just-vibe 0.14.0 → 0.14.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.14.1
+
+- Update, inspect and remove Claude Code installations made by 0.12.0 or earlier. 0.14.0 checked the installed copy against workflow rules added in 0.13.0, so `update --target claude` and `doctor --target claude` stopped with "Command compare: procedure[5] promises a write". An installed copy is now read with shape checks only. Codex installations were not affected.
+
 ## 0.14.0
 
 0.13.0 was prepared but not published to npm. This release also contains its changes, listed under 0.13.0.

package/README.md

@@ -6,7 +6,7 @@ Engineering workflows and role profiles for coding agents, with remembered prefe
 
 Describe what you want normally. With supported, trusted host hooks, just-vibe suggests relevant workflows and directs the agent to load their methods and discover the tools it needs. Explicit corrections can refine later instructions. Current requests always take precedence, and saved preferences grant no permissions.
 
-**Source version: 0.14.0**, with language-server checks, structural rules, mutation evidence, sandboxed workers, a ready queue and in-host MCP review, and lower per-prompt and per-tool-call hook cost. It also contains the routing, workflow contract and profile revisions prepared for 0.13.0, which was not published separately. The catalog has 221 skill names, 218 canonical workflows, 113 engineering profiles and 22 packs. Check [npm](https://www.npmjs.com/package/just-vibe) for published versions and the [implementation and verification plan](https://github.com/Zachshotamartin/just-vibe/blob/main/docs/agent-qa-and-learning-plan.md) for acceptance evidence. A source build is not evidence of publication.
+**Source version: 0.14.1**, with language-server checks, structural rules, mutation evidence, sandboxed workers, a ready queue and in-host MCP review, and lower per-prompt and per-tool-call hook cost. It also contains the routing, workflow contract and profile revisions prepared for 0.13.0, which was not published separately. The catalog has 221 skill names, 218 canonical workflows, 113 engineering profiles and 22 packs. Check [npm](https://www.npmjs.com/package/just-vibe) for published versions and the [implementation and verification plan](https://github.com/Zachshotamartin/just-vibe/blob/main/docs/agent-qa-and-learning-plan.md) for acceptance evidence. A source build is not evidence of publication.
 
 ## Install
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "just-vibe",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Engineering workflows and role profiles for coding agents.",
   "homepage": "https://just-vibe-tools.vercel.app/",
   "type": "module",

package/plugins/just-vibe/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "just-vibe",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Engineering workflows and role profiles for coding agents.",
   "author": {
     "name": "Zachary Martin",

package/plugins/just-vibe/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "just-vibe",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Engineering workflows and role profiles for coding agents.",
   "author": {
     "name": "Zachary Martin",

package/plugins/just-vibe/scripts/lib/catalog.mjs

@@ -152,6 +152,22 @@ export function loadCatalog(root = pluginRoot) {
   return { ...catalog, packs: packs.packs, root };
 }
 
+// An installed copy was validated by the release that built it. Newer authoring rules must not
+// block reading it to update, inspect or remove that installation, so only the fields that name
+// files are checked.
+export function loadInstalledCatalog(root) {
+  const packs = JSON.parse(readFileSync(resolve(root, 'catalog/packs.json'), 'utf8'));
+  const source = JSON.parse(readFileSync(resolve(root, 'catalog/commands.json'), 'utf8'));
+  if (source.schemaVersion !== 1 || !Array.isArray(source.commands) || !Array.isArray(packs.packs)) throw new Error('Unsupported installed catalog.');
+  const ids = new Set();
+  for (const c of source.commands) {
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(c?.id) || ids.has(c.id) || typeof c.summary !== 'string'
+        || (!c.aliasOf && c.skillPath !== `skills/${c.id}/SKILL.md`)) throw new Error(`Invalid installed command: ${c?.id}`);
+    ids.add(c.id);
+  }
+  return { ...materializeAliases(source), packs: packs.packs, root };
+}
+
 export function getCommand(catalog, id, { canonical = false } = {}) {
   const name = commandName(id);
   let command = catalog.commands.find(c => c.id === name);

package/plugins/just-vibe/scripts/lib/claude-shortcuts.mjs

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
 import { resolve, join } from 'node:path';
 import { homedir } from 'node:os';
 import { managedFiles } from './managed-files.mjs';
-import { loadCatalog } from './catalog.mjs';
+import { loadCatalog, loadInstalledCatalog } from './catalog.mjs';
 import { DEFAULT_SELECTION, selectPayload } from './selection.mjs';
 import { within, readJson } from './storage.mjs';
 
@@ -40,7 +40,7 @@ export function claudeShortcuts(options, { source, operation, dryRun = false, ro
   // Read the actual staged selection when available, rather than exposing skills
   // which a core/frontend/ML installation intentionally excluded.
   const plugin = source && join(source, 'plugins/just-vibe');
-  let catalog = loadCatalog(plugin && existsSync(join(plugin, 'catalog/commands.json')) ? plugin : undefined), ids;
+  let catalog = plugin && existsSync(join(plugin, 'catalog/commands.json')) ? loadInstalledCatalog(plugin) : loadCatalog(), ids;
   if (dryRun && operation === 'install' && !options.local && !options.github
       && (options.command === 'update' || !plugin || !existsSync(join(plugin, 'catalog/commands.json')))) {
     // Preflight the future payload before the native host or managed bundle is