liteagents 3.5.0 → 3.6.0

package/CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [3.6.0] - 2026-09-05
+
+### Added
+- **`scripts/frontmatter.json` is frozen and date-stamped.** `mirror.cjs
+  shapes` now refuses to overwrite a recorded shape with a weaker one (a
+  required key demoted to optional, gone entirely, or a `Bash()` style
+  relaxed to `null`) — it reports `WEAKENING` instead of writing. `--force`
+  re-records it deliberately and updates the frozen date.
+- **`mirror.cjs check` detects orphaned kit files** — a file under a mirrored
+  tool directory with no corresponding source under `packages/claude`, left
+  behind when a capability moves or is removed.
+- **`/branch-review`'s review-record guard.** A recorded `last-review.md` is
+  now validated before being trusted: its `sha:` must resolve to a real
+  commit and be an ancestor of `HEAD`, and its `branch:` must match the
+  current branch. A record that fails either check — hand-edited, corrupted,
+  or left over from a merged, renamed, or rebased branch — is treated as no
+  record at all, falling through to a full review. Previously only the
+  `sha:` line was compared, so a stale record resolved to a commit range
+  that never existed.
+
+### Fixed
+- **`supported_variants` removed from all four `tools/*/manifest-template.json`.**
+  It advertised `["lite","standard","pro"]` in every installed `manifest.json`
+  when only one install exists, and nothing read the field.
+- **`tests/installer/package-manager.test.js` was never registered** in
+  `tests/run-all-tests.js`, so it had never run. Standalone it failed 22 of
+  44 tests against the removed three-variant installer, and wrote 11 fixtures
+  into `packages/` inside the repo. Rewritten against the single-variant
+  reality, every fixture now in an isolated temp directory, and registered.
+
+### Changed
+- Installer test coverage: 1103 → 1153 tests. `getAvailableContent`'s
+  deduplication — a capability shipping both `<name>.md` and a same-named
+  `<name>/` asset directory must be listed once — now has a regression suite
+  of its own.
+
 ## [3.5.0] - 2026-09-05
 
 ### Breaking

package/installer/package-manager.js

@@ -349,7 +349,9 @@ class PackageManager {
         }
       }
 
-      return { items: result, dirName: path.basename(dir) };
+      // A command with both a <name>.md file and a same-named <name>/
+      // subdirectory (bundled assets) would otherwise appear twice here.
+      return { items: [...new Set(result)], dirName: path.basename(dir) };
     };
 
     // Check for both plural and singular directory names

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "liteagents",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "description": "AI development toolkit with 10 specialized agents and 13 capabilities including live-canvas UI design with click-to-annotate feedback. Simple one-question installer for Claude, Opencode, Ampcode, and Droid.",
   "main": "index.js",
   "bin": {

package/packages/ampcode/skills/branch-review/SKILL.md

@@ -100,6 +100,20 @@ was actually read rather than assuming.
 you owe an answer on — take both from the file, never from the orchestrator's
 recollection, for the same reason `/release` does. Then:
 
+- **First, check the record belongs to this branch.** There is one record file
+  per repo, not one per branch. Validate `<that sha>` first with
+  `git rev-parse --verify <that sha>` — a value that fails this (e.g. a
+  corrupted or hand-edited record, or one starting with `-`, which git would
+  otherwise parse as an option) is a malformed record; treat it exactly as
+  **No file** below. If it validates, and its `branch:` line differs from the
+  current branch, or `git merge-base --is-ancestor <that sha> HEAD` exits
+  non-zero, the record describes a different or rewritten history — treat it
+  exactly as **No file** below and review the whole branch. Skipping this
+  resolves `<that sha>..HEAD` against a merged, renamed, or rebased sha, which
+  is not a subset of this branch but a range that never existed. Check both:
+  the branch name catches a switch, the ancestry check catches a rebase or
+  squash under the same name. Otherwise:
+
 - **`sha:` ≠ HEAD** → this is a re-review. Target the range
   `<that sha>..HEAD`. Stage 1 reads only the commits since, and stage 3
   re-verifies each recorded blocker as fixed, unfixed, or dismissed with a

package/packages/claude/skills/branch-review/SKILL.md

@@ -100,6 +100,20 @@ was actually read rather than assuming.
 you owe an answer on — take both from the file, never from the orchestrator's
 recollection, for the same reason `/release` does. Then:
 
