devlyn-cli 4.3.3 → 4.3.4

package/bin/cleanup-history.json

@@ -1,5 +1,5 @@
 {
-  "source": "scripts/update-cleanup-history.js: LF-normalized Git blobs from first-parent config/agents-config/optional-skills history and all tags; excludes optional-addon hashes and third-party web-design-guidelines",
+  "source": "scripts/update-cleanup-history.js: LF-normalized Git blobs from first-parent config/agents-config/optional-skills history and release tags; excludes optional-addon hashes and third-party web-design-guidelines; commands: devlyn.*.md from config/commands, .claude/commands, commands and optional-commands/* in the same commits via skill-ownership.contentHash",
   "files": {
     ".claude/agents/evaluator.md": [
       "146a229b0218938bca2de6b426cda642ae9826dc2dfa8c3687c6fd5de9160cf6",
@@ -41,6 +41,81 @@
       "d5615e73af2401ea7418e02fc76d850506e59a64fff00f084ad272e474e138ba"
     ]
   },
+  "commands": {
+    "devlyn.clean.md": [
+      "918c6ae867c57a4d9748237adae0df8c78a1447c7c028a0af988b59a5fbb0d9a"
+    ],
+    "devlyn.design-system.md": [
+      "f81166b5ba08d9ee1f5cff33c911ea387e5cb50141a9712a96fc4434c60a673f"
+    ],
+    "devlyn.design-ui.md": [
+      "0496a6b2dd8c6bb0474b71ef9a319a6b95bb76972d0f07a01c33f8860fe83dfb",
+      "4e2aafcc0de6ce7f3022a353aaa9fb4330e76a50a91ab970b9b9a0f192f9f1f2"
+    ],
+    "devlyn.discover-product.md": [
+      "1e66aa35bf300ec6167e1b888f43a92ebd9e60d501397ff0334c9a7809d433f5",
+      "a609401d29cd2bdad7a48c7c8f096b442fe03a17c6b2c3151936c47b4a16e6c6"
+    ],
+    "devlyn.evaluate.md": [
+      "8f17ccc639d54adab24c49dcf471376bab97511675d00554056a4c1f67a14115"
+    ],
+    "devlyn.feature-spec.md": [
+      "d442ed7ae8d14a255c37f1b120b758f69794be88e2970a8a0c0e51519344b6c7"
+    ],
+    "devlyn.handoff.md": [
+      "91d143c6305e95e4af6992eda0d127e94a394c2e91a2d409b4d41ca03c23f470"
+    ],
+    "devlyn.implement-ui.md": [
+      "a8d0813781b2f7a3df5a4751c92755bf7c84c53428cf63cea34c965939b8c478"
+    ],
+    "devlyn.pencil-pull.md": [
+      "dfdd3d19ca676558bfa2bb3ce398181b0a081ab88d1feaf69c54c706a9671631"
+    ],
+    "devlyn.pencil-push.md": [
+      "5f2e8b29609cbb2af72941579823bec598265ebf29cd3a375d6aa47d95b74354"
+    ],
+    "devlyn.product-spec.md": [
+      "7a92d2df2586b44e2c4d9182eeb3d61f7adc2a13bed4d2cd26abcfe086585895"
+    ],
+    "devlyn.recommend-features.md": [
+      "2b92523017e1da10c299dafb19d84736de5084b5b46693de7fd2d6df51dc56b4"
+    ],
+    "devlyn.resolve.md": [
+      "24595766e1a81a1fcacb78261b03c3665bc686bcac8b1805d1c4db379584879f",
+      "48c0c3ee553f87f1f0733190effc7220c01c82837a5300ef68c9ffdf30c5d3a1",
+      "eaad5354cfc20ed378ffd2a2e1ca6bade1310bd2a47ab93e5942e9599c3ba9a8"
+    ],
+    "devlyn.review.md": [
+      "22f532f587f6d2fbf2662e38d5073b85a030141573f86d92ad40b9d292836fb7",
+      "3a511fc678e599ff4b4c37fd9191399a599e1ba9ea9c40fc4afcbe29cb188d2b",
+      "55888e08bf31ead1d359f218277cfa7efc3c6cb0f96fadc665d5a2406ff115d3",
+      "7f9ce1db4ffd3cdaf9fd949e4b07de04e0931c91cd846d4ab220ff6114a45b17"
+    ],
+    "devlyn.team-design-ui.md": [
+      "02485911588e9f52afb5a5082fd7804ee7a41bad44323960a2afe1a16a49d628"
+    ],
+    "devlyn.team-resolve.md": [
+      "09fc163d34dfe8906dd8d22501a028bfbbad639499acab01e5e60f06fc520382",
+      "54c52c3f27998998ed55cc648d071bbb10444761b819c59ed118b795596a4aee",
+      "72f66be3c4c27a46e76d56d13a0d381880c054a03243188f98da2faf6dc77295",
+      "8f11fa0c3203c0dd5bf09b5243dcff5968a36275682c54b3a012262fc545859a",
+      "ccfc5083813ee50d407109616ccbc2509aa7526316cebbf7a271537abdfff3b7"
+    ],
+    "devlyn.team-review.md": [
+      "58b36cfe2749968d697d486a104a1b139e4312730b0ac2933550634f6ece48db",
+      "7e5c2d93a23d51af7939dae29c70095dbd8a4a681cc06d4d578f2de29df346a3",
+      "c8e145955a303141af4082dae174e3b3f1681e4c9698e25ae337eadd31fb883b"
+    ],
+    "devlyn.team-ui.md": [
+      "d0b10b922b0936d8826a1bbcf62c0f9ea4cc3ed79e6d7c6af0116e134de73aad"
+    ],
+    "devlyn.ui.md": [
+      "3cb63dcbe3c455c97eca8b30057aefba8959936fce79c3d854adeb3c07ec8959"
+    ],
+    "devlyn.update-docs.md": [
+      "86945afccf24762a88d26eef3703fbf6c5a90a3343fd3de72a9cb26b6f62d3b5"
+    ]
+  },
   "skills": {
     "code-health-standards": [
       "962a82b5ebeafac515f81f5c68494c67dbf31c3e3e453f23c4452d4725e21355",

package/bin/devlyn.js

@@ -1347,7 +1347,7 @@ function showHelp() {
 // is read-only and lists each item with its proof. Apply plans again from what is on disk now and
 // acts only on items both plans name the same way, so a plan file can narrow a cleanup but never
 // widen it: untracked copies go in place, tracked ones through the project's delivery policy.
-// Nothing is removed by name alone except what the installer itself already removes.
+// Every removal needs shipped-content proof; names only identify candidates.
 // ---------------------------------------------------------------------------
 
 const CLEANUP_CORE = ['devlyn-ideate', 'devlyn-engines'];
@@ -1394,6 +1394,26 @@ function cleanupInUse(dir) {
   return cleanupProcesses === null || cleanupProcesses.some((line) => line.includes(dir + path.sep));
 }
 
