bigpowers 2.93.0 → 2.93.2

package/.gemini/extensions/bigpowers/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.93.0",
+  "version": "2.93.2",
   "description": "80 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "gemini-extension"

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.93.0",
+  "version": "2.93.2",
   "description": "80 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.93.2](https://github.com/danielvm-git/bigpowers/compare/v2.93.1...v2.93.2) (2026-11-03)
+
+
+### Bug Fixes
+
+* **deps:** clear the production dependency advisories ([#200](https://github.com/danielvm-git/bigpowers/issues/200)) ([1ff6dea](https://github.com/danielvm-git/bigpowers/commit/1ff6dea73d7fdc06ebb3172839758f7a1be995c4))
+
+## [2.93.1](https://github.com/danielvm-git/bigpowers/compare/v2.93.0...v2.93.1) (2026-11-03)
+
+
+### Bug Fixes
+
+* **cli:** report the installed version after a self-update ([#198](https://github.com/danielvm-git/bigpowers/issues/198)) ([4a2d8d0](https://github.com/danielvm-git/bigpowers/commit/4a2d8d0131d593c83c86151f6c716d2bfae96498))
+
 # [2.93.0](https://github.com/danielvm-git/bigpowers/compare/v2.92.0...v2.93.0) (2026-11-03)
 
 

package/README.md

@@ -67,6 +67,8 @@ Use **arrow keys** to navigate, **space** to select, and **Enter** to confirm.
 
 ![Interactive Installer](docs/images/interactive-installer.png)
 
+*Screenshot from an earlier release; the current installer may differ.*
+
 ### From source (contributors)
 
 ```bash

package/bin/bigpowers.js

@@ -10,7 +10,9 @@ const path = require('path');
 
 const ROOT = path.dirname(path.dirname(__filename));
 const SKILLS_MARKER = path.join(os.homedir(), '.claude', 'skills', 'survey-context');
-const pkg = require(path.join(ROOT, 'package.json'));
+// Version strings come from disk, not from a require cache captured at startup:
+// `update` reinstalls this package mid-process (BUG-2026-11-03-cli-update-stale-version).
+const { readPackageVersion } = require(path.join(ROOT, 'scripts', 'lib', 'cli-version'));
 
 function isInstalled() {
   try {
@@ -95,10 +97,11 @@ if (cmd === 'status') {
     const count = fs.readdirSync(path.join(os.homedir(), '.claude', 'skills'))
       .filter(d => fs.lstatSync(path.join(os.homedir(), '.claude', 'skills', d)).isSymbolicLink())
       .length;
-    console.log(`bigpowers v${pkg.version} — ${count} skills installed`);
+    const version = readPackageVersion(ROOT);
+    console.log(`bigpowers v${version} — ${count} skills installed`);
     const latest = latestPublishedVersion();
-    if (latest && latest !== pkg.version) {
-      console.log(`\n⬆️  A newer release is available: v${latest} (you have v${pkg.version}).`);
+    if (latest && latest !== version) {
+      console.log(`\n⬆️  A newer release is available: v${latest} (you have v${version}).`);
       console.log('   Upgrade: npm install -g bigpowers@latest && bigpowers update');
     }
   } else {
@@ -123,10 +126,10 @@ Commands:
 
 // Default: check state and guide
 if (isInstalled()) {
-  console.log(`bigpowers v${pkg.version} — already installed.`);
+  console.log(`bigpowers v${readPackageVersion(ROOT)} — already installed.`);
   console.log('Commands: bigpowers {setup|update|status|help}');
 } else {
-  console.log(`🚀 bigpowers v${pkg.version} — skills not yet installed.`);
+  console.log(`🚀 bigpowers v${readPackageVersion(ROOT)} — skills not yet installed.`);
   console.log('   Run: bigpowers setup');
   process.exit(1);
 }

package/bin/setup.js

@@ -16,9 +16,9 @@ const { execSync, spawn } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const { installGlobal, installLocal, uninstallTool, detectExistingInstall } = require('../scripts/lib/install-helpers');
+const { readPackageVersion } = require('../scripts/lib/cli-version');
 
 const ROOT = path.resolve(path.dirname(__filename), '..');
-const pkg = require(path.join(ROOT, 'package.json'));
 
 // ── ANSI helpers ─────────────────────────────────────────────────────────────
 const c = {
@@ -30,7 +30,11 @@ const c = {
 };
 
 // ── ASCII banner ─────────────────────────────────────────────────────────────
-const BANNER = `
+// The version is a parameter, read fresh from disk at render time: `update`
+// reinstalls this package mid-process, so a value captured at startup is the one
+// that was just replaced (BUG-2026-11-03-cli-update-stale-version).
