nobrainer-tech-flow 2.4.0 → 2.4.1

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "nobrainer-tech-flow",
       "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-      "version": "2.4.0",
+      "version": "2.4.1",
       "source": "./",
       "author": {
         "name": "NoBrainer Tech"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "nobrainer-tech-flow",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "author": {
     "name": "NoBrainer Tech"
   },

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "nobrainer-tech-flow",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "author": {
     "name": "NoBrainer Tech",
     "url": "https://nobrainer.tech"

package/AGENTS.md

@@ -23,6 +23,7 @@ Respect host hierarchy; user instructions override skill guidelines. Apply [deli
 - `tests/` — deterministic and behavioral regression gates.
 - `docs/COMPATIBILITY.md` and `docs/TESTING.md` — proof boundaries.
 - `docs/SKILL_CURATION.md` — admission, ownership and retirement decisions.
+- `docs/RELEASING.md`: releases.
 
 ## Portable skill contract
 

package/CLAUDE.md

@@ -23,6 +23,7 @@ Respect host hierarchy; user instructions override skill guidelines. Apply [deli
 - `tests/` — deterministic and behavioral regression gates.
 - `docs/COMPATIBILITY.md` and `docs/TESTING.md` — proof boundaries.
 - `docs/SKILL_CURATION.md` — admission, ownership and retirement decisions.
+- `docs/RELEASING.md`: releases.
 
 ## Portable skill contract
 

package/README.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://nobrainer.tech">
-    <img src="assets/nobrainer-tech-logo.svg" width="96" alt="nobrainer-tech-flow monogram">
+    <img src="assets/nobrainer-tech-logo.svg" width="96" alt="NoBrainer Tech logo">
   </a>
 </p>
 
@@ -534,9 +534,10 @@ and [Testing](docs/TESTING.md) for acceptance evidence.
 **What's new in 2.4.0:** nobrainer-tech-flow can ask before risky commands and
 shows whether its proof still matches your files. See [RELEASE-NOTES.md](RELEASE-NOTES.md).
 
-Current source version: **2.4.0**. Check the
+Current source version: **2.4.1**, which fixes undo after a rearranged profile. Check the
 [latest published GitHub release](https://github.com/nobrainer-tech/nobrainer-tech-flow/releases/latest)
-for distribution and the [2.4.0 verification record](docs/releases/v2.4.0.md) for
+for distribution and the [2.4.1](docs/releases/v2.4.1.md) and
+[2.4.0 verification records](docs/releases/v2.4.0.md) for
 the current scope, reproducible checks and client-runtime limits. The unchanged command runner keeps its
 [v1.7.0 verification scope](docs/releases/v1.7.0.md). Source publication does not
 imply client marketplace discovery or improved model reasoning. The earlier

package/assets/nobrainer-tech-logo.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" role="img" aria-label="NBTF"><rect x="2" y="2" width="92" height="92" rx="22" fill="#2948B8"/><text x="18" y="43" fill="#fff" font-family="Arial,Helvetica,sans-serif" font-weight="800" font-size="31" letter-spacing="-2">NB</text><text x="18" y="76" fill="#fff" font-family="Arial,Helvetica,sans-serif" font-weight="800" font-size="31" letter-spacing="-2">TF</text><rect x="70" y="63" width="8" height="8" rx="1" fill="#FF9875"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M126 0H476A36 36 0 0 1 512 36V386A126 126 0 0 1 386 512H36A36 36 0 0 1 0 476V126A126 126 0 0 1 126 0Z" fill="#3B65F0"/><path d="M384 384H121A24 24 0 0 1 97 358A288 288 0 0 1 358 97A24 24 0 0 1 384 121Z" fill="#FFF7EC"/><rect x="240" y="240" width="104" height="104" fill="#F04A14"/></svg>

package/docs/INSTALL.md

@@ -14,9 +14,9 @@ upgraded merely because the new source is installed nearby.
 Node 18+ and Python 3.11+ are prerequisites. Preview the setup first:
 
 ```sh
-npx nobrainer-tech-flow@2.4.0 --client codex
-npx nobrainer-tech-flow@2.4.0 --client codex --apply
-npx nobrainer-tech-flow@2.4.0 --client codex --undo --apply
+npx nobrainer-tech-flow@2.4.1 --client codex
+npx nobrainer-tech-flow@2.4.1 --client codex --apply
+npx nobrainer-tech-flow@2.4.1 --client codex --undo --apply
 ```
 
 Use claude for Claude Code, opencode or copilot for those clients. Add --home PATH
@@ -24,7 +24,7 @@ for an isolated profile. These commands become available once this version is
 published on npm; a source candidate is not registry availability.
 
