cli-jaw 2.2.25 → 2.3.0

package/public/manager/src/settings/pages/components/TransportStatusChips.tsx

@@ -1,6 +1,8 @@
 import { useCallback, useEffect, useRef, useState } from 'react';
 import type { SettingsClient } from '../../types';
 
+export type MessengerChannel = 'telegram' | 'discord' | 'slack';
+
 export type TransportStatus = {
     configured: boolean;
     activeInbound: boolean;
@@ -9,7 +11,9 @@ export type TransportStatus = {
 };
 
 export type ChannelHealth = {
-    activeInbound: 'telegram' | 'discord' | 'slack';
+    /** @deprecated Use activeInboundChannels for the actual running set. */
+    activeInbound: MessengerChannel;
+    activeInboundChannels: MessengerChannel[];
     telegram: TransportStatus;
     discord: TransportStatus;
     slack: TransportStatus;
@@ -23,13 +27,29 @@ function isTransportStatus(value: unknown): value is TransportStatus {
         && typeof row['sendCapable'] === 'boolean';
 }
 
+function isMessengerChannel(value: unknown): value is MessengerChannel {
+    return value === 'telegram' || value === 'discord' || value === 'slack';
+}
+
 export function parseChannelHealth(payload: unknown): ChannelHealth | null {
     if (!payload || typeof payload !== 'object') return null;
     const channels = (payload as { channels?: unknown }).channels;
     if (!channels || typeof channels !== 'object') return null;
     const row = channels as Record<string, unknown>;
+    const rawActiveChannels = row['activeInboundChannels'];
+    let activeInboundChannels: MessengerChannel[] | null;
+    if (rawActiveChannels !== undefined) {
+        activeInboundChannels = Array.isArray(rawActiveChannels)
+            && rawActiveChannels.every(isMessengerChannel)
+            ? [...new Set(rawActiveChannels)]
+            : null;
+    } else {
+        const legacyActive = row['activeInbound'];
+        activeInboundChannels = isMessengerChannel(legacyActive) ? [legacyActive] : null;
+    }
+    if (!activeInboundChannels) return null;
     const active = row['activeInbound'];
-    if (active !== 'telegram' && active !== 'discord' && active !== 'slack') return null;
+    if (!isMessengerChannel(active)) return null;
     if (!isTransportStatus(row['telegram']) || !isTransportStatus(row['discord'])) return null;
     // Slack is tolerated as absent: a newer Manager can be pointed at an older
     // running cli-jaw, and rejecting the whole payload would hide Telegram and
@@ -39,6 +59,7 @@ export function parseChannelHealth(payload: unknown): ChannelHealth | null {
         : { configured: false, activeInbound: false, sendCapable: false, reason: 'unavailable' };
     return {
         activeInbound: active,
+        activeInboundChannels,
         telegram: row['telegram'],
         discord: row['discord'],
         slack,

package/scripts/docs/extract-commands.mts

@@ -25,6 +25,9 @@ const CMDLINE_HIDDEN = new Set([
     'browser',
     'prompt',
     'version',
+    'stop',
+    'approve',
+    'deny',
 ]);
 
 type SlashSurface = typeof SURFACES[number];