+function banner(version) {
+  return `
 ${c.cyan('╔════════════════════════════════════════════════════════════════════════════╗')}
 ${c.cyan('║')}                                                                            ${c.cyan('║')}
 ${c.cyan('║')}   ${c.bold(c.cyan('██████╗ ██╗ ██████╗ ██████╗  ██████╗ █      █ ███████╗██████╗ ███████╗'))}   ${c.cyan('║')}
@@ -41,9 +45,10 @@ ${c.cyan('║')}   ${c.bold(c.cyan('██████╔╝██║╚██
 ${c.cyan('║')}   ${c.bold(c.cyan('╚═════╝ ╚═╝ ╚═════╝ ╚═╝      ╚═════╝ ╚═╝  ╚═╝ ╚══════╝╚═╝  ╚═╝╚══════╝'))}   ${c.cyan('║')}
 ${c.cyan('║')}                                                                            ${c.cyan('║')}
 ${c.cyan('║')}           ${c.dim('Spec-Driven & Test-First Skills for Solo Developers')}              ${c.cyan('║')}
-${c.cyan('║')}           ${c.dim(`v${pkg.version}`)}                                                          ${c.cyan('║')}
+${c.cyan('║')}           ${c.dim(`v${version}`)}                                                          ${c.cyan('║')}
 ${c.cyan('╚════════════════════════════════════════════════════════════════════════════╝')}
 `;
+}
 
 // ── Tool definitions ─────────────────────────────────────────────────────────
 const TOOLS = [
@@ -164,8 +169,9 @@ async function handleUninstall() {
 async function main() {
   const { intro, outro, select, multiselect, spinner, confirm, isCancel } = await clack();
 
-  console.log(BANNER);
-  intro(c.bold(`bigpowers v${pkg.version}`));
+  const version = readPackageVersion(ROOT); // after a self-update this is the NEW version
+  console.log(banner(version));
+  intro(c.bold(`bigpowers v${version}`));
 
   // ── Step 0: Detect existing install ────────────────────────────────────
   const hasExisting = detectExistingInstall();

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "bigpowers",
-  "version": "2.93.0",
+  "version": "2.93.2",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {
     "setup": "node bin/setup.js",
     "compliance": "bash scripts/audit-compliance.sh specs/verifications/features && bash scripts/validate-doctrine.sh && python3 scripts/check-skill-links.py",
+    "audit:prod": "npm audit --omit=dev",
     "doctrine": "bash scripts/validate-doctrine.sh",
     "sync": "bash scripts/sync-skills.sh",
     "validate-specs": "bash scripts/validate-specs-yaml.sh",
@@ -65,7 +66,7 @@
     "remark-frontmatter": "^5.0.0",
     "remark-parse": "^11.0.0",
     "unified": "^11.0.5",
-    "zod": "^3.24.2"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@ctxo/lang-typescript": "^0.11.0",

package/scripts/lib/cli-version.js

@@ -0,0 +1,29 @@
+// story: BUG-2026-11-03-cli-update-stale-version
+// cli-version.js — read the installed version from disk, never from a require cache.