 Application copies the release files into the chosen home directory's
-.nobrainer-tech-flow-npm/2.4.0 and verifies the copy. That folder sits beside
+.nobrainer-tech-flow-npm/2.4.1 and verifies the copy. That folder sits beside
 ~/.nobrainer-tech-flow, where the Git installation suggests a clone, so cleaning
 the clone cannot delete the files the skill links point to. Releases before 2.3.2
 kept their copy in .nobrainer-tech-flow/npm; undo such a setup with the command of

package/docs/RELEASING.md

@@ -0,0 +1,24 @@
+# Releasing nobrainer-tech-flow
+
+This repository is the one product to promote: stars, issues and links point here.
+Every channel below carries the same version from the same tag, and its links
+(homepage, repository, support) lead back here. A stable release is finished only
+when each channel reads back that version, or the gap is reported:
+
+1. GitHub release from the annotated `vX.Y.Z` tag, with
+   `nobrainer-tech-flow-X.Y.Z-plugin.zip` (`scripts/build_plugin.py`) and the
+   `npm pack` tarball built from the merge commit; download each asset and compare its
+   SHA-256 with the digest of that same file before upload.
+2. npm: run the `Publish npm` workflow from the tag, then read back
+   `npm view nobrainer-tech-flow version`.
+3. Claude Code and Codex marketplaces in this repository: they follow the default
+   branch, so install `nobrainer-tech-flow@nobrainer-tech` in a throwaway profile while
+   `main` still equals the tag, and read back the version and the installed commit.
+4. `nobrainer-tech/nobrainer-tech-flow-plugin`: export the release ZIP there
+   through a PR, update `SOURCE.json`, run its unmodified
+   `_maintainers/verify_release.py`, then release it. It is the hook-free copy that
+   the Claude directory tracks, not a second project to promote.
+5. Claude directory (claude.ai/directory/manage) picks up that repository's
+   default branch; OpenAI plugin directory (platform.openai.com/plugins) takes the
+   native ZIP upload. Both submissions and publication clicks are owner-gated.
+6. Changelog on https://nobrainer.tech/flow/changelog/ after owner preview.

package/docs/releases/v2.4.1.md

@@ -0,0 +1,63 @@
+# nobrainer-tech-flow 2.4.1: undo after a rearranged profile
+
+Release date: 2026-10-19.
+
+Two fixes to the setup record from an independent review of the 2.3.2 installer
+(issue #82). In both cases the undo used to stop with exit 3 and change nothing, so no
+data was lost, but the skill links stayed installed until the record was fixed by hand.
+
+## What changes
+
+- **Undo works after a link joins two folders the setup made.** After a Codex setup on
+  a fresh profile, moving `~/.agents/skills` to `~/.codex/skills` and replacing
+  `~/.agents` with a link to `~/.codex` makes two entries of `created_dirs` lead to
+  one folder. `install.sh`, `install.py` and the guided `--rollback` refused that record
+  as listing a folder twice. They now look for a repeated entry by its spelling in the
+  record, so a link added after the setup no longer counts as a repeat. The undo
+  removes the links, leaves the `~/.agents` link and everything in `~/.codex` as they
+  are, and prints a `PRESERVED` line for the folder that now lies behind the link. A
+  record that lists the same path twice is still refused with exit 3. When two
+  different entries lead to one folder, the record cannot show which of them the setup
+  made, so the undo removes neither: each one stays with a `PRESERVED` line, while the
+  links and the other recorded folders are still removed.
+- **A folder whose real path holds a line break stops the setup before it writes.**
+  The record lists each folder the setup makes with the links on the way resolved.
+  When a link on the way leads to a folder whose name holds a line break or another
+  control character (for example `~/.claude` linked to such a folder), `install.sh`
+  wrote that path into the record split over two lines, so apply exited 0 and the
+  undo later refused the record. The Python installer wrote such a path for a folder
+  behind a link that is not on the skills path (for example `CODEX_HOME` set to a
+  folder still to be made behind such a link). Both installers now refuse the apply
+  with exit 2 and an error that names the folder, before anything is written, as they
+  already did for a path written with such a character. `install.sh` also keeps a
+  line break at the end of a folder name when it resolves links; it used to drop it.
+
+## Verification record
+
+Local checks (macOS, Python 3.14.5):
+
+- Two new tests in `tests.test_shell_installer` run each case with `install.sh` under
+  `/bin/sh`, dash, bash in POSIX mode and zsh emulating sh, and with `install.py`.
+  Against the 2.4.0 scripts they failed in 23 subtests: every `install.sh` run of both
+  cases, the `install.py` undo of the rearranged profile, and the `install.py` apply
+  with `CODEX_HOME` behind a link. The `install.py` apply with `~/.claude` linked to
+  such a folder was already refused. Without the trailing line break fix, 8 `install.sh`
+  subtests for a folder name that ends in a line break still failed.
+- The case "a folder listed under two spellings" was removed from the test of damaged
+  records, because such a record is now accepted; the case of a folder listed twice
+  stays.
+- A third test, from a review of this fix, lists an existing empty home under its real
+  path and through a link to it. The undo exits 0 and the home stays in all 5 runs; with
+  the first version of this fix, the undo removed the home in all 5.
+- `python3 -m unittest tests.test_shell_installer tests.test_one_command_installer
+  tests.test_guided_onboarding tests.test_installer tests.test_install_guards`: 205
+  tests passed, 2 skipped.
+- `sh -n` and `dash -n` on `scripts/install.sh`, `shellcheck -S error` and
+  `git diff --check` passed.
+
+The line break case is not tested on Windows, which does not allow such a file name.
+
+## Scope
+
+This is an installer fix. The record format, the module set and the instruction
+block do not change.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "nobrainer-tech-flow",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "contextFileName": "GEMINI.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nobrainer-tech-flow",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
   "type": "module",
   "main": ".opencode/plugins/nobrainer-tech-skills.js",