package/scripts/generate-channel-capability-table.mts

@@ -0,0 +1,161 @@
+/**
+ * Generates the messaging ChannelAdapter capability matrix inside
+ * `structure/CAPABILITY_TRUTH_TABLE.md`.
+ *
+ *   node_modules/.bin/tsx scripts/generate-channel-capability-table.mts
+ *   node_modules/.bin/tsx scripts/generate-channel-capability-table.mts --check
+ *
+ * Why a generator instead of a hand-kept table: the declaration in
+ * `src/messaging/channel-capabilities.ts` is the only thing the runtime obeys, so
+ * a hand-written doc can only ever be a second, quieter claim. `--check` is wired
+ * into `gate:truth-table-fresh`, which makes doc drift a release failure rather
+ * than a review-time nicety.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+import { allChannelCapabilities, CHANNEL_CAPABILITY_KEYS } from '../src/messaging/channel-capabilities.ts';
+import type { ChannelCapabilities } from '../src/messaging/channel-capabilities.ts';
+import type { MessengerChannel } from '../src/messaging/types.ts';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const TABLE_REL = 'structure/CAPABILITY_TRUTH_TABLE.md';
+const SOURCE_REL = 'src/messaging/channel-capabilities.ts';
+const ADAPTER_REL = 'src/messaging/channel-adapter.ts';
+const CONFORMANCE_REL = 'tests/unit/channel-contract-conformance.test.ts';
+const GENERATOR_REL = 'scripts/generate-channel-capability-table.mts';
+
+const START = '<!-- BEGIN GENERATED: messaging-channel-capabilities -->';
+const END = '<!-- END GENERATED: messaging-channel-capabilities -->';
+
+/** Prose for each capability key. Keyed by the closed set, so adding a capability
+ *  without describing it is a compile error rather than an empty documentation cell. */
+const CAPABILITY_NOTES: Record<keyof ChannelCapabilities, string> = {
+    sendText: '텍스트 전송',
+    editText: '전송된 메시지 수정',
+    deleteMessage: '전송된 메시지 삭제',
+    reaction: '리액션 부착',
+    typing: '입력 중 표시',
+    fileUpload: '파일 업로드',
+    voice: '음성 파일 전달 (녹음 UI 아님)',
+    threads: '스레드 타겟팅',
+    interactiveActions: '버튼 등 인터랙티브 액션',
+    durableIngress: '프로세스 재시작 후에도 유지되는 inbound 중복 제거',
+    replayableTransport: '미확인 프레임을 트랜스포트가 재전송',
+    maxMessageChars: '단일 메시지 문자 상한 (chunker 상수)',
+};
+
+function cell(value: boolean | number): string {
+    if (typeof value === 'number') return `\`${value.toLocaleString('en-US')}\``;
+    return value ? '✅' : '❌';
+}
+
+function buildBlock(): string {
+    const capabilities = allChannelCapabilities();
+    const channels = Object.keys(capabilities) as MessengerChannel[];
+
+    const lines: string[] = [];
+    lines.push('<!-- 이 블록은 생성됩니다. 손으로 고치지 마세요. -->');
+    lines.push(`<!-- 생성기: ${GENERATOR_REL} · 소스: ${SOURCE_REL} -->`);
+    lines.push('');
+    lines.push(`> **생성된 블록입니다 — 직접 수정하지 마세요.** \`${SOURCE_REL}\`의`);
+    lines.push(`> 선언을 읽어 \`npm run docs:channel-capabilities\`가 다시 씁니다.`);
+    lines.push(`> 손으로 고친 내용은 \`gate:truth-table-fresh\`에서 drift로 실패합니다.`);
+    lines.push('');
+    lines.push(`| Capability | ${channels.map((c) => c).join(' | ')} | 의미 |`);
+    lines.push(`| --- | ${channels.map(() => '---').join(' | ')} | --- |`);
+    for (const key of CHANNEL_CAPABILITY_KEYS) {
+        const values = channels.map((channel) => cell(capabilities[channel][key]));
