cli-jaw 2.4.3 → 2.4.4

package/dist/bin/commands/dashboard-chat.js

@@ -84,7 +84,11 @@ export async function handleDashboardChat(argvFromSwitch) {
         }
     }
     catch (err) {
-        console.error(`  ${err.message}`);
+        const msg = err.message;
+        console.error(`  ${msg}`);
+        if (msg.includes('unreachable')) {
+            console.error(`  Tip: for local-instance search, use: jaw chat search "<query>" --all-sessions`);
+        }
         process.exit(1);
     }
 }

package/dist/bin/commands/dashboard-chat.js.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-chat.js","sourceRoot":"","sources":["../../../bin/commands/dashboard-chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEpF,sFAAsF;AACtF,yFAAyF;AACzF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACtD,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B,KAAK,UAAU,aAAa,CAAI,IAAY;IACxC,OAAO,gBAAgB,CAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC;AAoBD,SAAS,gBAAgB,CAAC,IAAwB;IAC9C,OAAO,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO;YACH,MAAM,GAAG,CAAC,UAAU,GAAG,KAAK,KAAK,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,EAAE;YACvE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;SACxC,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IACd,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;uEAWuD,sBAAsB;;;;CAI5F,CAAC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,cAAwB;IAC9D,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzF,SAAS,EAAE,CAAC;QACZ,OAAO;IACX,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtC,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACL,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACzC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC3B;QACD,MAAM,EAAE,KAAK;QACb,gBAAgB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAErE,IAAI,CAAC;QACD,QAAQ,GAAG,EAAE,CAAC;YACV,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACZ,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC3F,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACtC,IAAI,MAAM,CAAC,QAAQ;oBAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACjE,IAAI,MAAM,CAAC,KAAK;oBAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxD,IAAI,MAAM,CAAC,IAAI;oBAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAqB,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACxF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtF,OAAO;YACX,CAAC;YACD;gBACI,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;gBAC9C,SAAS,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC"}
+{"version":3,"file":"dashboard-chat.js","sourceRoot":"","sources":["../../../bin/commands/dashboard-chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEpF,sFAAsF;AACtF,yFAAyF;AACzF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACtD,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B,KAAK,UAAU,aAAa,CAAI,IAAY;IACxC,OAAO,gBAAgB,CAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC;AAoBD,SAAS,gBAAgB,CAAC,IAAwB;IAC9C,OAAO,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO;YACH,MAAM,GAAG,CAAC,UAAU,GAAG,KAAK,KAAK,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,EAAE;YACvE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;SACxC,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IACd,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;uEAWuD,sBAAsB;;;;CAI5F,CAAC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,cAAwB;IAC9D,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzF,SAAS,EAAE,CAAC;QACZ,OAAO;IACX,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtC,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACL,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACzC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC3B;QACD,MAAM,EAAE,KAAK;QACb,gBAAgB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAErE,IAAI,CAAC;QACD,QAAQ,GAAG,EAAE,CAAC;YACV,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACZ,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC3F,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACtC,IAAI,MAAM,CAAC,QAAQ;oBAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACjE,IAAI,MAAM,CAAC,KAAK;oBAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxD,IAAI,MAAM,CAAC,IAAI;oBAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAqB,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACxF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtF,OAAO;YACX,CAAC;YACD;gBACI,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;gBAC9C,SAAS,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cli-jaw",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "description": "Personal AI assistant powered by Pi, Antigravity, AI-E, Claude, Claude E, Codex, Codex App, Cursor, Grok, Kiro, OpenCode, and Copilot — Web, Terminal, Telegram, and Discord interfaces with 107 built-in skills",
   "type": "module",
   "keywords": [

package/scripts/promote-to-main.sh

@@ -51,10 +51,11 @@ git worktree add -b "$PROMOTION_BRANCH" "$WORKTREE" "$PREVIEW_SHA"
 
