cohorte 1.2.3 → 1.2.4

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 Entries are shown by `/update-pipeline` ("What's new") after a core refresh. Keep them short,
 user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` section per release.
 
+## 1.2.4 — 2026-07-29
+
+> **If you installed with `npx cohorte`, this is the release that makes 1.2.3 actually
+> reach you.** Re-run `npx cohorte@latest update --global` (or `update` for a bundled core).
+
+- **`npx cohorte install/update` shipped a core missing two scripts.** `bin/cli.js` — the
+  port of `install.sh` that `npx` actually runs — copied only `scripts/*.template`, never
+  `kanban-move.sh` or `telemetry-send.sh`. Since every caller chains them with `|| true`,
+  the result was silent on every npx-installed machine: no kanban card moves, no telemetry
+  pings, no error anywhere. The shell installers named both files explicitly and this port
+  drifted from them. It now copies by a rule that needs no list to keep in sync.
+- The same port never copied `CHANGELOG.md` into the core either, so `/doctor` and
+  `/update-pipeline`'s "What's new" had nothing to read on npx installs. Fixed.
+- CI now dry-runs `bin/cli.js` into a scratch dir and asserts the same postconditions as
+  the `install.sh` dry-run. 1.2.3's guard only grepped the two shell installers — it would
+  have passed this bug, because the port copies by rule rather than by name.
+
 ## 1.2.3 — 2026-07-29
 
 - **Telemetry now covers the whole funnel.** Only `/build` was actually pinging; `/smoke`,

package/bin/cli.js

@@ -102,13 +102,31 @@ function copyCore() {
   for (const f of ['PIPELINE.template.md', 'SCHEMA.md', 'cohorte.config.template.yaml']) {
     fs.copyFileSync(path.join(src, 'profile', f), path.join(pipelineDir, f));
   }
-  for (const f of fs.readdirSync(path.join(src, 'scripts'))) {
-    if (f.endsWith('.template')) {
-      fs.copyFileSync(path.join(src, 'scripts', f), path.join(pipelineDir, 'scripts', f));
+  // Copy the *.template files AND the shipped executables (kanban-move.sh,
+  // telemetry-send.sh). Until 1.2.4 this loop took only `.template`, so every
+  // `npx cohorte install/update` produced a core missing both scripts — and since
+  // every caller chains them with `|| true`, the result was silent: no kanban card
+  // moves, no telemetry pings, no error. The shell installers named them explicitly
+  // and this port drifted. The rule below needs no list to keep in sync: a `<x>.sh`
+  // with an `<x>.sh.template` sibling is rendered per-project by /init-pipeline, so
+  // only the template ships; every other `.sh` is a shipped executable.
+  const scriptFiles = fs.readdirSync(path.join(src, 'scripts'));
+  for (const f of scriptFiles) {
+    const isTemplate = f.endsWith('.template');
+    const isShipped = f.endsWith('.sh') && !scriptFiles.includes(`${f}.template`);
+    if (!isTemplate && !isShipped) continue;
+    const target = path.join(pipelineDir, 'scripts', f);
+    fs.copyFileSync(path.join(src, 'scripts', f), target);
+    if (isShipped && process.platform !== 'win32') {
+      try { fs.chmodSync(target, 0o755); } catch { /* optional */ }
     }
   }
   fs.copyFileSync(path.join(src, 'core', 'agents', 'implementer.template.md'),
                   path.join(pipelineDir, 'implementer.template.md'));
+  // /doctor reads this to tell the human what they're missing; the shell installers
+  // have always copied it, this port never did.
+  const changelog = path.join(src, 'CHANGELOG.md');
+  if (fs.existsSync(changelog)) fs.copyFileSync(changelog, path.join(pipelineDir, 'CHANGELOG.md'));
   fs.writeFileSync(path.join(pipelineDir, 'VERSION'), VERSION + '\n');
   if (process.platform !== 'win32') {
     try { fs.chmodSync(path.join(dest, 'hooks', 'gate.py'), 0o755); } catch { /* optional */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cohorte",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code — install the core, run /init-pipeline, and it adapts to your project's stack.",
   "bin": {
     "cohorte": "bin/cli.js"

package/scripts/validate-core.mjs

@@ -130,9 +130,13 @@ for (const f of readdirSync(join(root, "core/commands"))) {
 }
 
 // ── shipped scripts ─────────────────────────────────────────────────────────
-// Every scripts/*.sh must be copied by BOTH installers. Callers chain these with
-// `|| true`, so one the installer forgets is a silent no-op forever — no kanban
+// Every scripts/*.sh must be copied by BOTH shell installers. Callers chain these
+// with `|| true`, so one an installer forgets is a silent no-op forever — no kanban
 // card moves, no telemetry ping, no error. CI is the only place this is loud.
+// The third installer, bin/cli.js (what `npx cohorte` runs), copies by rule rather
+// than by name, so grepping for filenames can't see it — ci.yml dry-runs it into a
+// scratch HOME and asserts the same postconditions instead. Both are needed: this
+// check catches a forgotten name, that one catches a drifted rule.
 // A `<name>.sh` with a `<name>.sh.template` sibling is a locally-rendered artifact
 // (this repo dogfoods its own /init-pipeline), not a core asset — skip those.
 const installers = { "install.sh": read("install.sh"), "install.ps1": read("install.ps1") };