+        lines.push(`| \`${key}\` | ${values.join(' | ')} | ${CAPABILITY_NOTES[key]} |`);
+    }
+    lines.push('');
+    lines.push('출처와 검증 지점:');
+    lines.push('');
+    lines.push(`- 선언 (SoT): [\`${SOURCE_REL}\`](../${SOURCE_REL})`);
+    lines.push(`- 어댑터 계약: [\`${ADAPTER_REL}\`](../${ADAPTER_REL})`);
+    lines.push(`- conformance test: \`${CONFORMANCE_REL}\` — 이 스위트 통과가 \`true\` 선언의 유일한 근거`);
+    lines.push(`- 생성기: [\`${GENERATOR_REL}\`](../${GENERATOR_REL}) (\`--check\`는 \`gate:truth-table-fresh\`가 실행)`);
+    lines.push('');
+    lines.push('`true`는 이 트리에서 오늘 호출 가능한 동작만을 뜻합니다. 벤더 SDK가 제공한다는');
+    lines.push('사실은 근거가 아닙니다 — conformance test가 통과할 때만 선언을 올립니다.');
+    return lines.join('\n');
+}
+
+type Located = {
+    text: string;
+    startIdx: number;
+    endIdx: number;
+    committed: string;
+};
+
+function locate(text: string): Located {
+    const startIdx = text.indexOf(START);
+    const endIdx = text.indexOf(END);
+    if (startIdx < 0 || endIdx < 0 || endIdx < startIdx) {
+        throw new Error(
+            `${TABLE_REL} is missing the generated block markers.\n` +
+            `  expected: ${START}\n            ${END}`,
+        );
+    }
+    return {
+        text,
+        startIdx,
+        endIdx,
+        committed: text.slice(startIdx + START.length, endIdx),
+    };
+}
+
+/** First differing line, so a failing gate points at the row instead of dumping both blocks. */
+function firstDifference(committed: string, expected: string): string {
+    const a = committed.split('\n');
+    const b = expected.split('\n');
+    for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+        if (a[i] === b[i]) continue;
+        return [
+            `  first difference at generated-block line ${i + 1}:`,
+            `    committed: ${a[i] === undefined ? '(line missing)' : JSON.stringify(a[i])}`,
+            `    expected:  ${b[i] === undefined ? '(line missing)' : JSON.stringify(b[i])}`,
+        ].join('\n');
+    }
+    return '  blocks differ in trailing bytes only';
+}
+
+function main(): number {
+    const check = process.argv.includes('--check');
+    const abs = path.join(repoRoot, TABLE_REL);
+    const original = fs.readFileSync(abs, 'utf8');
+    const located = locate(original);
+    const expected = `\n${buildBlock()}\n`;
+
+    if (check) {
+        if (located.committed === expected) {
+            console.log(`[ok] ${TABLE_REL} messaging capability matrix matches ${SOURCE_REL}`);
+            return 0;
+        }
+        console.error(
+            `[drift] ${TABLE_REL} messaging capability matrix does not match ${SOURCE_REL}.\n` +
+            `${firstDifference(located.committed, expected)}\n` +
+            `  fix: npm run docs:channel-capabilities`,
+        );
+        return 1;
+    }
+
+    if (located.committed === expected) {
+        console.log(`[unchanged] ${TABLE_REL}`);
+        return 0;
+    }
+    const next = original.slice(0, located.startIdx + START.length) + expected + original.slice(located.endIdx);
+    fs.writeFileSync(abs, next);
+    console.log(`[written] ${TABLE_REL} messaging capability matrix regenerated from ${SOURCE_REL}`);
+    return 0;
+}
+
+try {
+    process.exit(main());
+} catch (err) {
+    console.error(`[error] ${(err as Error).message}`);
+    process.exit(1);
+}