+// Markers are generated, not bundled: require the exact writer format, a shipped version and
+// only fingerprints of shipped skills. Extra fields, arbitrary hashes and non-files stay untouched.
+function cleanupMarkerOwned(file, current) {
+  if (!fs.lstatSync(file)?.isFile()) return false;
+  const text = fs.readFileSync(file, 'utf8').replace(/\r\n/g, '\n');
+  let marker;
+  try { marker = JSON.parse(text); } catch (error) { if (error instanceof SyntaxError) return false; throw error; }
+  if (!marker || (marker.version !== PKG.version && !SKILL_HISTORY.versions.includes(marker.version))) return false;
+  // 2.10.1 to 4.2.0 wrote no skills field.
+  const [major, minor, patch] = marker.version.split('.').map(Number);
+  if (major < 4 || (major === 4 && (minor < 2 || (minor === 2 && patch === 0)))) {
+    return text === JSON.stringify({ schemaVersion: 1, package: PKG.name, version: marker.version }, null, 2) + '\n';
+  }
+  if (!marker.skills || typeof marker.skills !== 'object' || Array.isArray(marker.skills)) return false;
+  const entries = Object.entries(marker.skills);
+  if (!entries.length || entries.some(([name, hash]) => current[name] !== hash
+      && !(Object.hasOwn(SKILL_HISTORY.skills, name) && SKILL_HISTORY.skills[name].includes(hash)))) return false;
+  return text === JSON.stringify({ schemaVersion: 1, package: PKG.name, version: marker.version, skills: marker.skills }, null, 2) + '\n';
+}
+
 // The legacy items of one skill root, each with its proof and the base its parents are checked from.
 // `_shared` and the install marker go only when every copy beside them goes too: a kept, edited
 // devlyn-ideate needs both.
@@ -1412,6 +1432,7 @@ function cleanupSkillRoot(base, root, current) {
     for (const spelling of legacySkillPaths(root, old)) renamed.set(path.basename(spelling).toLowerCase(), current);
   }
   const deprecated = new Set([...deprecatedSkillPaths(root)].map((file) => path.basename(file).toLowerCase()));
+  const optional = new Set(OPTIONAL_ADDONS.map((addon) => addon.name.toLowerCase()));
   const support = [];
   let kept = 0;
   let marker = false;
@@ -1443,17 +1464,36 @@ function cleanupSkillRoot(base, root, current) {
     }
     if (renamed.has(lower)) {
       // An optional skill under its pre-4.0 name: the installer moves it to its new name; cleanup keeps it.
-      if (CLEANUP_CORE.includes(renamed.get(lower))) items.push({ kind: 'renamed-skill', path: file, base, action: 'remove', reasons: [] });
+      if (CLEANUP_CORE.includes(renamed.get(lower))) {
+        const proven = historicalSkill(file);
+        items.push({ kind: 'renamed-skill', path: file, base, action: proven ? 'remove' : 'skip',
+          reasons: proven ? [] : [cleanupReason('modified-copy')] });
+        if (!proven) kept++;
+      }
       else { items.push({ kind: 'renamed-skill', path: file, base, action: 'skip', reasons: [cleanupReason('optional-skill')] }); kept++; }
       continue;
     }
-    if (deprecated.has(lower)) { items.push({ kind: 'retired-skill', path: file, base, action: 'remove', reasons: [] }); continue; }
-    if (isShippedCopy(file, RETIRED_SKILL_MD_SHA256[lower])) items.push({ kind: 'retired-standard', path: file, base, action: 'remove', reasons: [] });
+    if (deprecated.has(lower)) {
+      const proven = historicalSkill(file);
+      items.push({ kind: 'retired-skill', path: file, base, action: proven ? 'remove' : 'skip',
+        reasons: proven ? [] : [cleanupReason('modified-copy')] });
+      if (!proven) kept++;
+      continue;
+    }
+    const proven = isShippedCopy(file, RETIRED_SKILL_MD_SHA256[lower]);
+    // Under a current optional add-on's name, other bytes are that add-on, installed by choice.
+    if (!proven && optional.has(lower)) continue;
+    items.push({ kind: 'retired-standard', path: file, base, action: proven ? 'remove' : 'skip',
+      reasons: proven ? [] : [cleanupReason('modified-copy')] });
+    if (!proven) kept++;
   }
   if (kept === 0) {
     items.push(...support);
     if (marker && items.some((item) => item.action === 'remove')) {
-      items.push({ kind: 'install-marker', path: path.join(root, DEVLYN_INSTALL_MARKER), base, action: 'remove', reasons: [] });
+      const file = path.join(root, DEVLYN_INSTALL_MARKER);
+      const proven = cleanupMarkerOwned(file, current);
+      items.push({ kind: 'install-marker', path: file, base, action: proven ? 'remove' : 'skip',
+        reasons: proven ? [] : [cleanupReason('modified-copy')] });
     }
   }
   if (cleanupInUse(root)) {
@@ -1468,7 +1508,12 @@ function cleanupCommands(base) {
   const names = new Set(DEPRECATED_FILES.map((file) => path.basename(file).toLowerCase()));
   return fs.readdirSync(commands).sort().filter((name) => names.has(name.toLowerCase())
     && fs.lstatSync(path.join(commands, name)).isFile())
-    .map((name) => ({ kind: 'legacy-command', path: path.join(commands, name), base, action: 'remove', reasons: [] }));
+    .map((name) => {
+      const file = path.join(commands, name);
+      const proven = CLEANUP_HISTORY.commands[name.toLowerCase()]?.includes(contentHash(file));
+      return { kind: 'legacy-command', path: file, base, action: proven ? 'remove' : 'skip',
+        reasons: proven ? [] : [cleanupReason('modified-copy')] };
+    });
 }
 
 function cleanupProjectFiles(base) {
@@ -1536,17 +1581,25 @@ function cleanupPython() {
 
