-# INSTALL / UPDATE
-# =============================================================================
-
 print_header
 
 # Check dependencies
@@ -260,6 +301,11 @@ if [[ "$INSTALL_COMMANDS" == "true" ]]; then
     log_info "Installing slash commands..."
 
     if [[ -d "$INSTALL_DIR/.claude/commands" ]]; then
+        prune_removed_commands "$COMMANDS_DIR" "$INSTALL_DIR/.claude/commands"
+        if [[ "$PRUNED_COUNT" -gt 0 ]]; then
+            log_info "Pruned $PRUNED_COUNT slash command(s) removed in a previous release"
+        fi
+
         cp "$INSTALL_DIR"/.claude/commands/*.md "$COMMANDS_DIR/" 2>/dev/null || true
         cmd_count=$(find "$INSTALL_DIR/.claude/commands" -maxdepth 1 -name '*.md' -type f 2>/dev/null | wc -l | tr -d ' ')
         log_success "Installed $cmd_count slash commands"

package/scripts/release.sh

@@ -1,220 +0,0 @@
-#!/bin/bash
-# release.sh - Automates the version-bump surfaces for an ai-consultants release.
-#
-# Usage:
-#   scripts/release.sh <new-version> [--dry-run]
-#
-# Bumps the CURRENT version (read from package.json) to <new-version> across
-# exactly these surfaces:
-#   package.json, scripts/config.sh, SKILL.md (frontmatter + title),
-#   README.md (title + badge), CLAUDE.md (**Version**), docs/cost_rates.json,
-#   docs/COST_RATES.md (title)
-#
-# Then validates consistency (no stray CURRENT version left on those exact
-# lines), runs `npm test` + `npm run lint`, and prints a reminder of the
-# manual release steps this script deliberately does NOT do.
-#
-# Env overrides:
-#   ROOT        - repo root to operate under (default: computed from script location)
-#   SKIP_GATE=1 - skip npm test / npm run lint (used by the hermetic test suite)
-#
-# This script never commits, tags, or publishes.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/lib/common.sh"
-
-ROOT="${ROOT:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-
-DRY_RUN=false
-NEW_VERSION=""
-
-for arg in "$@"; do
-    case "$arg" in
-        --dry-run)
-            DRY_RUN=true
-            ;;
-        -h|--help)
-            echo "Usage: $0 <new-version> [--dry-run]"
-            exit 0
-            ;;
-        *)
-            if [[ -z "$NEW_VERSION" ]]; then
-                NEW_VERSION="$arg"
-            else
-                log_error "Unexpected argument: $arg"
-                exit 1
-            fi
-            ;;
-    esac
-done
-
-if [[ -z "$NEW_VERSION" ]]; then
-    log_error "Missing required argument: <new-version>"
-    echo "Usage: $0 <new-version> [--dry-run]"
-    exit 1
-fi
-
-if [[ ! "$NEW_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    log_error "Invalid version '$NEW_VERSION' — must be semver X.Y.Z (e.g. 2.21.0)"
-    exit 1
-fi
-
-if [[ ! -f "$ROOT/package.json" ]]; then
-    log_error "package.json not found under ROOT: $ROOT"
-    exit 1
-fi
-
-CURRENT_VERSION="$(jq -r '.version' "$ROOT/package.json")"
-
-if [[ -z "$CURRENT_VERSION" || "$CURRENT_VERSION" == "null" ]]; then
-    log_error "Could not read current version from $ROOT/package.json"
-    exit 1
-fi
-
-if [[ "$CURRENT_VERSION" == "$NEW_VERSION" ]]; then
-    log_error "New version ($NEW_VERSION) is the same as the current version"
-    exit 1
-fi
-
-# Escape a literal string for safe use in a sed BRE pattern (dots, slashes, etc).