 (
   cd "$WORKTREE"
+  npm ci --ignore-scripts
   npm version "$STABLE_VERSION" --no-git-tag-version --allow-same-version
   node scripts/sync-electron-version.cjs
   npm run gate:all
-  node scripts/require-release-evidence.mjs
+  node scripts/require-release-evidence.mjs --accept-ci-evidence
   git add package.json package-lock.json electron/package.json electron/package-lock.json
   git commit -m "chore: promote v$STABLE_VERSION"
   git push --set-upstream origin "$PROMOTION_BRANCH"

package/scripts/release-preview.sh

@@ -214,7 +214,7 @@ else
   git push origin HEAD:preview
 fi
 
-# ─── Dispatch publish workflow ─────────────────────────
+# ─── Wait for release CI, then dispatch publish ────────
 RELEASE_SHA="$(git rev-parse HEAD)"
 LIVE_SHA="$(git ls-remote origin refs/heads/preview | cut -f1)"
 
@@ -223,6 +223,145 @@ if [ -z "$LIVE_SHA" ] || [ "$LIVE_SHA" != "$RELEASE_SHA" ]; then
   exit 1
 fi
 
+# Printed on every path that gives up before dispatching, so the operator can
+# resume the release without reconstructing the command from the workflow file.
+publish_dispatch_hint() {
+  echo ""
+  echo "Resume once the required runs are green:"
+  echo "  gh workflow run publish.yml --ref preview \\"
+  echo "    -f version=\"$VERSION\" -f tag=preview -f expected-sha=\"$RELEASE_SHA\" -f dry-run=false"
+}
+
+# publish.yml refuses to publish without a SUCCESSFUL PUSH run of test.yml for
+# this exact SHA -- and, when the installer surface changed, of
+# postinstall-platform.yml too. The push above is seconds old, so dispatching
+# immediately made the first attempt of every preview release fail by
+# construction: v2.4.0-preview (18e6337) needed three dispatches, 10:29:13
+# (Tests still running), 10:37:23 (Postinstall still running), 10:38:29 (green).
+# So wait for the evidence first, exactly as promote-to-main.sh already does for
+# the merged main SHA on the stable path.
+
+# publish.yml derives its range on a fetch-depth: 0 checkout and therefore sees
+# every tag. Match that view before deciding below, or a checkout missing the
+# newest stable tag answers a different question than the gate will.
+git fetch origin --tags --quiet || echo "⚠️  Could not refresh tags; using the local tag list."
+
+# postinstall-platform.yml carries `paths:` filters, so for a SHA that touches
+# no installer-sensitive path it never runs at all and waiting for it would burn
+# the whole deadline on a run that will never exist. publish.yml decides with
+# `require-release-evidence.mjs --changed-files-stdin` over the diff since the
+# last stable tag merged into the release SHA, so ask the same detector the same
+# question over the same range rather than guessing.
+PLATFORM_REQUIRED=false
+PREVIOUS_STABLE_TAG="$(git tag --merged "$RELEASE_SHA" --sort=-v:refname \
+  | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1 || true)"
+if [ -z "$PREVIOUS_STABLE_TAG" ]; then
+  echo "ℹ️  No previous stable v* tag; publish.yml treats this as a first release and skips the platform gate."
+else
+  CHANGED_FILES="$(mktemp)"
+  git diff --name-only "$PREVIOUS_STABLE_TAG..$RELEASE_SHA" > "$CHANGED_FILES"
+  DETECTOR_STATUS=0
+  node scripts/require-release-evidence.mjs --changed-files-stdin < "$CHANGED_FILES" || DETECTOR_STATUS=$?
+  rm -f "$CHANGED_FILES"
+  case "$DETECTOR_STATUS" in
+    0)
+      echo "ℹ️  No installer-sensitive changes since $PREVIOUS_STABLE_TAG; platform checks are not required."
+      ;;
+    1)
+      PLATFORM_REQUIRED=true
+      ;;
+    3)