 // The GitHub repository and base branch a project's tracked changes are delivered to, or null.
 function cleanupRemote(root) {
-  const url = cleanupGit(root, ['remote', 'get-url', 'origin']);
+  const { fail } = require('./release');
+  const query = (args, absent) => {
+    const result = cleanupGit(root, args);
+    if (result.error || (result.status !== 0 && result.status !== absent)) {
+      fail('repository-unreadable', { detail: result.error?.message || result.stderr.trim() });
+    }
+    return result;
+  };
+  const url = query(['remote', 'get-url', 'origin'], 2);
   if (url.status !== 0) return null;
   const match = url.stdout.trim().match(/github\.com[:/]([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/i);
   if (!match) return null;
-  const head = cleanupGit(root, ['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD']);
-  // origin/HEAD names the default; without it, the remote-tracking branch that exists. With neither
-  // fetched, `main`: an allocation against a missing base fails visibly, before any commit.
+  const head = query(['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD'], 1);
+  // With no default ref, the reviewed base is an existing main/master tracking branch or main.
+  // Delivery uses exactly this choice; completion refuses a base that is not the remote default.
   const base = head.status === 0 ? head.stdout.trim().replace(/^origin\//, '')
-    : ['main', 'master'].find((name) => cleanupGit(root, ['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${name}`]).status === 0)
+    : ['main', 'master'].find((name) => query(['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${name}`], 1).status === 0)
       || 'main';
-  return { repository: `${match[1]}/${match[2]}`, base, named: head.status === 0 };
+  return { repository: `${match[1]}/${match[2]}`, base };
 }
 
 // Whether a task is in flight on the installed copies: an allocated task's packet runs their exact
@@ -1569,6 +1622,31 @@ function cleanupSameFile(a, b) {
   return Boolean(x && y && x.dev === y.dev && x.ino === y.ino);
 }
 
+// Ownership is unknown if Git cannot read the work tree or index. Only an explicit non-repository
+// result or a successful empty index query permits local deletion, including machine/dotfiles roots.
+function cleanupTracked(file) {
+  const root = path.dirname(file);
+  const repo = cleanupGit(root, ['rev-parse', '--show-toplevel']);
+  if (!repo.error && repo.status === 128 && repo.stderr.includes('not a git repository')) return false;
+  if (repo.error || repo.status !== 0) throw new Error(repo.error?.message || repo.stderr.trim());
+  const files = cleanupGit(root, ['ls-files', '-z', '--', `:(icase,literal)${file}`]);
+  if (files.error || files.status !== 0) throw new Error(files.error?.message || files.stderr.trim());
+  return files.stdout.length > 0;
+}
+
+// A tracked copy remains in the caller's checkout even after PR delivery. Decide retention across
+// the whole root, before splitting routes; support in the delivery tree is considered separately.
+function cleanupRetainSupport(items) {
+  const remaining = new Set(items.filter((item) => !cleanupSupport(item)
+    && (item.action === 'skip' || item.route === 'delivery')).map((item) => path.dirname(item.path)));
+  for (const item of items) {
+    if (cleanupSupport(item) && item.route === 'local' && item.action !== 'skip' && remaining.has(path.dirname(item.path))) {
+      Object.assign(item, { action: 'skip', reasons: [cleanupReason('dependent-copy')] });
+    }
+  }
+  return items;
+}
+
 function cleanupProjectScope(project, current) {
   const { repositoryIdentity } = require('./harness-status');
   const { physicalRoot } = require('./release');
@@ -1588,7 +1666,9 @@ function cleanupProjectScope(project, current) {
   for (const item of items) {
     if (busy && item.action !== 'skip') Object.assign(item, { action: 'skip', reasons: [busy] });
     const relative = path.relative(base, item.path).split(path.sep).join('/');
-    const tracked = Boolean(identity && relative && cleanupGit(base, ['ls-files', '-z', '--', relative]).stdout.length > 0);
+    let tracked = false;
+    try { tracked = cleanupTracked(item.path); }
+    catch (error) { Object.assign(item, { action: 'skip', reasons: [cleanupReason('repository-unreadable', { detail: error.message })] }); }
     scope.items.push({ ...item, relative, route: tracked ? 'delivery' : 'local' });
   }
   if (!scope.remote) {
@@ -1596,6 +1676,7 @@ function cleanupProjectScope(project, current) {
       if (item.route === 'delivery' && item.action !== 'skip') Object.assign(item, { action: 'skip', reasons: [cleanupReason('no-remote')] });
     }
   }
+  cleanupRetainSupport(scope.items);
   return scope;
 }
 
