cohorte 1.2.3 → 1.2.5

package/CHANGELOG.md

@@ -3,6 +3,32 @@
 Entries are shown by `/update-pipeline` ("What's new") after a core refresh. Keep them short,
 user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` section per release.
 
+## 1.2.5 — 2026-07-29
+
+- **`.claude/pipeline.json`'s `core_version` never updated on global installs.** The installer
+  bumps it in bundled mode, but a global core is shared — it cannot know which repos point at
+  it, so nothing bumped the field and it drifted forever. Repos running a current core were
+  still claiming `1.0.0`. `/update-pipeline` now syncs the pointer in both modes.
+- `/doctor` no longer reports that drift as a broken install: a global-mode pointer lagging the
+  VERSION file is ⚠️ with the one-command fix, not ❌. The core was never the problem.
+
+## 1.2.4 — 2026-07-29
+
+> **If you installed with `npx cohorte`, this is the release that makes 1.2.3 actually
+> reach you.** Re-run `npx cohorte@latest update --global` (or `update` for a bundled core).
+
+- **`npx cohorte install/update` shipped a core missing two scripts.** `bin/cli.js` — the
+  port of `install.sh` that `npx` actually runs — copied only `scripts/*.template`, never
+  `kanban-move.sh` or `telemetry-send.sh`. Since every caller chains them with `|| true`,
+  the result was silent on every npx-installed machine: no kanban card moves, no telemetry
+  pings, no error anywhere. The shell installers named both files explicitly and this port
+  drifted from them. It now copies by a rule that needs no list to keep in sync.
+- The same port never copied `CHANGELOG.md` into the core either, so `/doctor` and
+  `/update-pipeline`'s "What's new" had nothing to read on npx installs. Fixed.
+- CI now dry-runs `bin/cli.js` into a scratch dir and asserts the same postconditions as
+  the `install.sh` dry-run. 1.2.3's guard only grepped the two shell installers — it would
+  have passed this bug, because the port copies by rule rather than by name.
+
 ## 1.2.3 — 2026-07-29
 
 - **Telemetry now covers the whole funnel.** Only `/build` was actually pinging; `/smoke`,

package/bin/cli.js

@@ -102,13 +102,31 @@ function copyCore() {
   for (const f of ['PIPELINE.template.md', 'SCHEMA.md', 'cohorte.config.template.yaml']) {
     fs.copyFileSync(path.join(src, 'profile', f), path.join(pipelineDir, f));
   }
-  for (const f of fs.readdirSync(path.join(src, 'scripts'))) {
-    if (f.endsWith('.template')) {
-      fs.copyFileSync(path.join(src, 'scripts', f), path.join(pipelineDir, 'scripts', f));
+  // Copy the *.template files AND the shipped executables (kanban-move.sh,
+  // telemetry-send.sh). Until 1.2.4 this loop took only `.template`, so every
+  // `npx cohorte install/update` produced a core missing both scripts — and since
+  // every caller chains them with `|| true`, the result was silent: no kanban card
+  // moves, no telemetry pings, no error. The shell installers named them explicitly
+  // and this port drifted. The rule below needs no list to keep in sync: a `<x>.sh`
+  // with an `<x>.sh.template` sibling is rendered per-project by /init-pipeline, so
+  // only the template ships; every other `.sh` is a shipped executable.
+  const scriptFiles = fs.readdirSync(path.join(src, 'scripts'));
+  for (const f of scriptFiles) {
+    const isTemplate = f.endsWith('.template');
+    const isShipped = f.endsWith('.sh') && !scriptFiles.includes(`${f}.template`);
+    if (!isTemplate && !isShipped) continue;
+    const target = path.join(pipelineDir, 'scripts', f);
+    fs.copyFileSync(path.join(src, 'scripts', f), target);
+    if (isShipped && process.platform !== 'win32') {
+      try { fs.chmodSync(target, 0o755); } catch { /* optional */ }
     }
   }
   fs.copyFileSync(path.join(src, 'core', 'agents', 'implementer.template.md'),
                   path.join(pipelineDir, 'implementer.template.md'));
+  // /doctor reads this to tell the human what they're missing; the shell installers
+  // have always copied it, this port never did.
+  const changelog = path.join(src, 'CHANGELOG.md');
+  if (fs.existsSync(changelog)) fs.copyFileSync(changelog, path.join(pipelineDir, 'CHANGELOG.md'));
   fs.writeFileSync(path.join(pipelineDir, 'VERSION'), VERSION + '\n');
   if (process.platform !== 'win32') {
     try { fs.chmodSync(path.join(dest, 'hooks', 'gate.py'), 0o755); } catch { /* optional */ }

package/core/commands/doctor.md

@@ -14,8 +14,10 @@ fix only with the human's go-ahead (or hand them the command).
 
