contract-driven-delivery 2.0.15 → 2.0.16

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [2.0.16] - 2026-05-06
+
+New-change scaffold hardening so freshly opened proposals use the installed
+kit version even when an existing project has stale templates on disk.
+
+### Changed
+
+- **`cdd-kit new` stamps `tasks.yml` with the real change id**: new changes no
+  longer start with the `<change-id>` placeholder in the machine-validated task
+  metadata.
+
+### Fixed
+
+- **Fresh proposals ignore stale project templates**: regression coverage now
+  locks `cdd-kit new` to bundled package templates, so old
+  `specs/templates/*` files in a user repo cannot leak into a newly created
+  change.
+- **Postinstall sync coverage includes workflow skills**: regression coverage
+  now verifies npm postinstall updates standalone skills such as `/cdd-new`,
+  keeping agent-log instructions aligned with the installed gate.
+
 ## [2.0.15] - 2026-05-06
 
 Prompt guidance patch for agent-log evidence and closeout learning ownership.

package/dist/cli/index.js

@@ -8678,7 +8678,7 @@ __export(migrate_exports, {
 });
 import { join as join18 } from "path";
 import { cpSync as cpSync2, existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync8, readFileSync as readFileSync18, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync8 } from "fs";
-import yaml3 from "js-yaml";
+import yaml2 from "js-yaml";
 function backupChangeDir(cwd, changeId, sessionStamp) {
   const backupRoot = join18(cwd, ".cdd", "migrate-backup", sessionStamp);
   const backupDir2 = join18(backupRoot, changeId);
@@ -8854,7 +8854,7 @@ function migrateTasksFile(changeId, changeDir, enableContextGovernance, detected
       out["section"] = r.section;
     return out;
   });
-  const yamlOut = yaml3.dump(data, { lineWidth: -1, noRefs: true });
+  const yamlOut = yaml2.dump(data, { lineWidth: -1, noRefs: true });
   pendingWrites.push({ path: newPath, content: yamlOut });
   pendingDeletes.push({ path: legacyPath });
   changed.push(`tasks.md -> tasks.yml (${tasksRows.length} task(s) migrated)`);
@@ -8922,7 +8922,7 @@ function migrateAgentLogs(changeDir, changed, pendingWrites, pendingDeletes) {
       continue;
     const raw = readFileSync18(fullPath, "utf8");
     const parsed = parseLegacyAgentLog(raw);
-    const yamlOut = yaml3.dump(parsed, { lineWidth: -1, noRefs: true });
+    const yamlOut = yaml2.dump(parsed, { lineWidth: -1, noRefs: true });
     pendingWrites.push({ path: yamlFull, content: yamlOut });
     pendingDeletes.push({ path: fullPath });
     changed.push(`agent-log/${f} -> agent-log/${yamlName}`);
@@ -10146,7 +10146,7 @@ __export(archive_exports, {
 });
 import { join as join23 } from "path";
 import { existsSync as existsSync19, mkdirSync as mkdirSync10, renameSync as renameSync2, readFileSync as readFileSync23, writeFileSync as writeFileSync11, appendFileSync, cpSync as cpSync3, rmSync as rmSync3 } from "fs";
-import yaml4 from "js-yaml";
+import yaml3 from "js-yaml";
 async function archive(changeId) {
   const cwd = process.cwd();
   const changeDir = join23(cwd, "specs", "changes", changeId);
@@ -10166,7 +10166,7 @@ async function archive(changeId) {
   if (existsSync19(tasksPath)) {
     try {
       const raw = readFileSync23(tasksPath, "utf8");
-      const data = yaml4.load(raw);
+      const data = yaml3.load(raw);
       if (data?.status === "gate-blocked") {
         log.warn("tasks.yml has status: gate-blocked \u2014 archiving anyway (change was paused).");
       }
@@ -10222,7 +10222,7 @@ __export(abandon_exports, {
 });
 import { join as join24 } from "path";
 import { existsSync as existsSync20, readFileSync as readFileSync24, writeFileSync as writeFileSync12, appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
-import yaml5 from "js-yaml";
+import yaml4 from "js-yaml";
 async function abandon(changeId, opts) {
   const cwd = process.cwd();
   const changeDir = join24(cwd, "specs", "changes", changeId);
@@ -10233,12 +10233,12 @@ async function abandon(changeId, opts) {
   }
   if (existsSync20(tasksPath)) {
     const raw = readFileSync24(tasksPath, "utf8");
-    const data = yaml5.load(raw) ?? {};
+    const data = yaml4.load(raw) ?? {};
     data["status"] = "abandoned";