@@ -1610,7 +1691,15 @@ function cleanupMachineScope(home, accountHomes, current) {
     items.push(...cleanupSkillRoot(base, root, current));
   }
   items.push(...cleanupCommands(home));
-  return { kind: 'machine', root: home, name: null, remote: null, items: items.map((item) => ({ ...item, relative: null, route: 'local' })) };
+  for (const item of items) {
+    try {
+      if (cleanupTracked(item.path)) Object.assign(item, { action: 'skip', reasons: [cleanupReason('tracked-copy')] });
+    } catch (error) {
+      Object.assign(item, { action: 'skip', reasons: [cleanupReason('repository-unreadable', { detail: error.message })] });
+    }
+    Object.assign(item, { relative: null, route: 'local' });
+  }
+  return { kind: 'machine', root: home, name: null, remote: null, items: cleanupRetainSupport(items) };
 }
 
 function cleanupScopes(inputs, current) {
@@ -1622,7 +1711,7 @@ function cleanupScopes(inputs, current) {
     try { scope = cleanupProjectScope(project, current); }
     catch (error) {
       scope = { kind: 'project', root: project, name: path.basename(project), remote: null, items: [{ kind: 'project', path: project, base: project,
-        relative: '', route: 'local', action: 'skip', reasons: [cleanupReason('project-unreadable', { detail: error.message })] }] };
+        relative: '', route: 'local', action: 'skip', reasons: [cleanupReason(error.reason?.code === 'repository-unreadable' ? 'repository-unreadable' : 'project-unreadable', { detail: error.message })] }] };
     }
     scopes.push({ id: `project:${sha256(Buffer.from(project)).slice(0, 12)}`, ...scope });
   }
@@ -1637,14 +1726,18 @@ function cleanupPlan(inputs) {
   return { ...plan, digest: cleanupDigest(plan) };
 }
 
-function cleanupDigest(plan) {
-  const { sha256 } = require('./release');
-  const canonical = (value) => Array.isArray(value) ? `[${value.map(canonical).join(',')}]`
+// JSON text with sorted keys: a plan the app stored with its own key order still reads the same.
+function cleanupCanonical(value) {
+  return Array.isArray(value) ? `[${value.map(cleanupCanonical).join(',')}]`
     : value && typeof value === 'object'
-      ? `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`
+      ? `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${cleanupCanonical(value[key])}`).join(',')}}`
       : JSON.stringify(value);
+}
+
+function cleanupDigest(plan) {
+  const { sha256 } = require('./release');
   const { digest, ...body } = plan;
-  return sha256(Buffer.from(canonical(body)));
+  return sha256(Buffer.from(cleanupCanonical(body)));
 }
 