package/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "nobrainer-tech-flow",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "author": {
     "name": "NoBrainer Tech",
     "url": "https://nobrainer.tech"

package/scripts/install.sh

@@ -169,7 +169,9 @@ physical() {
 			return
 		fi
 	done
-	_p_head=$(cd -P "$_p_head" 2>/dev/null && pwd -P) || _p_head=$1 _p_tail=
+	# The slash keeps a trailing line break of a folder name across the substitution.
+	_p_head=$(cd -P "$_p_head" 2>/dev/null && printf '%s/' "$PWD") || _p_head=$1/ _p_tail=
+	_p_head=${_p_head%/}
 	printf '%s%s\n' "${_p_head%/}" "$_p_tail"
 }
 
@@ -543,7 +545,9 @@ under_link() {
 # The folders a record lists must be ones the setup can have made: each an absolute,
 # plain path listed once, that is, or lies above, the skills folder, the folder of the
 # instruction file or the folder of the record. Anything else is a damaged record that an undo must not act on. A path
-# may be spelled with or without the links on the way, so both spellings count.
+# may be spelled with or without the links on the way, so both spellings count. Two entries
+# may still lead to one folder: a link put in place of one of them since the setup does that.
+# The undo removes no folder of such a group.
 above() {
 	case "$2/" in "$1"/*) return 0 ;; esac
 	return 1
@@ -591,9 +595,9 @@ check_dirs() {
 			fi
 			[ -n "$_k_ok" ] || exit 1
 			case $_k_seen in *"
-$_k_real
+$_k_dir
 "*) exit 1 ;; esac
-			_k_seen="$_k_seen$_k_real
+			_k_seen="$_k_seen$_k_dir
 "
 		done
 	}
@@ -922,6 +926,16 @@ install() {
 	sha256 /dev/null >/dev/null || die 2 "this script needs sha256sum, shasum or openssl to record the setup"
 