+      echo "ℹ️  Changed files are release-driver extras only; platform checks are not required."
+      ;;
+    *)
+      echo "ERROR: installer-sensitive path detector failed with status $DETECTOR_STATUS" >&2
+      publish_dispatch_hint
+      exit "$DETECTOR_STATUS"
+      ;;
+  esac
+fi
+
+echo "⏳ Waiting for preview Tests on $RELEASE_SHA..."
+deadline=$((SECONDS + 1200))
+PREVIEW_TESTS_URL=""
+while [ "$SECONDS" -lt "$deadline" ]; do
+  PREVIEW_TESTS_URL="$(gh run list \
+    --workflow test.yml \
+    --branch preview \
+    --commit "$RELEASE_SHA" \
+    --event push \
+    --status success \
+    --limit 1 --json url --jq '.[0].url // ""')"
+  [ -n "$PREVIEW_TESTS_URL" ] && break
+  # An empty result also covers "GitHub has not materialised the run yet", which
+  # is the normal state for the first seconds after a push, so keep polling.
+  failed="$(gh run list \
+    --workflow test.yml \
+    --branch preview \
+    --commit "$RELEASE_SHA" \
+    --event push \
+    --status completed \
+    --limit 1 --json conclusion --jq '.[0].conclusion // ""')"
+  case "$failed" in
+    failure|cancelled|timed_out|startup_failure|action_required)
+      echo "ERROR: preview Tests completed with $failed" >&2
+      publish_dispatch_hint
+      exit 1
+      ;;
+  esac
+  sleep 10
+done
+if [ -z "$PREVIEW_TESTS_URL" ]; then
+  echo "ERROR: timed out waiting for successful preview Tests" >&2
+  publish_dispatch_hint
+  exit 1
+fi
+echo "✅ Tests: $PREVIEW_TESTS_URL"
+
+if [ "$PLATFORM_REQUIRED" = true ]; then
+  echo "⏳ Waiting for preview Postinstall Platform Checks on $RELEASE_SHA..."
+  deadline=$((SECONDS + 1200))
+  PREVIEW_PLATFORM_URL=""
+  while [ "$SECONDS" -lt "$deadline" ]; do
+    PREVIEW_PLATFORM_URL="$(gh run list \
+      --workflow postinstall-platform.yml \
+      --branch preview \
+      --commit "$RELEASE_SHA" \
+      --event push \
+      --status success \
+      --limit 1 --json url --jq '.[0].url // ""')"
+    [ -n "$PREVIEW_PLATFORM_URL" ] && break
+    failed="$(gh run list \
+      --workflow postinstall-platform.yml \
+      --branch preview \
+      --commit "$RELEASE_SHA" \
+      --event push \
+      --status completed \
+      --limit 1 --json conclusion --jq '.[0].conclusion // ""')"
+    case "$failed" in
+      failure|cancelled|timed_out|startup_failure|action_required)
+        echo "ERROR: preview Postinstall Platform Checks completed with $failed" >&2
+        publish_dispatch_hint
+        exit 1
+        ;;
+    esac
+    sleep 10
+  done
+  if [ -z "$PREVIEW_PLATFORM_URL" ]; then
+    echo "ERROR: timed out waiting for successful preview Postinstall Platform Checks" >&2
+    publish_dispatch_hint
+    exit 1
+  fi
+  echo "✅ Postinstall Platform Checks: $PREVIEW_PLATFORM_URL"
+fi
+
+LIVE_SHA="$(git ls-remote origin refs/heads/preview | cut -f1)"
+if [ "$LIVE_SHA" != "$RELEASE_SHA" ]; then
+  echo "ERROR: origin/preview moved while waiting for release CI" >&2
+  publish_dispatch_hint
+  exit 1
+fi
+
 gh workflow run publish.yml --ref preview \
   -f version="$VERSION" -f tag=preview -f expected-sha="$RELEASE_SHA" -f dry-run=false
 
@@ -239,7 +378,7 @@ RELEASE_BODY="## Preview Release v$VERSION
 $CHANGELOG
 
 ### Publish
-- npm preview publish runs from \`.github/workflows/publish.yml\` on the \`preview\` branch.
+- npm preview publish is dispatched by \`scripts/release-preview.sh\` into \`.github/workflows/publish.yml\` (\`workflow_dispatch\`), pinned to this commit, after preview CI is green.
 - npm dist-tag: \`preview\`
 - Install after the workflow succeeds: \`npm install -g cli-jaw@preview\`
 