+//
+// `bigpowers update` runs `npm install -g bigpowers@latest` inside a *running*
+// process. bin/bigpowers.js has already require()d package.json by then, so when
+// bin/setup.js (required after the reinstall) reads the same resolved path, Node
+// hands back the cached object: the banner printed v2.88.5 while v2.92.0 was what
+// had just been installed, and `bigpowers install` — a fresh process — correctly
+// reported 2.92.0.
+//
+// readFileSync always sees the new file, so every user-facing version string goes
+// through here.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/** Version of the package rooted at `root`, read fresh from disk. */
+function readPackageVersion(root) {
+  try {
+    const text = fs.readFileSync(path.join(root, 'package.json'), 'utf8');
+    return JSON.parse(text).version || 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+module.exports = { readPackageVersion };

package/scripts/lib/golden-suite-gates.sh

@@ -53,6 +53,13 @@ GOLDEN_GATES=(
   "target-contracts:bash scripts/test-target-contracts.sh:false"
   # Registry-driven replacements for the 25 hand-written per-target scripts.
   "install-hub:bash scripts/test-install-hub.sh:false"
+  # Whether the package *builds* was gated; whether its tree is *safe* was not.
+  # `npm audit --omit=dev` was 10 advisories (1 critical) with nothing watching.
+  "prod-dependency-audit:bash scripts/test-prod-dependency-audit.sh:false"
+  # `bigpowers update` runs `npm install -g @latest` inside a live process; a
+  # version captured by require() at startup then reports the release that was
+  # just replaced (BUG-2026-11-03-cli-update-stale-version).
+  "bigpowers-cli-version:bash scripts/test-bigpowers-cli-version.sh:false"
   "adapter-render:bash scripts/test-adapter-render.sh:false"
   "adapters:bash scripts/test-adapters.sh:false"
   # Previously orphaned: present in scripts/ but reachable from no gate.

package/scripts/test-bigpowers-cli-version.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# story: BUG-2026-11-03-cli-update-stale-version
+# test-bigpowers-cli-version.sh — `update` must report the version it just installed.
+#
+# Reproduces the reported symptom without touching npm or the real HOME:
+#   bigpowers update  → banner v2.88.5   (wrong: a require() cache captured at startup,
+#                                          before `npm install -g bigpowers@latest`)
+#   bigpowers install → banner v2.92.0   (right: a fresh process reads package.json)
+#
+# Three assertions:
+#   1. readPackageVersion() sees the on-disk version even after package.json was
+#      already require()d and then rewritten (the exact mechanism).
+#   2. the installer's banner renders that fresh value — end to end, from a copy
+#      of bin/ whose version changes between process start and banner render.
+#   3. neither CLI entry point still interpolates a cached `pkg.version` into a
+#      user-facing line (static guard: the cache is invisible at runtime until
+#      the day a self-update happens).
+#
+# Usage: bash scripts/test-bigpowers-cli-version.sh
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+
+source scripts/lib/test-assertions.sh
+TA_PASS=0
+TA_FAIL=0
+TA_TMPDIR="$(mktemp -d)"
+trap ta_cleanup EXIT
+
+echo "=== test-bigpowers-cli-version.sh ==="
+
+# ── 1. readPackageVersion ignores the require cache ─────────────────────────
+mkdir -p "$TA_TMPDIR/pkgver"
+if [ ! -f scripts/lib/cli-version.js ]; then
+  ta_fail "(1) scripts/lib/cli-version.js is missing — nothing reads the version from disk"
+  CACHE_OUT=""
+else
+CACHE_OUT="$(node -e '
+const fs = require("fs"), path = require("path");
+const dir = process.argv[1];
+fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ version: "2.88.5" }));
+const cached = require(path.join(dir, "package.json"));          // what bin/bigpowers.js does at startup
+fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ version: "2.92.0" }));  // npm install -g @latest
+const { readPackageVersion } = require(process.argv[2]);
+process.stdout.write(`${cached.version}|${readPackageVersion(dir)}`);
+' "$TA_TMPDIR/pkgver" "$REPO_ROOT/scripts/lib/cli-version.js")"
+fi
+if [ "$CACHE_OUT" = "2.88.5|2.92.0" ]; then
+  ta_pass "(1) readPackageVersion sees the on-disk version after package.json is rewritten"
+else
+  ta_fail "(1) version read followed the require cache: got '$CACHE_OUT' (want '2.88.5|2.92.0')"
+fi
+
+# ── 2. the banner an `update` run prints carries the new version ────────────
+# Drive the exact sequence bin/bigpowers.js uses: read package.json at startup,
+# let `npm install -g bigpowers@latest` replace it, then require bin/setup.js —
+# which renders the banner. stdin at EOF makes setup draw the banner and exit, so
+# nothing is installed and no prompt is answered.