 // Apply one item a fresh plan proves right now; returns a reason when it is not what was proven.
@@ -1695,6 +1788,11 @@ function cleanupLocal(scope, items) {
   const roots = [...new Set(items.map((item) => path.dirname(item.path)).filter((dir) => path.basename(dir) === 'skills'
     && fs.lstatSync(dir, { throwIfNoEntry: false })?.isDirectory()))];
   const act = (item) => {
+    try {
+      if (cleanupTracked(item.path)) { results.set(item.id, cleanupReason('tracked-copy')); return; }
+    } catch (error) {
+      results.set(item.id, cleanupReason('repository-unreadable', { detail: error.message })); return;
+    }
     try { results.set(item.id, cleanupApplyItem(item)); }
     catch (error) { results.set(item.id, cleanupReason('apply-failed', { detail: error.message })); }
   };
@@ -1729,36 +1827,54 @@ function cleanupDeliver(scope, items, current) {
   if (!python) return { error: cleanupReason('requirement-missing', { name: 'Python 3.11' }) };
   const run = (args, cwd) => spawnSync(python, ['-B', helper, ...args], { cwd, encoding: 'utf8', env: { ...process.env, PYTHONDONTWRITEBYTECODE: '1' } });
   const lastJson = (text) => { try { return JSON.parse(text.trim().split('\n').at(-1)); } catch { return null; } };
-  // Without origin/HEAD the base was a guess: GitHub names the default branch before anything is committed.
-  let base = scope.remote.base;
-  if (!scope.remote.named) {
-    const asked = spawnSync('gh', ['repo', 'view', scope.remote.repository, '--json', 'defaultBranchRef', '-q', '.defaultBranchRef.name'],
-      { encoding: 'utf8', timeout: 30000 });
-    if (asked.status === 0 && asked.stdout.trim()) base = asked.stdout.trim();
-  }
   const short = crypto.randomBytes(4).toString('hex');
   const branch = `devlyn/cleanup-${short}`;
   const worktree = path.join(path.dirname(scope.root), `${path.basename(scope.root)}.devlyn.noindex`, `devlyn-cleanup-${short}`);
   const allocated = lastJson(run(['allocate', '--repo', scope.root, '--task', `devlyn-cli ${PKG.version} legacy cleanup`,
     '--branch', branch, '--worktree', worktree, '--repository', scope.remote.repository,
-    '--remote', 'origin', '--base', base], scope.root).stdout);
+    '--remote', 'origin', '--base', scope.remote.base], scope.root).stdout);
   if (allocated?.status !== 'ALLOCATED') return { error: cleanupReason('delivery-failed', { detail: allocated?.reason || 'allocation failed' }) };
   const release = (error) => {
-    cleanupGit(scope.root, ['worktree', 'remove', '--force', worktree]);
-    cleanupGit(scope.root, ['branch', '-D', branch]);
-    try { fs.rmSync(path.dirname(allocated.receipt), { recursive: true, force: true }); } catch {}
+    for (const args of [['worktree', 'remove', '--force', worktree], ['branch', '-D', branch]]) {
+      const result = cleanupGit(scope.root, args);
+      if (result.error || result.status !== 0) return { error: cleanupReason(error.code, { ...error.params,
+        releaseError: result.error?.message || result.stderr.trim(), worktree, receipt: allocated.receipt }) };
+    }
+    fs.rmSync(path.dirname(allocated.receipt), { recursive: true, force: true });
     return { error };
   };
+  let prepared;
+  try { prepared = cleanupDeliveryCommit(worktree, items, current, release); }
+  catch (error) { return release(cleanupReason('apply-failed', { detail: error.message })); }
+  if (prepared.error) return prepared;
+  const completed = lastJson(run(['complete', '--receipt', allocated.receipt, '--acceptance', prepared.acceptance, '--writers-stopped'], scope.root).stdout);
+  const status = completed?.delivery_status || completed?.status;
+  if (status === 'COMPLETE' || status === 'MERGED') return { delivery: { state: 'merged', url: completed.pr || null } };
+  if (completed?.pr) return { delivery: { state: 'pr-open', url: completed.pr } };
+  const reason = completed?.reason || 'delivery did not complete';
+  const auth = /\b(authentication|unauthorized|gh auth login|could not read Username|HTTP 40[13])\b/i.test(reason);
+  return { error: cleanupReason(auth ? 'auth-failed' : 'delivery-failed', { detail: reason, ...(completed?.resume ? { resume: completed.resume } : {}) }) };
+}
+
+// Inside the allocated worktree: prove every reviewed item, remove them, commit, and write the
+// acceptance completion binds. A failure releases the worktree; so does a throw, in the caller.
+function cleanupDeliveryCommit(worktree, items, current, release) {
   const fresh = cleanupProjectScope(worktree, current);
-  const wanted = new Map(items.map((item) => [`${item.kind}\u0000${item.relative}`, item]));
+  const available = new Map(fresh.items.map((item) => [`${item.kind}\u0000${item.relative}`, item]));
+  const pairs = items.map((reviewed) => {
+    const fresh = available.get(`${reviewed.kind}\u0000${reviewed.relative}`);
+    return { reviewed, fresh, before: fresh && cleanupPreimage(fresh.path) };
+  });
+  const stale = pairs.filter(({ reviewed, fresh, before }) => !fresh || fresh.action !== reviewed.action || fresh.route !== 'delivery'
+    || before.type !== reviewed.before.type || before.sha256 !== reviewed.before.sha256);
+  // Check the entire batch before mutating even one item; the remote base cannot replace the reviewed preimage.
+  if (stale.length) return release(cleanupReason('stale-plan', { detail: stale.map(({ reviewed }) => reviewed.relative).join(', ') }));
   const applied = [];
-  for (const item of fresh.items) {
-    const key = `${item.kind}\u0000${item.relative}`;
-    if (item.action === 'skip' || item.route !== 'delivery' || !wanted.has(key)) continue;
-    if (cleanupApplyItem({ ...item, before: cleanupPreimage(item.path) }) === null) { applied.push(item.relative); wanted.delete(key); }
+  for (const { reviewed, fresh } of pairs) {
+    const error = cleanupApplyItem({ ...fresh, before: reviewed.before });
+    if (error) return release(cleanupReason(error.code, { ...error.params, detail: reviewed.relative }));
+    applied.push(fresh.relative);
   }
-  // A reviewed item the remote base does not hold as reviewed (not pushed, already gone) is not delivered.
-  if (wanted.size) return release(cleanupReason('stale-plan', { detail: [...wanted.values()].map((item) => item.relative).join(', ') }));
   for (const dir of ['.agents/skills', '.claude/skills']) {
     try { const full = path.join(worktree, dir); if (fs.readdirSync(full).length === 0) fs.rmdirSync(full); } catch {}
   }
@@ -1774,17 +1890,13 @@ function cleanupDeliver(scope, items, current) {
   try { left = JSON.parse(check.stdout.trim().split('\n').at(-1)).data.scopes[0].items.filter((item) => item.action !== 'skip' && applied.includes(item.relative)); }
   catch { return release(cleanupReason('delivery-failed', { detail: 'the check after cleanup could not run' })); }
   if (left.length) return release(cleanupReason('delivery-failed', { detail: 'items remain after cleanup' }));
+  const head = cleanupGit(worktree, ['rev-parse', 'HEAD']);
+  if (head.error || head.status !== 0) return release(cleanupReason('repository-unreadable', { detail: head.error?.message || head.stderr.trim() }));
   const acceptance = path.join(worktree, '.devlyn', 'acceptance.json');
   fs.writeFileSync(acceptance, JSON.stringify({ kind: 'direct', task: `devlyn-cli ${PKG.version} legacy cleanup`,
-    source_sha: cleanupGit(worktree, ['rev-parse', 'HEAD']).stdout.trim(),
+    source_sha: head.stdout.trim(),
     checks: [{ command: `devlyn cleanup --plan --project ${worktree} --json`, evidence: '.devlyn/cleanup-check.json' }] }));
-  const completed = lastJson(run(['complete', '--receipt', allocated.receipt, '--acceptance', acceptance, '--writers-stopped'], scope.root).stdout);
-  const status = completed?.delivery_status || completed?.status;
-  if (status === 'COMPLETE' || status === 'MERGED') return { delivery: { state: 'merged', url: completed.pr || null } };
-  if (completed?.pr) return { delivery: { state: 'pr-open', url: completed.pr } };
-  const reason = completed?.reason || 'delivery did not complete';
-  const auth = /\b(authentication|unauthorized|gh auth login|could not read Username|HTTP 40[13])\b/i.test(reason);
-  return { error: cleanupReason(auth ? 'auth-failed' : 'delivery-failed', { detail: reason, ...(completed?.resume ? { resume: completed.resume } : {}) }) };
+  return { acceptance };
 }
 
 function cleanupApply(plan, { events = false } = {}) {
@@ -1799,11 +1911,23 @@ function cleanupApply(plan, { events = false } = {}) {
     if (!pairs.length) { scopes.push({ ...progress, state: 'skipped' }); emit(scopes.at(-1)); continue; }
     emit(progress);
     try {
+      const observed = fresh.get(reviewed.id);
+      if (reviewed.kind !== observed?.kind
+          || (observed.kind === 'project' && cleanupCanonical(reviewed.remote) !== cleanupCanonical(observed.remote))) {
+        Object.assign(progress, { state: 'failed', error: cleanupReason('stale-plan', { detail: 'delivery identity changed' }) });
+        scopes.push(progress); emit(progress); continue;
+      }
       const refused = pairs.find((pair) => !pair.fresh);
-      const proven = pairs.filter((pair) => pair.fresh).map((pair) => pair.fresh);
+      // A reviewed copy refused now stays on disk, so the support beside it stays too.
+      const held = new Set(pairs.filter((pair) => !pair.fresh && !cleanupSupport(pair.reviewed))
+        .map((pair) => path.dirname(pair.reviewed.path)));
+      const proven = pairs.filter((pair) => pair.fresh && !(cleanupSupport(pair.fresh) && held.has(path.dirname(pair.fresh.path))))
+        .map((pair) => pair.fresh);
       const local = cleanupLocal(fresh.get(reviewed.id), proven.filter((item) => item.route === 'local'));
       const failedLocal = [...local.values()].find((reason) => reason);
-      const deliverable = proven.filter((item) => item.route === 'delivery');
+      // A local copy that could not go keeps the tracked support beside it, as cleanupLocal keeps local support.
+      const keptRoots = new Set(proven.filter((item) => item.route === 'local' && local.get(item.id)).map((item) => path.dirname(item.path)));
+      const deliverable = proven.filter((item) => item.route === 'delivery' && !(cleanupSupport(item) && keptRoots.has(path.dirname(item.path))));
       const delivery = deliverable.length ? cleanupDeliver(fresh.get(reviewed.id), deliverable, current) : null;
       progress.delivery = delivery?.delivery || null;
       const error = delivery?.error || failedLocal || (refused && cleanupReason('stale-plan'));