     if (!data["change-id"]) {
       data["change-id"] = changeId;
     }
-    writeFileSync12(tasksPath, yaml5.dump(data, { lineWidth: -1, noRefs: true }), "utf8");
+    writeFileSync12(tasksPath, yaml4.dump(data, { lineWidth: -1, noRefs: true }), "utf8");
   }
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const archiveDir = join24(cwd, "specs", "archive");
@@ -10276,7 +10276,7 @@ __export(list_changes_exports, {
 });
 import { join as join25 } from "path";
 import { existsSync as existsSync21, readdirSync as readdirSync13, readFileSync as readFileSync25 } from "fs";
-import yaml6 from "js-yaml";
+import yaml5 from "js-yaml";
 async function listChanges() {
   const cwd = process.cwd();
   const changesDir = join25(cwd, "specs", "changes");
@@ -10296,7 +10296,7 @@ async function listChanges() {
       if (existsSync21(tasksPath)) {
         try {
           const raw = readFileSync25(tasksPath, "utf8");
-          const data = yaml6.load(raw);
+          const data = yaml5.load(raw);
           if (data?.status)
             status = data.status;
           pending = (data?.tasks ?? []).filter((t) => t.status === "pending").length;
@@ -11104,7 +11104,6 @@ init_paths();
 import { join as join9, relative as relative3 } from "path";
 import { createHash as createHash4 } from "crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync8, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "fs";
-import yaml from "js-yaml";
 init_logger();
 init_context_scan();
 init_digest();
@@ -11173,6 +11172,20 @@ function parseDependsOn(raw) {
     return [];
   return raw.split(",").map((item) => item.trim()).filter(Boolean);
 }
+function applyScaffoldMetadata(tasksPath, changeId, dependencies) {
+  if (!existsSync8(tasksPath))
+    return;
+  let raw = readFileSync8(tasksPath, "utf8");
+  raw = raw.replace(/^change-id:\s*<change-id>\s*$/m, `change-id: ${changeId}`);
+  if (dependencies.length > 0) {
+    const dependsOn = [
+      "depends-on:",
+      ...dependencies.map((dep) => `  - ${JSON.stringify(dep)}`)
+    ].join("\n");
+    raw = raw.replace(/^depends-on:\s*\[\]\s*$/m, dependsOn);
+  }
+  writeFileSync4(tasksPath, raw, "utf8");
+}
 async function newChange(name, opts) {
   if (!SAFE_NAME.test(name)) {
     log.error(`Invalid change name: "${name}". Use letters, numbers, hyphens, or underscores (max 64 chars).`);
@@ -11220,15 +11233,10 @@ async function newChange(name, opts) {
     log.dim(tmpl);
     written += 1;
   }
+  const tasksPath = join9(changeDir, "tasks.yml");
+  applyScaffoldMetadata(tasksPath, name, dependencies);
   if (dependencies.length > 0) {
-    const tasksPath = join9(changeDir, "tasks.yml");
-    if (existsSync8(tasksPath)) {
-      const raw = readFileSync8(tasksPath, "utf8");
-      const data = yaml.load(raw) ?? {};
-      data["depends-on"] = dependencies;
-      writeFileSync4(tasksPath, yaml.dump(data, { lineWidth: -1, noRefs: true }), "utf8");
-      log.dim(`depends-on: ${dependencies.join(", ")}`);
-    }
+    log.dim(`depends-on: ${dependencies.join(", ")}`);
   }
   log.blank();
   log.ok(`${written} template(s) created in specs/changes/${name}`);
@@ -11330,7 +11338,7 @@ init_logger();
 import { existsSync as existsSync13, readFileSync as readFileSync16, readdirSync as readdirSync7 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join16 } from "path";
-import yaml2 from "js-yaml";
+import yaml from "js-yaml";
 import picomatch2 from "picomatch";
 
 // src/schemas/agent-log.schema.ts
@@ -11571,7 +11579,7 @@ function loadContextPolicy(cwd) {
 function loadYamlFile(path) {
   try {
     const raw = readFileSync16(path, "utf8");
-    return { data: yaml2.load(raw, { schema: yaml2.JSON_SCHEMA }), parseError: null };
+    return { data: yaml.load(raw, { schema: yaml.JSON_SCHEMA }), parseError: null };
   } catch (err) {
     return { data: null, parseError: err.message };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "contract-driven-delivery",
-  "version": "2.0.15",
+  "version": "2.0.16",
   "description": "Contract-driven delivery kit for AI coding agents with deterministic context indexes, manifest-backed read-scope governance, and orchestrated contracts-first delivery.",
   "keywords": [
     "contract-driven",