 1. **Core & pointer.** A core exists (`~/.claude/pipeline/VERSION` global, and/or
    `.claude/pipeline/VERSION` bundled); `.claude/pipeline.json` names a mode + `core_version`
-   coherent with the VERSION file. Compare against `npm view cohorte version` — behind ⇒
-   suggest `/update-pipeline`. Read `pipeline/CHANGELOG.md` for what they're missing. The router
+   coherent with the VERSION file. A **global**-mode pointer lagging the VERSION file is ⚠️, not ❌:
+   nothing bumped that field before 1.2.5, so the core itself is fine and only the pointer is stale
+   ⇒ fix by running `/update-pipeline` (§3 syncs it now), or by editing the one field. Compare
+   against `npm view cohorte version` — behind ⇒ suggest `/update-pipeline`. Read `pipeline/CHANGELOG.md` for what they're missing. The router
    commands' step files are present — `templates/steps/init-pipeline/` non-empty (a router whose
    `templates/steps/<cmd>/` dir is missing is a partial/stale install ⇒
    re-run install/update). **Shipped scripts present and executable** in `<core>/pipeline/scripts/`:

package/core/commands/update-pipeline.md

@@ -51,7 +51,14 @@ the human's choices — so `/init-pipeline` never needs re-running for an upgrad
 ## 3. Report old → new
 
 Re-read the VERSION file(s) and print `old → new`. If unchanged, say the core was already up to date.
-For a bundled repo, note that `.claude/pipeline.json`'s `core_version` was bumped and should be committed.
+
+**Sync the pointer — in BOTH modes.** If this repo has a `.claude/pipeline.json` whose `core_version`
+differs from the core you just installed, rewrite that one field (leave every other field untouched)
+and tell the human to commit it. In **bundled** mode the installer already did it; in **global** mode
+**nothing does** — the installer refreshes one shared core and cannot know which repos point at it,
+so before 1.2.5 the field simply drifted forever (a repo on a current core still claiming `1.0.0`).
+`/doctor` check 1 requires the pointer to be coherent with the VERSION file, so a drifted field reads
+as a broken install when nothing is broken.
 
 Then print **What's new**: read the installed `<core>/pipeline/CHANGELOG.md` and show the entries
 between the old and new versions (most recent first). File absent ⇒ the old core predates 0.1.14 —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cohorte",
-  "version": "1.2.3",
+  "version": "1.2.5",
   "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code — install the core, run /init-pipeline, and it adapts to your project's stack.",
   "bin": {
     "cohorte": "bin/cli.js"

package/scripts/validate-core.mjs

@@ -130,9 +130,13 @@ for (const f of readdirSync(join(root, "core/commands"))) {
 }
 
 // ── shipped scripts ─────────────────────────────────────────────────────────
-// Every scripts/*.sh must be copied by BOTH installers. Callers chain these with
-// `|| true`, so one the installer forgets is a silent no-op forever — no kanban
+// Every scripts/*.sh must be copied by BOTH shell installers. Callers chain these
+// with `|| true`, so one an installer forgets is a silent no-op forever — no kanban
 // card moves, no telemetry ping, no error. CI is the only place this is loud.
+// The third installer, bin/cli.js (what `npx cohorte` runs), copies by rule rather
+// than by name, so grepping for filenames can't see it — ci.yml dry-runs it into a
+// scratch HOME and asserts the same postconditions instead. Both are needed: this
+// check catches a forgotten name, that one catches a drifted rule.
 // A `<name>.sh` with a `<name>.sh.template` sibling is a locally-rendered artifact
 // (this repo dogfoods its own /init-pipeline), not a core asset — skip those.
 const installers = { "install.sh": read("install.sh"), "install.ps1": read("install.ps1") };