package/bin/skill-history.json

@@ -1,5 +1,5 @@
 {
-  "source": "skills: config/skills/* and optional-skills/* trees from every first-parent HEAD commit touching those paths and every local tag, derived by scripts/update-skill-history.js using bin/skill-ownership.js normalization (LF, install-path stamps, OS metadata and Python bytecode)",
+  "source": "skills: config/skills/* and optional-skills/* trees from every first-parent HEAD commit touching those paths and every release tag, derived by scripts/update-skill-history.js using bin/skill-ownership.js normalization (LF, install-path stamps, OS metadata and Python bytecode)",
   "skills": {
     "_shared": [
       "015eea12cc07cfb9eb318c30855f6deacb5bf43bd508a511dffd2e48c9d82964",
@@ -89,6 +89,7 @@
       "7403aa2911ac89180c4abe2c15e4037a8023af134e2fe70ed35ae1b14c92a04c",
       "74ad540635331051e8a32b6d7aa08c1926b9433298d1a1f699efe294b0c96d53",
       "74d650102836e72f0ab6cec05760ced6e2e047c62c1fe403837879e91d2e1cc4",
+      "75578439ec7edad038ff429071b7625f1bc1fc81cf6a715b3d4f2c05afa0e07e",
       "75cdbe50f909866a69cd7f7fa6ed104f471a6386e19fcf82e695c001edeafe13",
       "7a0f6c692bd1f74759d44f1a145899c157e1787635db546ea8a192461421e353",
       "7ca704d818bf9c044fed59fdd4107bd0463f9b0514d44729003e3e52aa796353",
@@ -635,5 +636,132 @@
       "711cd2633df2062104f12d50037a07a1012a90ab18c422cb5fdf665fcb9dc987",
       "d6a98c105a0d1952de90c39ca0734cb70cbdd116e6b4a4d45507d796bd2a9e88"
     ]
-  }
+  },
+  "versions": [
+    "0.2.1",
+    "0.3.0",
+    "0.4.0",
+    "0.5.0",
+    "0.5.1",
+    "0.5.2",
+    "0.5.3",
+    "0.5.4",
+    "0.5.5",
+    "0.5.7",
+    "0.5.8",
+    "0.6.0",
+    "0.7.0",
+    "0.7.1",
+    "0.7.2",
+    "1.0.0",
+    "1.0.1",
+    "1.1.0",
+    "1.1.1",
+    "1.1.2",
+    "1.10.0",
+    "1.11.0",
+    "1.12.0",
+    "1.12.1",
+    "1.12.2",
+    "1.12.3",
+    "1.12.4",
+    "1.12.5",
+    "1.13.0",
+    "1.14.0",
+    "1.15.0",
+    "1.2.0",
+    "1.2.1",
+    "1.3.0",
+    "1.3.1",
+    "1.3.2",
+    "1.4.0",
+    "1.5.0",
+    "1.5.1",
+    "1.5.2",
+    "1.5.3",
+    "1.5.4",
+    "1.6.0",
+    "1.7.0",
+    "1.7.1",
+    "1.7.2",
+    "1.7.3",
+    "1.8.0",
+    "1.8.1",
+    "1.9.0",
+    "1.9.1",
+    "2.0.0",
+    "2.1.0",
+    "2.10.0",
+    "2.10.1",
+    "2.2.0",
+    "2.2.1",
+    "2.2.2",
+    "2.3.0",
+    "2.3.1",
+    "2.3.2",
+    "2.4.0",
+    "2.4.1",
+    "2.5.0",
+    "2.5.1",
+    "2.5.2",
+    "2.5.3",
+    "2.5.4",
+    "2.5.5",
+    "2.5.6",
+    "2.5.7",
+    "2.6.0",
+    "2.6.1",
+    "2.7.0",
+    "2.8.0",
+    "2.8.1",
+    "2.9.0",
+    "2.9.1",
+    "2.9.2",
+    "2.9.3",
+    "3.0.0",
+    "3.0.1",
+    "3.1.0",
+    "3.1.1",
+    "3.1.2",
+    "3.1.3",
+    "3.2.0",
+    "3.2.1",
+    "3.3.0",
+    "3.3.1",
+    "4.0.0",
+    "4.0.1",
+    "4.1.0",
+    "4.2.0",
+    "4.2.1",
+    "4.2.10",
+    "4.2.11",
+    "4.2.12",
+    "4.2.13",
+    "4.2.14",
+    "4.2.15",
+    "4.2.16",
+    "4.2.17",
+    "4.2.18",
+    "4.2.19",
+    "4.2.2",
+    "4.2.20",
+    "4.2.21",
+    "4.2.22",
+    "4.2.23",
+    "4.2.24",
+    "4.2.25",
+    "4.2.26",
+    "4.2.3",
+    "4.2.4",
+    "4.2.5",
+    "4.2.6",
+    "4.2.7",
+    "4.2.8",
+    "4.2.9",
+    "4.3.0",
+    "4.3.1",
+    "4.3.2",
+    "4.3.3",
+    "4.3.4"
+  ]
 }

package/config/skills/_shared/harness-store.py

@@ -12,6 +12,7 @@ import json
 import os
 from pathlib import Path
 import re
+import runpy
 import subprocess
 import sys
 