package/scripts/promote-to-main.sh

@@ -0,0 +1,175 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+command -v gh >/dev/null 2>&1 || { echo "ERROR: gh is required" >&2; exit 1; }
+gh auth status >/dev/null
+git fetch origin main preview --tags --prune
+
+LIVE_PREVIEW_SHA="$(git rev-parse refs/remotes/origin/preview^{commit})"
+PREVIEW_SHA="$(git rev-parse "${1:-$LIVE_PREVIEW_SHA}^{commit}")"
+if [ "$PREVIEW_SHA" != "$LIVE_PREVIEW_SHA" ]; then
+  echo "ERROR: requested SHA is not the live origin/preview head" >&2
+  exit 1
+fi
+
+PREVIEW_VERSION="$(git show "$PREVIEW_SHA:package.json" \
+  | node -e 'const fs=require("node:fs"); process.stdout.write(JSON.parse(fs.readFileSync(0,"utf8")).version)')"
+if [[ ! "$PREVIEW_VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-preview\.[0-9]+$ ]]; then
+  echo "ERROR: preview version must match X.Y.Z-preview.TIMESTAMP; got $PREVIEW_VERSION" >&2
+  exit 1
+fi
+STABLE_VERSION="${BASH_REMATCH[1]}"
+
+TESTS_URL="$(gh run list \
+  --workflow test.yml \
+  --branch preview \
+  --commit "$PREVIEW_SHA" \
+  --event push \
+  --status success \
+  --limit 1 --json url --jq '.[0].url // ""')"
+if [ -z "$TESTS_URL" ]; then
+  echo "ERROR: no successful Tests run for $PREVIEW_SHA on preview" >&2
+  exit 1
+fi
+
+MAIN_SHA="$(git rev-parse refs/remotes/origin/main^{commit})"
+if ! git merge-base --is-ancestor "$MAIN_SHA" "$PREVIEW_SHA"; then
+  echo "ERROR: origin/main is not an ancestor of the certified preview SHA" >&2
+  exit 1
+fi
+
+WORKTREE="$(mktemp -d "${TMPDIR:-/tmp}/cli-jaw-promote.XXXXXX")"
+PROMOTION_BRANCH="codex/promote-${STABLE_VERSION}-${PREVIEW_SHA:0:12}"
+cleanup() {
+  git worktree remove --force "$WORKTREE" >/dev/null 2>&1 || true
+  rmdir "$WORKTREE" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+git worktree add -b "$PROMOTION_BRANCH" "$WORKTREE" "$PREVIEW_SHA"
+
+(
+  cd "$WORKTREE"
+  npm version "$STABLE_VERSION" --no-git-tag-version --allow-same-version
+  node scripts/sync-electron-version.cjs
+  npm run gate:all
+  node scripts/require-release-evidence.mjs
+  git add package.json package-lock.json electron/package.json electron/package-lock.json
+  git commit -m "chore: promote v$STABLE_VERSION"
+  git push --set-upstream origin "$PROMOTION_BRANCH"
+)
+
+PROMOTION_COMMIT="$(git -C "$WORKTREE" rev-parse HEAD)"
+PR_URL="$(gh pr create \
+  --base main \
+  --head "$PROMOTION_BRANCH" \
+  --title "chore: promote v$STABLE_VERSION" \
+  --body "Promotes certified preview $PREVIEW_VERSION at $PREVIEW_SHA. Tests: $TESTS_URL")"
+
+gh pr checks "$PR_URL" --required --watch --fail-fast
+gh pr merge "$PR_URL" --squash --match-head-commit "$PROMOTION_COMMIT"
+
+MERGED_AT="$(gh pr view "$PR_URL" --json mergedAt --jq '.mergedAt // ""')"
+if [ -z "$MERGED_AT" ]; then
+  echo "ERROR: promotion PR did not merge" >&2
+  exit 1
+fi
+PR_MERGE_SHA="$(gh pr view "$PR_URL" --json mergeCommit --jq '.mergeCommit.oid // ""')"
+if [ -z "$PR_MERGE_SHA" ]; then
+  echo "ERROR: promotion PR has no merge commit SHA" >&2
+  exit 1
+fi
+