+FAKE_PKG="$TA_TMPDIR/fakepkg"
+mkdir -p "$FAKE_PKG"
+cp -R "$REPO_ROOT/bin" "$FAKE_PKG/bin"
+cp -R "$REPO_ROOT/scripts" "$FAKE_PKG/scripts"
+ln -sfn "$REPO_ROOT/node_modules" "$FAKE_PKG/node_modules"
+printf '{"name":"bigpowers-fake","version":"2.88.5"}\n' > "$FAKE_PKG/package.json"
+cat > "$FAKE_PKG/driver.js" <<'DRIVER'
+// Mimics `bigpowers update`: snapshot at startup, reinstall over it, then render.
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+const root = __dirname;
+const pkg = require(path.join(root, 'package.json'));   // 2.88.5 — the version the process booted with
+fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'bigpowers-fake', version: '2.92.0' }));
+process.stdout.write(`startup=${pkg.version}\n`);
+require(path.join(root, 'bin', 'setup.js'));            // prints the banner
+DRIVER
+BANNER_OUT="$(
+  cd "$FAKE_PKG"
+  HOME="$TA_TMPDIR/home" perl -e 'alarm 25; exec @ARGV' node driver.js < /dev/null 2>&1 || true
+)"
+if printf '%s' "$BANNER_OUT" | grep -q "startup=2.88.5" && printf '%s' "$BANNER_OUT" | grep -q "v2.92.0"; then
+  ta_pass "(2) the banner after a self-update reports the installed version (2.92.0), not the startup one (2.88.5)"
+elif printf '%s' "$BANNER_OUT" | grep -q "v2.88.5"; then
+  ta_fail "(2) the banner reported the startup version (v2.88.5) after 2.92.0 was installed"
+else
+  ta_fail "(2) no banner version found in the update flow"
+fi
+
+# ── 3. no user-facing line interpolates the startup snapshot ────────────────
+# `pkg.version` is the value captured when the process started. Anywhere it
+# reaches the user after a self-update, it is the version that was replaced.
+STALE=0
+for f in bin/setup.js bin/bigpowers.js; do
+  grep -nE 'pkg\.version' "$f" | grep -vE '^\s*[0-9]+:\s*//' >/dev/null 2>&1 && STALE=1
+done
+if [ "$STALE" -eq 0 ]; then
+  ta_pass "(3) neither bin/setup.js nor bin/bigpowers.js prints a cached pkg.version"
+else
+  ta_fail "(3) a CLI entry point still interpolates pkg.version (stale after self-update)"
+fi
+
+echo "$TA_PASS passed, $TA_FAIL failed"
+[[ "$TA_FAIL" -eq 0 ]]

package/scripts/test-prod-dependency-audit.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# story: BUG-2026-11-03-prod-dependency-advisories
+# test-prod-dependency-audit.sh — the shipped dependency graph must stay advisory-free.