-esc_regex() {
-    printf '%s' "$1" | sed -e 's/[.[\*^$/]/\\&/g'
-}
-
-CUR_ESC="$(esc_regex "$CURRENT_VERSION")"
-
-# Each surface: file | sed program (anchored on the surrounding text, not a
-# blanket version replace) | old-line regex (for --dry-run preview + the
-# "old version gone" check) | new-line literal text (for the "new version
-# present" check, matched with fixed-string grep — avoids treating '*'/'.' in
-# markdown/JSON content as regex metacharacters) | human-readable label.
-SURFACES=(
-    "package.json|s/\"version\": \"${CUR_ESC}\"/\"version\": \"${NEW_VERSION}\"/|\"version\": \"${CUR_ESC}\"|  \"version\": \"${NEW_VERSION}\",|package.json: \"version\" field"
-    "scripts/config.sh|s/AI_CONSULTANTS_VERSION=\"${CUR_ESC}\"/AI_CONSULTANTS_VERSION=\"${NEW_VERSION}\"/|AI_CONSULTANTS_VERSION=\"${CUR_ESC}\"|AI_CONSULTANTS_VERSION=\"${NEW_VERSION}\"|scripts/config.sh: AI_CONSULTANTS_VERSION"
-    "SKILL.md|s/^  version: ${CUR_ESC}\$/  version: ${NEW_VERSION}/|^  version: ${CUR_ESC}\$|  version: ${NEW_VERSION}|SKILL.md: frontmatter version"
-    "SKILL.md|s/^# AI Consultants v${CUR_ESC} - AI Expert Panel\$/# AI Consultants v${NEW_VERSION} - AI Expert Panel/|^# AI Consultants v${CUR_ESC} - AI Expert Panel\$|# AI Consultants v${NEW_VERSION} - AI Expert Panel|SKILL.md: title"
-    "README.md|s/^# AI Consultants v${CUR_ESC}\$/# AI Consultants v${NEW_VERSION}/|^# AI Consultants v${CUR_ESC}\$|# AI Consultants v${NEW_VERSION}|README.md: title"
-    "README.md|s/version-${CUR_ESC}-blue/version-${NEW_VERSION}-blue/|version-${CUR_ESC}-blue|version-${NEW_VERSION}-blue|README.md: badge"
-    "CLAUDE.md|s/^\*\*Version\*\*: ${CUR_ESC}\$/**Version**: ${NEW_VERSION}/|^\*\*Version\*\*: ${CUR_ESC}\$|**Version**: ${NEW_VERSION}|CLAUDE.md: **Version**"
-    "docs/cost_rates.json|s/\"version\": \"${CUR_ESC}\"/\"version\": \"${NEW_VERSION}\"/|\"version\": \"${CUR_ESC}\"|  \"version\": \"${NEW_VERSION}\",|docs/cost_rates.json: \"version\" field"
-    "docs/COST_RATES.md|s/^# Cost Rates - AI Consultants v${CUR_ESC}\$/# Cost Rates - AI Consultants v${NEW_VERSION}/|^# Cost Rates - AI Consultants v${CUR_ESC}\$|# Cost Rates - AI Consultants v${NEW_VERSION}|docs/COST_RATES.md: title"
-)
-
-log_info "Release: $CURRENT_VERSION -> $NEW_VERSION (ROOT: $ROOT)"
-
-if [[ "$DRY_RUN" == "true" ]]; then
-    echo ""
-    echo "DRY RUN — no files will be changed."