+git fetch origin main
+MERGED_MAIN_SHA="$(git rev-parse refs/remotes/origin/main^{commit})"
+LIVE_MAIN_SHA="$(git ls-remote origin refs/heads/main | cut -f1)"
+if [ -z "$LIVE_MAIN_SHA" ] || [ "$MERGED_MAIN_SHA" != "$LIVE_MAIN_SHA" ] \
+  || [ "$MERGED_MAIN_SHA" != "$PR_MERGE_SHA" ]; then
+  echo "ERROR: merged PR SHA, origin/main, and live main head do not match" >&2
+  exit 1
+fi
+MERGED_VERSION="$(git show "$MERGED_MAIN_SHA:package.json" \
+  | node -e 'const fs=require("node:fs"); process.stdout.write(JSON.parse(fs.readFileSync(0,"utf8")).version)')"
+if [ "$MERGED_VERSION" != "$STABLE_VERSION" ]; then
+  echo "ERROR: merged main version is $MERGED_VERSION, expected $STABLE_VERSION" >&2
+  exit 1
+fi
+
+deadline=$((SECONDS + 1200))
+MAIN_TESTS_URL=""
+while [ "$SECONDS" -lt "$deadline" ]; do
+  MAIN_TESTS_URL="$(gh run list \
+    --workflow test.yml \
+    --branch main \
+    --commit "$MERGED_MAIN_SHA" \
+    --event push \
+    --status success \
+    --limit 1 --json url --jq '.[0].url // ""')"
+  [ -n "$MAIN_TESTS_URL" ] && break
+  failed="$(gh run list \
+    --workflow test.yml \
+    --branch main \
+    --commit "$MERGED_MAIN_SHA" \
+    --event push \
+    --status completed \
+    --limit 1 --json conclusion --jq '.[0].conclusion // ""')"
+  case "$failed" in
+    failure|cancelled|timed_out|startup_failure|action_required)
+      echo "ERROR: main Tests completed with $failed" >&2
+      exit 1
+      ;;
+  esac
+  sleep 10
+done
+if [ -z "$MAIN_TESTS_URL" ]; then
+  echo "ERROR: timed out waiting for successful main Tests" >&2
+  exit 1
+fi
+
+deadline=$((SECONDS + 1200))
+MAIN_PLATFORM_URL=""
+while [ "$SECONDS" -lt "$deadline" ]; do
+  MAIN_PLATFORM_URL="$(gh run list \
+    --workflow postinstall-platform.yml \
+    --branch main \
+    --commit "$MERGED_MAIN_SHA" \
+    --event push \
+    --status success \
+    --limit 1 --json url --jq '.[0].url // ""')"
+  [ -n "$MAIN_PLATFORM_URL" ] && break
+  failed="$(gh run list \
+    --workflow postinstall-platform.yml \
+    --branch main \
+    --commit "$MERGED_MAIN_SHA" \
+    --event push \
+    --status completed \
+    --limit 1 --json conclusion --jq '.[0].conclusion // ""')"
+  case "$failed" in
+    failure|cancelled|timed_out|startup_failure|action_required)
+      echo "ERROR: main Postinstall Platform Checks completed with $failed" >&2
+      exit 1
+      ;;
+  esac
+  sleep 10
+done
+if [ -z "$MAIN_PLATFORM_URL" ]; then
+  echo "ERROR: timed out waiting for successful main Postinstall Platform Checks" >&2
+  exit 1
+fi
+
+LIVE_MAIN_SHA="$(git ls-remote origin refs/heads/main | cut -f1)"
+if [ "$LIVE_MAIN_SHA" != "$MERGED_MAIN_SHA" ]; then
+  echo "ERROR: origin/main moved while waiting for release CI" >&2
+  exit 1
+fi
+
+gh workflow run publish.yml \
+  --ref main \
+  -f version="$STABLE_VERSION" \
+  -f tag=latest \
+  -f expected-sha="$MERGED_MAIN_SHA" \
+  -f dry-run=false \
+  -f create-github-release=true
+
+echo "stable publish dispatched: cli-jaw@$STABLE_VERSION from $MERGED_MAIN_SHA"