@@ -54,7 +55,11 @@ def verify_release(root):
     root = Path(root)
     # As harness-status verifies it: an npm-installed package keeps npm's own .bin shims, which are checked.
     script = "const r=require(process.argv[1]);r.runJson(()=>r.verifyRelease(process.argv[2],{npmInstall:true}));"
-    result = subprocess.run(["node", "-e", script, str(root / "bin/release.js"), str(root)], capture_output=True, text=True, encoding="utf-8")
+    try:
+        node = runpy.run_path(str(Path(__file__).with_name("platform-support.py")))["managed_node"]() or "node"
+        result = subprocess.run([node, "-e", script, str(root / "bin/release.js"), str(root)], capture_output=True, text=True, encoding="utf-8")
+    except (OSError, ValueError) as exc:
+        raise HarnessError(f"release verifier could not start: {exc}") from exc
     require(result.returncode == 0, f"release verification failed: {root}: {result.stderr.strip()}")
     try:
         release = release_ref(json.loads(result.stdout)["data"]["release"])

package/config/skills/_shared/platform-support.py

@@ -15,6 +15,18 @@ import sys
 import time
 
 
+def managed_node():
+    """The Node that runs devlyn-cli's own scripts: the app's override is authoritative, and an invalid one never
+    falls back to PATH. Project and engine commands keep the session's own Node."""
+    value = os.environ.get("DEVLYN_NODE")
+    if value is None:
+        return None
+    node = Path(value)
+    if not node.is_absolute() or not node.is_file() or not os.access(node, os.X_OK):
+        raise OSError("DEVLYN_NODE must be an absolute path to an executable file")
+    return value
+
+
 def configure_utf8():
     for stream in (sys.stdin, sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):

package/native/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn",
-  "version": "4.3.3",
+  "version": "4.3.4",
   "description": "Devlyn harness skills",
   "skills": "./skills/"
 }

package/native/claude/skills/_shared/harness-store.py

@@ -12,6 +12,7 @@ import json
 import os
 from pathlib import Path
 import re
+import runpy
 import subprocess
 import sys
 
@@ -54,7 +55,11 @@ def verify_release(root):
     root = Path(root)
     # As harness-status verifies it: an npm-installed package keeps npm's own .bin shims, which are checked.
     script = "const r=require(process.argv[1]);r.runJson(()=>r.verifyRelease(process.argv[2],{npmInstall:true}));"
-    result = subprocess.run(["node", "-e", script, str(root / "bin/release.js"), str(root)], capture_output=True, text=True, encoding="utf-8")
+    try:
+        node = runpy.run_path(str(Path(__file__).with_name("platform-support.py")))["managed_node"]() or "node"
+        result = subprocess.run([node, "-e", script, str(root / "bin/release.js"), str(root)], capture_output=True, text=True, encoding="utf-8")
+    except (OSError, ValueError) as exc:
+        raise HarnessError(f"release verifier could not start: {exc}") from exc
     require(result.returncode == 0, f"release verification failed: {root}: {result.stderr.strip()}")
     try:
         release = release_ref(json.loads(result.stdout)["data"]["release"])

package/native/claude/skills/_shared/platform-support.py

@@ -15,6 +15,18 @@ import sys
 import time
 
 
+def managed_node():
+    """The Node that runs devlyn-cli's own scripts: the app's override is authoritative, and an invalid one never
+    falls back to PATH. Project and engine commands keep the session's own Node."""
+    value = os.environ.get("DEVLYN_NODE")
+    if value is None:
+        return None
+    node = Path(value)
+    if not node.is_absolute() or not node.is_file() or not os.access(node, os.X_OK):
+        raise OSError("DEVLYN_NODE must be an absolute path to an executable file")
+    return value
+
+
 def configure_utf8():
     for stream in (sys.stdin, sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):

package/native/codex/.agents/plugins/marketplace.json

@@ -1,5 +1,5 @@
 {
-  "name": "devlyn-harness-v4-3-3",
+  "name": "devlyn-harness-v4-3-4",
   "plugins": [
     {
       "name": "devlyn",

package/native/codex/plugins/devlyn/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn",
-  "version": "4.3.3",
+  "version": "4.3.4",
   "description": "Devlyn harness skills",
   "skills": "./skills/"
 }

package/native/codex/plugins/devlyn/skills/_shared/harness-store.py

@@ -12,6 +12,7 @@ import json
 import os
 from pathlib import Path
 import re
+import runpy
 import subprocess
 import sys
 
@@ -54,7 +55,11 @@ def verify_release(root):
     root = Path(root)
     # As harness-status verifies it: an npm-installed package keeps npm's own .bin shims, which are checked.
     script = "const r=require(process.argv[1]);r.runJson(()=>r.verifyRelease(process.argv[2],{npmInstall:true}));"
-    result = subprocess.run(["node", "-e", script, str(root / "bin/release.js"), str(root)], capture_output=True, text=True, encoding="utf-8")
+    try:
+        node = runpy.run_path(str(Path(__file__).with_name("platform-support.py")))["managed_node"]() or "node"
+        result = subprocess.run([node, "-e", script, str(root / "bin/release.js"), str(root)], capture_output=True, text=True, encoding="utf-8")
+    except (OSError, ValueError) as exc:
+        raise HarnessError(f"release verifier could not start: {exc}") from exc
     require(result.returncode == 0, f"release verification failed: {root}: {result.stderr.strip()}")
     try:
         release = release_ref(json.loads(result.stdout)["data"]["release"])

package/native/codex/plugins/devlyn/skills/_shared/platform-support.py

@@ -15,6 +15,18 @@ import sys
 import time
 
 
+def managed_node():
+    """The Node that runs devlyn-cli's own scripts: the app's override is authoritative, and an invalid one never
+    falls back to PATH. Project and engine commands keep the session's own Node."""
+    value = os.environ.get("DEVLYN_NODE")
+    if value is None:
+        return None
+    node = Path(value)
+    if not node.is_absolute() or not node.is_file() or not os.access(node, os.X_OK):
+        raise OSError("DEVLYN_NODE must be an absolute path to an executable file")
+    return value
+
+
 def configure_utf8():
     for stream in (sys.stdin, sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn-cli",
-  "version": "4.3.3",
+  "version": "4.3.4",
   "description": "Loop & harness engineering for AI coding agents (Claude Code, Codex, and any AGENTS.md-driven agent) — core engineering principles for CLAUDE.md/AGENTS.md and a loop designer that splits one intent into tasks agents drain hands-free",
   "homepage": "https://github.com/fysoul17/devlyn-cli#readme",
   "bin": {