-    echo ""
-fi
-
-for surface in "${SURFACES[@]}"; do
-    IFS='|' read -r rel_file sed_prog old_regex new_literal label <<< "$surface"
-    file="$ROOT/$rel_file"
-
-    if [[ ! -f "$file" ]]; then
-        log_error "Surface file not found: $file"
-        exit 1
-    fi
-
-    matched_line="$(grep -nE -m1 -- "$old_regex" "$file" 2>/dev/null || true)"
-
-    if [[ "$DRY_RUN" == "true" ]]; then
-        echo "  [$label]"
-        echo "    file: $rel_file"
-        if [[ -n "$matched_line" ]]; then
-            echo "    old:  ${matched_line#*:}"
-        else
-            echo "    old:  (no match found — see WARNING below)"
-        fi
-        echo "    new version: $NEW_VERSION"
-        if [[ -z "$matched_line" ]]; then
-            log_warn "No match for [$label] in $rel_file — this surface would not be updated"
-        fi
-        continue
-    fi
-
-    if [[ -z "$matched_line" ]]; then
-        log_error "No match for [$label] in $rel_file — refusing to proceed"
-        exit 1
-    fi
-
-    sed -i.bak -e "$sed_prog" "$file"
-    rm -f "${file}.bak"
-    log_success "Updated $label"
-done
-
-if [[ "$DRY_RUN" == "true" ]]; then
-    echo ""
-    log_info "Dry run complete. No files were changed."
-    exit 0
-fi
-
-# -----------------------------------------------------------------------------
-# Consistency validation: each surface's anchor line must now show NEW and
-# must NOT still show CURRENT. Checked line-by-line against the same anchors
-# used for the edit (not a whole-file grep), so legitimate historical
-# mentions of CURRENT elsewhere (CHANGELOG.md, docs/releases/*.md, CLAUDE.md's
-# `## Changelog` section) are correctly excluded from this check.
-# -----------------------------------------------------------------------------
-log_info "Validating consistency..."
-
-validation_failed=false
-for surface in "${SURFACES[@]}"; do
-    IFS='|' read -r rel_file sed_prog old_regex new_literal label <<< "$surface"
-    file="$ROOT/$rel_file"
-
-    if grep -qE -- "$old_regex" "$file" 2>/dev/null; then
-        log_error "[$label] still shows the old version ($CURRENT_VERSION) in $rel_file"
-        validation_failed=true
-    fi
-
-    if ! grep -qF -- "$new_literal" "$file" 2>/dev/null; then
-        log_error "[$label] missing expected new version ($NEW_VERSION) in $rel_file"
-        validation_failed=true
-    fi
-done
-
-if [[ "$validation_failed" == "true" ]]; then
-    log_error "Consistency validation FAILED. Fix the surfaces above before releasing."
-    exit 1
-fi
-
-log_success "Consistency validation passed: all surfaces show $NEW_VERSION, no stray $CURRENT_VERSION."
-
-# -----------------------------------------------------------------------------
-# Gate: full test suite + lint (skippable for the hermetic test harness)
-# -----------------------------------------------------------------------------
-if [[ "${SKIP_GATE:-}" == "1" ]]; then
-    log_warn "SKIP_GATE=1 set — skipping npm test / npm run lint"
-else
-    log_info "Running npm test..."
-    if ! (cd "$ROOT" && npm test); then
-        log_error "npm test FAILED — release aborted. Fix tests before releasing."
-        exit 1
-    fi
-    log_success "npm test passed."
-
-    log_info "Running npm run lint..."
-    if ! (cd "$ROOT" && npm run lint); then
-        log_error "npm run lint FAILED — release aborted. Fix lint issues before releasing."
-        exit 1
-    fi
-    log_success "npm run lint passed."
-fi
-
-echo ""
-echo "======================================================================"
-echo " Version bumped: $CURRENT_VERSION -> $NEW_VERSION"
-echo "======================================================================"
-echo ""
-echo "REMINDER — the following steps are NOT automated by this script:"
-echo "  1. Add a '## [$NEW_VERSION] - $(date +%Y-%m-%d)' entry to CHANGELOG.md"
-echo "  2. Add a '### v$NEW_VERSION' entry to CLAUDE.md's '## Changelog' section"
-echo "  3. Create docs/releases/v${NEW_VERSION}.md (see CLAUDE.md's release note template)"
-echo "  4. Sync the website: ../aiconsultants.sh/index.html (softwareVersion schema + badge)"
-echo ""
-echo "This script did NOT commit, tag, or publish anything."
-echo ""