package/scripts/release-gates.mjs

@@ -88,14 +88,24 @@ const GATES = {
         },
     },
     'truth-table-fresh': {
-        description: 'CAPABILITY_TRUTH_TABLE.md edited within 7 days OR matches code refs',
+        description: 'CAPABILITY_TRUTH_TABLE.md edited within 7 days OR matches code refs, AND its generated messaging channel matrix matches src/messaging/channel-capabilities.ts',
         check() {
             const rel = 'structure/CAPABILITY_TRUTH_TABLE.md';
             const abs = path.join(repoRoot, rel);
             if (!fs.existsSync(abs)) return { ok: false, detail: `${rel} missing` };
+            // The generated messaging block first: a stale matrix is a wrong claim
+            // regardless of the file's mtime, so freshness must not excuse it.
+            // node_modules/.bin/tsx directly — npx resolution is not a gate dependency.
+            const generated = run(path.join('node_modules', '.bin', 'tsx'), [
+                'scripts/generate-channel-capability-table.mts', '--check',
+            ], { timeout: 60_000 });
+            if (generated.status !== 0) {
+                const detail = [generated.stderr, generated.stdout].filter(Boolean).join('\n').trim();
+                return { ok: false, detail: `messaging capability matrix drift:\n${detail || `tsx exited with ${generated.status}`}` };
+            }
             const stat = fs.statSync(abs);
             const ageDays = (Date.now() - stat.mtimeMs) / (1000 * 60 * 60 * 24);
-            if (ageDays <= 7) return { ok: true, detail: `truth table ${ageDays.toFixed(2)}d old` };
+            if (ageDays <= 7) return { ok: true, detail: `truth table ${ageDays.toFixed(2)}d old; messaging matrix in sync` };
             const text = readFile(rel);
             const required = ['action-intent', 'target-resolver', 'answer-artifact', 'source-audit'];
             for (const term of required) {
@@ -103,7 +113,7 @@ const GATES = {
                     return { ok: false, detail: `truth table stale (${ageDays.toFixed(1)}d) and missing ${term}` };
                 }
             }
-            return { ok: true, detail: `truth table ${ageDays.toFixed(1)}d old but matches required terms` };
+            return { ok: true, detail: `truth table ${ageDays.toFixed(1)}d old but matches required terms; messaging matrix in sync` };
         },
     },
     'mcp-scope-frozen': {
@@ -474,6 +484,50 @@ const GATES = {
             return { ok: true, detail: 'install-integrity + scriptless contract suites green' };
         },
     },
+    'messaging-conformance': {
+        description: 'Telegram/Slack/Discord durable ingress and command contract suites + functional certification artifact',
+        check() {
+            const publicDocs = ['README.md', 'README.ko.md', 'README.ja.md', 'README.zh-CN.md', 'AGENTS.md'];
+            for (const rel of publicDocs) {
+                const abs = path.join(repoRoot, rel);
+                if (!fs.existsSync(abs)) continue;
+                const text = fs.readFileSync(abs, 'utf8');
+                if (/exactly[- ]once/i.test(text)) {
+                    return { ok: false, detail: `${rel} claims exactly-once` };
+                }
+                if (/release-certified/i.test(text)) {
+                    return { ok: false, detail: `${rel} claims release-certified` };
+                }
+            }
+            const suites = [
+                'tests/unit/channel-contract-conformance.test.ts',
+                'tests/unit/messaging-command-parity.test.ts',
+                'tests/unit/messaging-durable-ingress.test.ts',
+                'tests/unit/telegram-ingress-journal.test.ts',
+                'tests/unit/discord-ingress-journal.test.ts',
+                'tests/unit/ingress-generation.test.ts',
+                'tests/unit/messaging-trace-context.test.ts',
+                'tests/unit/messaging-metrics.test.ts',
+            ];
+            const missing = suites.filter((rel) => !fs.existsSync(path.join(repoRoot, rel)));
+            if (missing.length > 0) {
+                return { ok: false, detail: `channel fixture missing: ${missing.join(', ')}` };
+            }
+            const tests = run('npx', ['tsx', '--experimental-test-module-mocks', 'tests/run.mts', ...suites], { timeout: 180_000 });
+            if (tests.status !== 0) {
+                return { ok: false, detail: [tests.stdout, tests.stderr].filter(Boolean).join('\n').trim().slice(-800) };
+            }
+            const written = run(path.join('node_modules', '.bin', 'tsx'), ['scripts/write-messaging-certification.mts'], { timeout: 30_000 });
+            if (written.status !== 0) {
+                return { ok: false, detail: [written.stdout, written.stderr].filter(Boolean).join('\n').trim().slice(-800) };
+            }
+            const validated = run(path.join('node_modules', '.bin', 'tsx'), ['scripts/validate-messaging-certification.mts'], { timeout: 30_000 });
+            if (validated.status !== 0) {
+                return { ok: false, detail: [validated.stdout, validated.stderr].filter(Boolean).join('\n').trim().slice(-800) };
+            }
+            return { ok: true, detail: 'three-channel messaging suites green; functional-certified artifact valid' };
+        },
+    },
     'gate-docs': {
         description: 'structure/INDEX.md documents exactly the gates that exist, and each is npm-addressable',
         check() {

package/scripts/release-preview.sh

@@ -15,6 +15,11 @@ set -euo pipefail
 
 cd "$(dirname "$0")/.."
 