@@ -270,4 +409,4 @@ echo "✅ Preview release queued: cli-jaw@$VERSION"
 echo "   Install: npm install -g cli-jaw@preview"
 echo "   Exact:   npm install -g cli-jaw@$VERSION"
 echo "   Release: https://github.com/lidge-jun/cli-jaw/releases/tag/v$VERSION"
-echo "   Workflow: https://github.com/lidge-jun/cli-jaw/actions/workflows/publish.yml?query=branch%3Apreview"
+echo "   Workflow: https://github.com/lidge-jun/cli-jaw/actions/workflows/publish.yml?query=event%3Aworkflow_dispatch"

package/scripts/require-release-evidence.mjs

@@ -195,6 +195,7 @@ Then it runs scripts/verify-release-evidence.mjs before publish/release can cont
 let baseRef = '';
 let changedFilesStdin = false;
 let printPaths = false;
+let acceptCiEvidence = false;
 const args = process.argv.slice(2);
 for (let i = 0; i < args.length; i += 1) {
   const arg = args[i];
@@ -210,6 +211,10 @@ for (let i = 0; i < args.length; i += 1) {
     changedFilesStdin = true;
     continue;
   }
+  if (arg === '--accept-ci-evidence') {
+    acceptCiEvidence = true;
+    continue;
+  }
   if (arg === '--base-ref') {
     baseRef = args[++i] || '';
     if (!baseRef) throw new Error('missing value for --base-ref');
@@ -345,9 +350,19 @@ if (changedFilesStdin) {
     console.log('[release-evidence-required] SKIP no installer-sensitive paths in stdin');
     process.exit(0);
   }
+  // Distinguish workflow-trigger changes (need platform CI) from extra-only changes.
+  // Exit 1 = platform CI required, exit 3 = sensitive but platform CI not triggered.
+  const workflowPaths = installerSensitivePaths.filter((p) => !EXTRA_SENSITIVE_PATHS.includes(p));
+  const workflowMatched = matched.filter((file) => workflowPaths.includes(file));
   console.error(`[release-evidence-required] CHANGED installer-sensitive files (${matched.length}, ${shortHash(matched)})`);
   for (const file of matched) {
-    console.error(`- ${file}`);
+    const isExtra = EXTRA_SENSITIVE_PATHS.includes(file) && !workflowPaths.includes(file);
+    console.error(`- ${file}${isExtra ? ' (release-driver only, no platform CI trigger)' : ''}`);
+  }
+  if (workflowMatched.length === 0) {
+    console.error('[release-evidence-required] all changed files are release-driver extras, not installer surface');
+    console.error('[release-evidence-required] platform CI is not required for these changes');
+    process.exit(3);
   }
   process.exit(1);
 }
@@ -385,6 +400,28 @@ if (changed.length > 30) {
 }
 
 if (!macosEvidence || !wslEvidence) {
+  // Option A from #355: accept CI postinstall-platform pass as equivalent evidence.
+  if (acceptCiEvidence) {
+    const headSha = requireGit(['rev-parse', 'HEAD'], 'resolve HEAD for CI evidence');
+    console.log(`[release-evidence-required] checking CI postinstall-platform for ${headSha.slice(0, 12)}...`);
+    const ciCheck = spawnSync('gh', [
+      'run', 'list',
+      '--workflow', 'postinstall-platform.yml',
+      '--commit', headSha,
+      '--event', 'push',
+      '--status', 'success',
+      '--limit', '1',
+      '--json', 'url',
+      '--jq', '.[0].url // ""',
+    ], { cwd: repoRoot, encoding: 'utf8', shell: false });
+    const ciUrl = (ciCheck.stdout || '').trim();
+    if (ciUrl) {
+      console.log(`[release-evidence-required] PASS CI postinstall-platform evidence: ${ciUrl}`);
+      process.exit(0);
+    }
+    console.error('[release-evidence-required] no successful postinstall-platform CI run found for this SHA');
+    console.error('Falling back to local evidence requirement.');
+  }
   console.error('[release-evidence-required] FAIL');
   console.error('Strict fresh-machine evidence is required before git push or npm publish.');
   console.error('Set both variables and rerun:');