+#
+# `npm audit --omit=dev` covers what users actually install. It was 10 advisories
+# (1 critical) on 2.93.1 with nothing watching it: the only dependency gates were
+# about whether the package *builds*, not whether its tree is safe.
+#
+# Two failure modes, both loud:
+#   1. any advisory in the production tree        → FAIL, listing package + severity
+#   2. the audit could not run (no registry)      → FAIL, naming the escape hatch
+#
+# Nothing here passes silently. To skip it deliberately (offline work), the golden
+# runner's own mechanism is the documented path:
+#   GOLDEN_SKIP_GATES=prod-dependency-audit bash scripts/run-verification-gates.sh
+# ...which records the gate as SKIPPED in the report rather than green.
+#
+# Dev-tree advisories are out of scope: they are concentrated in the npm bundle
+# inside @semantic-release/npm and need major release-tool upgrades
+# (BUG-2026-11-03-dev-dependency-advisories).
+#
+# Usage: bash scripts/test-prod-dependency-audit.sh
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+
+source scripts/lib/test-assertions.sh
+TA_PASS=0
+TA_FAIL=0
+TA_TMPDIR="$(mktemp -d)"
+trap ta_cleanup EXIT
+
+echo "=== test-prod-dependency-audit.sh ==="
+
+if ! command -v npm >/dev/null 2>&1; then
+  ta_fail "npm is unavailable — cannot audit the production dependency graph"
+  echo "$TA_PASS passed, $TA_FAIL failed"
+  exit 1
+fi
+
+AUDIT_JSON="$TA_TMPDIR/audit-prod.json"
+# npm audit exits 1 when it finds advisories — capture, do not abort.
+npm audit --omit=dev --json >"$AUDIT_JSON" 2>"$TA_TMPDIR/audit-prod.err" || true
+
+REPORT="$(
+  python3 - "$AUDIT_JSON" <<'PY'
+import json, sys
+
+path = sys.argv[1]
+try:
+    data = json.load(open(path, encoding="utf-8"))
+except Exception:
+    print("UNPARSEABLE")
+    sys.exit(0)
+
+meta = data.get("metadata") or {}
+counts = meta.get("vulnerabilities")
+if counts is None:
+    print("UNPARSEABLE")
+    sys.exit(0)
+
+total = counts.get("total", 0)
+rows = []
+for name, info in sorted((data.get("vulnerabilities") or {}).items()):
+    severity = info.get("severity", "?")
+    via = info.get("via") or []
+    title = ""
+    for entry in via:
+        if isinstance(entry, dict) and entry.get("title"):
+            title = entry["title"]
+            break
+    rows.append(f"{severity:<9} {name}  {title[:70]}")
+print(f"TOTAL={total}")
+for row in rows:
+    print(f"  {row}")
+PY
+)"
+
+if [[ "$REPORT" == UNPARSEABLE* ]]; then
+  ta_fail "npm audit produced no parseable report — the registry was probably unreachable:"
+  sed -n '1,5p' "$TA_TMPDIR/audit-prod.err" | sed 's/^/    /' >&2
+  ta_fail "run with network, or skip deliberately: GOLDEN_SKIP_GATES=prod-dependency-audit"
+else
+  TOTAL="$(grep -oE 'TOTAL=[0-9]+' <<< "$REPORT" | cut -d= -f2)"
+  if [[ "${TOTAL:-0}" -eq 0 ]]; then
+    ta_pass "no advisories in the production dependency tree (npm audit --omit=dev)"
+  else
+    ta_fail "$TOTAL advisor$([[ "$TOTAL" -eq 1 ]] && echo 'y' || echo 'ies') in the production dependency tree:"
+    sed -n '2,$p' <<< "$REPORT" | sed 's/^/    /' >&2
+  fi
+fi
+
+echo "$TA_PASS passed, $TA_FAIL failed"
+[[ "$TA_FAIL" -eq 0 ]]