+if ! command -v gh &>/dev/null; then
+  echo "❌ gh CLI is required but not found in PATH."
+  exit 1
+fi
+
 # ─── Flag parsing ──────────────────────────────────────
 BUMP_KIND="patch"
 REQUIRE_EVIDENCE=false
@@ -203,6 +208,20 @@ else
   git push origin HEAD:preview
 fi
 
+# ─── Dispatch publish workflow ─────────────────────────
+RELEASE_SHA="$(git rev-parse HEAD)"
+LIVE_SHA="$(git ls-remote origin refs/heads/preview | cut -f1)"
+
+if [ -z "$LIVE_SHA" ] || [ "$LIVE_SHA" != "$RELEASE_SHA" ]; then
+  echo "❌ origin/preview moved after push (expected $RELEASE_SHA, got ${LIVE_SHA:-'(empty)'}). Aborting."
+  exit 1
+fi
+
+gh workflow run publish.yml --ref preview \
+  -f version="$VERSION" -f tag=preview -f expected-sha="$RELEASE_SHA" -f dry-run=false
+
+echo "🚀 publish.yml workflow dispatched for preview v$VERSION (sha $RELEASE_SHA)"
+
 # ─── GitHub Prerelease stub ────────────────────────────
 echo "📋 Creating/updating GitHub prerelease stub..."
 RELEASE_BODY="## Preview Release v$VERSION

package/scripts/require-release-evidence.mjs

@@ -27,7 +27,7 @@ const installerSensitivePaths = [
   'scripts/audit-fresh-install-evidence.mjs',
   'scripts/verify-release-evidence.mjs',
   'scripts/require-release-evidence.mjs',
-  'scripts/release.sh',
+  'scripts/promote-to-main.sh',
   'scripts/release-preview.sh',
   'tests/unit/cli-detect.test.ts',
   'tests/unit/install-sh-exec.test.ts',
@@ -46,6 +46,9 @@ function usage() {
 
 Options:
   --base-ref REF    Compare installer-sensitive files against REF instead of the latest v* tag.
+  --changed-files-stdin
+                    Read changed file paths from stdin and check whether any are installer-sensitive.
+                    Cannot be combined with --base-ref.
   -h, --help        Show this help.
 
 If installer-sensitive files changed, this script requires:
@@ -57,6 +60,7 @@ Then it runs scripts/verify-release-evidence.mjs before publish/release can cont
 }
 
 let baseRef = '';
+let changedFilesStdin = false;
 const args = process.argv.slice(2);
 for (let i = 0; i < args.length; i += 1) {
   const arg = args[i];
@@ -64,6 +68,10 @@ for (let i = 0; i < args.length; i += 1) {
     usage();
     process.exit(0);
   }
+  if (arg === '--changed-files-stdin') {
+    changedFilesStdin = true;
+    continue;
+  }
   if (arg === '--base-ref') {
     baseRef = args[++i] || '';
     if (!baseRef) throw new Error('missing value for --base-ref');
@@ -72,6 +80,18 @@ for (let i = 0; i < args.length; i += 1) {
   throw new Error(`unknown option: ${arg}`);
 }
 
+if (baseRef && changedFilesStdin) {
+  throw new Error('--changed-files-stdin cannot be combined with --base-ref');
+}
+
+function readChangedFilesFromStdin() {
+  const input = fs.readFileSync(0, 'utf8');
+  return input
+    .split(/\r?\n/)
+    .map((line) => line.replace(/\r$/, '').trim())
+    .filter((line) => line.length > 0);
+}
+
 function git(args, options = {}) {
   return spawnSync('git', args, {
     cwd: repoRoot,
@@ -175,6 +195,20 @@ function shortHash(files) {
   return crypto.createHash('sha256').update(files.join('\n')).digest('hex').slice(0, 12);
 }
 
+if (changedFilesStdin) {
+  const inputFiles = readChangedFilesFromStdin();
+  const matched = inputFiles.filter((file) => installerSensitivePaths.includes(file));
+  if (matched.length === 0) {
+    console.log('[release-evidence-required] SKIP no installer-sensitive paths in stdin');
+    process.exit(0);
+  }
+  console.error(`[release-evidence-required] CHANGED installer-sensitive files (${matched.length}, ${shortHash(matched)})`);
+  for (const file of matched) {
+    console.error(`- ${file}`);
+  }
+  process.exit(1);
+}
+
 if (!isGitRepo()) {
   console.error('[release-evidence-required] FAIL');
   console.error('- Cannot determine installer-sensitive changes outside a git checkout.');