package/release.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "devlyn-cli",
-  "version": "4.3.3",
+  "version": "4.3.4",
   "principles": {
     "defaults": "config/skills/_shared/runtime-principles.md",
     "memory": {
@@ -119,7 +119,7 @@
     },
     {
       "path": "bin/cleanup-history.json",
-      "sha256": "e2d6319a8a22be94188a8c004edeb596052da3b1fd441565b273416c82d49e2a",
+      "sha256": "d239acfc06c30a2c2de2210d79ebff630829d2d04f133267c7d91e1f8edd7b72",
       "executable": false
     },
     {
@@ -129,7 +129,7 @@
     },
     {
       "path": "bin/devlyn.js",
-      "sha256": "1b20470ea02060b2dae52192199f1ce0694cb1ed26dd45494485f6b75a9a1e1a",
+      "sha256": "8ba08fe52c9529dee1bf13498ab3237fc25830f7f7305337fd832f32d158be7e",
       "executable": true
     },
     {
@@ -164,7 +164,7 @@
     },
     {
       "path": "bin/skill-history.json",
-      "sha256": "17f3fc938be662c8a27e123df12390054cecee65e93de5c7157f772acf27adae",
+      "sha256": "714337eb0686097292fb464a053a7645bc1e44b15fa7c34077fd714d0ad4739e",
       "executable": false
     },
     {
@@ -219,7 +219,7 @@
     },
     {
       "path": "config/skills/_shared/harness-store.py",
-      "sha256": "9b8b9a8fba6d90df7cd02e3d7664520fb4536eee78bc26229ba2614ed618c894",
+      "sha256": "04505c53b0aa3006c700382cb444492d5a4f7c7c0780124dd229caa78eaaacfb",
       "executable": false
     },
     {
@@ -229,7 +229,7 @@
     },
     {
       "path": "config/skills/_shared/platform-support.py",
-      "sha256": "0e1a86dc02871744abec5aa0d0789e62f2aba4d6e8ee79b3001d4eb15e3be7f6",
+      "sha256": "419e9ddf2e11c8e770dca469e89b88c7f6e2c6941836482fb6072bfce49d14b8",
       "executable": false
     },
     {
@@ -309,7 +309,7 @@
     },
     {
       "path": "native/claude/.claude-plugin/plugin.json",
-      "sha256": "62873f1bc35e7badbe5f6669d19c01fc5f72a4120624e2b1560faad1b2e385d8",
+      "sha256": "c5925d81d5a6d26b54271f6d85b4856dfccd2333dfbe5c8bf3e7c60a288a25fd",
       "executable": false
     },
     {
@@ -359,7 +359,7 @@
     },
     {
       "path": "native/claude/skills/_shared/harness-store.py",
-      "sha256": "9b8b9a8fba6d90df7cd02e3d7664520fb4536eee78bc26229ba2614ed618c894",
+      "sha256": "04505c53b0aa3006c700382cb444492d5a4f7c7c0780124dd229caa78eaaacfb",
       "executable": false
     },
     {
@@ -369,7 +369,7 @@
     },
     {
       "path": "native/claude/skills/_shared/platform-support.py",
-      "sha256": "0e1a86dc02871744abec5aa0d0789e62f2aba4d6e8ee79b3001d4eb15e3be7f6",
+      "sha256": "419e9ddf2e11c8e770dca469e89b88c7f6e2c6941836482fb6072bfce49d14b8",
       "executable": false
     },
     {
@@ -439,12 +439,12 @@
     },
     {
       "path": "native/codex/.agents/plugins/marketplace.json",
-      "sha256": "d5250ae7c116d8a6f8cd6277f00b0fa14b78099cf7818d0635e5347d85fff360",
+      "sha256": "8b6d5165236fd2c0e6bdbe58b1f1b2659cf6852c268db8483f7a2e25f870002c",
       "executable": false
     },
     {
       "path": "native/codex/plugins/devlyn/.codex-plugin/plugin.json",
-      "sha256": "62873f1bc35e7badbe5f6669d19c01fc5f72a4120624e2b1560faad1b2e385d8",
+      "sha256": "c5925d81d5a6d26b54271f6d85b4856dfccd2333dfbe5c8bf3e7c60a288a25fd",
       "executable": false
     },
     {
@@ -494,7 +494,7 @@
     },
     {
       "path": "native/codex/plugins/devlyn/skills/_shared/harness-store.py",
-      "sha256": "9b8b9a8fba6d90df7cd02e3d7664520fb4536eee78bc26229ba2614ed618c894",
+      "sha256": "04505c53b0aa3006c700382cb444492d5a4f7c7c0780124dd229caa78eaaacfb",
       "executable": false
     },
     {
@@ -504,7 +504,7 @@
     },
     {
       "path": "native/codex/plugins/devlyn/skills/_shared/platform-support.py",
-      "sha256": "0e1a86dc02871744abec5aa0d0789e62f2aba4d6e8ee79b3001d4eb15e3be7f6",
+      "sha256": "419e9ddf2e11c8e770dca469e89b88c7f6e2c6941836482fb6072bfce49d14b8",
       "executable": false
     },
     {
@@ -1619,12 +1619,12 @@
     },
     {
       "path": "package.json",
-      "sha256": "3e212b7eb21db1ce909afbf38bb9f9375f31f7d135f1f9a354c80678d644f6a3",
+      "sha256": "c222c0658671710f90c77884f1582a860abf3e5f074ef8e5f485648ab17d6871",
       "executable": false
     }
   ],
   "digest": {
     "algorithm": "sha256",
-    "value": "18a02f41c27a19c5268d5b9f8ab82ed7f6fadb6531dadc382d679b1cffc33fc2"
+    "value": "dfb6e72ab508aa4e0a9929e812d8881c186689c37b08e6340eb40cf1865015af"
   }
 }