+- **First, check the record belongs to this branch.** There is one record file
+  per repo, not one per branch. Validate `<that sha>` first with
+  `git rev-parse --verify <that sha>` — a value that fails this (e.g. a
+  corrupted or hand-edited record, or one starting with `-`, which git would
+  otherwise parse as an option) is a malformed record; treat it exactly as
+  **No file** below. If it validates, and its `branch:` line differs from the
+  current branch, or `git merge-base --is-ancestor <that sha> HEAD` exits
+  non-zero, the record describes a different or rewritten history — treat it
+  exactly as **No file** below and review the whole branch. Skipping this
+  resolves `<that sha>..HEAD` against a merged, renamed, or rebased sha, which
+  is not a subset of this branch but a range that never existed. Check both:
+  the branch name catches a switch, the ancestry check catches a rebase or
+  squash under the same name. Otherwise:
+
 - **`sha:` ≠ HEAD** → this is a re-review. Target the range
   `<that sha>..HEAD`. Stage 1 reads only the commits since, and stage 3
   re-verifies each recorded blocker as fixed, unfixed, or dismissed with a

package/packages/droid/commands/branch-review.md

@@ -97,6 +97,20 @@ was actually read rather than assuming.
 you owe an answer on — take both from the file, never from the orchestrator's
 recollection, for the same reason `/release` does. Then:
 
+- **First, check the record belongs to this branch.** There is one record file
+  per repo, not one per branch. Validate `<that sha>` first with
+  `git rev-parse --verify <that sha>` — a value that fails this (e.g. a
+  corrupted or hand-edited record, or one starting with `-`, which git would
+  otherwise parse as an option) is a malformed record; treat it exactly as
+  **No file** below. If it validates, and its `branch:` line differs from the
+  current branch, or `git merge-base --is-ancestor <that sha> HEAD` exits
+  non-zero, the record describes a different or rewritten history — treat it
+  exactly as **No file** below and review the whole branch. Skipping this
+  resolves `<that sha>..HEAD` against a merged, renamed, or rebased sha, which
+  is not a subset of this branch but a range that never existed. Check both:
+  the branch name catches a switch, the ancestry check catches a rebase or
+  squash under the same name. Otherwise:
+
 - **`sha:` ≠ HEAD** → this is a re-review. Target the range
   `<that sha>..HEAD`. Stage 1 reads only the commits since, and stage 3
   re-verifies each recorded blocker as fixed, unfixed, or dismissed with a

package/packages/opencode/command/branch-review.md

@@ -96,6 +96,20 @@ was actually read rather than assuming.
 you owe an answer on — take both from the file, never from the orchestrator's
 recollection, for the same reason `/release` does. Then:
 
+- **First, check the record belongs to this branch.** There is one record file
+  per repo, not one per branch. Validate `<that sha>` first with
+  `git rev-parse --verify <that sha>` — a value that fails this (e.g. a
+  corrupted or hand-edited record, or one starting with `-`, which git would
+  otherwise parse as an option) is a malformed record; treat it exactly as
+  **No file** below. If it validates, and its `branch:` line differs from the
+  current branch, or `git merge-base --is-ancestor <that sha> HEAD` exits
+  non-zero, the record describes a different or rewritten history — treat it
+  exactly as **No file** below and review the whole branch. Skipping this
+  resolves `<that sha>..HEAD` against a merged, renamed, or rebased sha, which
+  is not a subset of this branch but a range that never existed. Check both:
+  the branch name catches a switch, the ancestry check catches a rebase or
+  squash under the same name. Otherwise:
+
 - **`sha:` ≠ HEAD** → this is a re-review. Target the range
   `<that sha>..HEAD`. Stage 1 reads only the commits since, and stage 3
   re-verifies each recorded blocker as fixed, unfixed, or dismissed with a

package/tools/ampcode/manifest-template.json

@@ -6,7 +6,6 @@
   "optimization": "amplified-codegen",
   "integration_type": "cli",
   "manifest_format": "ampcode-config",
-  "supported_variants": ["lite", "standard", "pro"],
   "agent_format": "amplified-optimized",
   "skill_compatibility": "ampcode-native",
   "resource_format": "enhanced",

package/tools/claude/manifest-template.json

@@ -6,7 +6,6 @@
   "optimization": "conversational-ai",
   "integration_type": "plugin",
   "manifest_format": "claude-plugin",
-  "supported_variants": ["lite", "standard", "pro"],
   "agent_format": "claude-conversational",
   "skill_compatibility": "claude-native",
   "resource_format": "markdown",

package/tools/droid/manifest-template.json

@@ -6,7 +6,6 @@
   "optimization": "mobile-codegen",
   "integration_type": "cli",
   "manifest_format": "droid-config",
-  "supported_variants": ["lite", "standard", "pro"],
   "agent_format": "mobile-optimized",
   "skill_compatibility": "droid-native",
   "resource_format": "mobile-focused",

package/tools/opencode/manifest-template.json

@@ -6,7 +6,6 @@
   "optimization": "cli-codegen",
   "integration_type": "cli",
   "manifest_format": "opencode-config",
-  "supported_variants": ["lite", "standard", "pro"],
   "agent_format": "cli-optimized",
   "skill_compatibility": "cli-native",
   "resource_format": "terminal",