 	created= dirs_to_make=
+	# A folder this run makes is recorded as it really is, links resolved. A line break or a
+	# control character in that form would leave a record no undo can read, so such a run
+	# stops before anything is written.
+	note_dirs "$home"
+	if [ "$link_count" -gt 0 ]; then note_dirs "$skills_dir"; fi
+	if [ "$file_status" != present ] && [ "$inherit" = 0 ]; then note_dirs "${target%/*}"; fi
+	printf '%s' "$dirs_to_make" | while IFS= read -r _a_dir; do
+		reject_control "$(physical "$_a_dir")" "the real path of $_a_dir"
+	done || exit 2
+	dirs_to_make=
 	# The record's folder is made before anything else is written: when it cannot be made,
 	# the run stops here instead of leaving links and a block that no record describes. It
 	# counts among the folders the setup made: a home that does not exist yet is made for
@@ -1283,9 +1297,23 @@ undo() {
 	rm -f "$state"
 	# The record is gone, so the folder it sat in may be empty now. A folder that was there
 	# before the setup is not listed, and a folder that holds anything stays.
+	# Two entries that lead to one folder cannot both be what the setup made, and the record
+	# cannot say which one is, so no entry of such a group is removed. The groups are found
+	# before any folder goes.
 	_u_gone=
 	if [ -n "$st_dirs" ]; then
+		_u_dupes=$(printf '%s' "$st_dirs" | while IFS= read -r _u_dir; do physical "$_u_dir"; done | LC_ALL=C sort | uniq -d)
+		_u_shared=
+		if [ -n "$_u_dupes" ]; then
+			_u_shared=$(printf '%s' "$st_dirs" | while IFS= read -r _u_dir; do
+				if printf '%s\n' "$_u_dupes" | grep -q -x -F -e "$(physical "$_u_dir")"; then printf '%s\n' "$_u_dir"; fi
+			done)
+		fi
 		_u_gone=$(printf '%s' "$st_dirs" | LC_ALL=C sort -r | while IFS= read -r _u_dir; do
+			if [ -n "$_u_shared" ] && printf '%s\n' "$_u_shared" | grep -q -x -F -e "$_u_dir"; then
+				printf 'PRESERVED: %s: another folder in the record leads to the same folder, so it is left as it is\n' "$_u_dir"
+				continue
+			fi
 			if [ ! -d "$_u_dir" ] || [ -L "$_u_dir" ]; then continue; fi
 			if under_link "$_u_dir"; then
 				printf 'PRESERVED: %s: a folder above it is a link now, so it is left as it is\n' "$_u_dir"

package/scripts/recommend_flow_setup.py

@@ -651,6 +651,8 @@ def recorded_directories(state: dict[str, object], record: Path) -> list[Path]:
     A path may be spelled with or without the links on the way, so both spellings count. A
     folder the setup made is listed as it really is, and a base spelled with ``..`` reaches
     it on the way without lying below it, so the real form of each folder on that way counts.
+    An entry may be listed once. Two entries may still lead to one folder: a link put in place
+    of one of them since the setup does that. The undo removes no folder of such a group.
     """
 
     raw = state.get("created_dirs", [])
@@ -675,9 +677,9 @@ def recorded_directories(state: dict[str, object], record: Path) -> list[Path]:
             or not any(form == place or form in place.parents for form in forms for place in places)
         ):
             raise ValueError(f"created_dirs names a folder this setup cannot have created: {item}")
-        if forms[1] in seen:
+        if path in seen:
             raise ValueError("created_dirs must list each folder the setup created once")
-        seen.add(forms[1])
+        seen.add(path)
         directories.append(path)
     return directories
 
@@ -698,18 +700,26 @@ def is_link(path: Path) -> bool:
     return bool(attributes & getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0))
 
 
-def remove_empty_directories(directories: list[Path]) -> tuple[list[Path], list[Path]]:
+def remove_empty_directories(directories: list[Path]) -> tuple[list[Path], list[Path], list[Path]]:
     """Remove each of these folders that is still empty, innermost first.
 
-    Returns the folders removed and the folders kept because a folder above them is a
-    link now. The record lists each folder with the links on the way resolved, so such a
-    link means the profile was rearranged since the setup, and removing the folder would
-    act on another tree.
+    Returns the folders removed, the folders kept because a folder above them is a link
+    now, and the folders kept because another entry leads to the same folder. The record
+    lists each folder with the links on the way resolved, so such a link means the profile
+    was rearranged since the setup, and removing the folder would act on another tree. Two
+    entries that lead to one folder cannot both be what the setup made, and the record
+    cannot say which one is, so neither is removed.
     """
 
+    real = [physical_path(path) for path in directories]
+    shared = {path for path, form in zip(directories, real) if real.count(form) > 1}
     removed: list[Path] = []
     kept: list[Path] = []
+    kept_shared: list[Path] = []
     for path in sorted(directories, key=lambda item: len(item.parts), reverse=True):
+        if path in shared:
+            kept_shared.append(path)
+            continue
         try:
             if is_link(path) or not path.is_dir():
                 continue
@@ -720,7 +730,7 @@ def remove_empty_directories(directories: list[Path]) -> tuple[list[Path], list[
         except OSError:
             continue
         removed.append(path)
-    return removed, kept
+    return removed, kept, kept_shared
 
 
 def state_path(home: Path, override: Path | None, client: str) -> Path:
@@ -1126,11 +1136,13 @@ def rollback(args: argparse.Namespace, state_file: Path) -> int:
         print(f"ROLLBACK_READBACK: removed={','.join(removed) or 'none'}; profile=preserved")
         return 3
     state_file.unlink()
-    removed_dirs, kept_dirs = remove_empty_directories(directories)
+    removed_dirs, kept_dirs, shared_dirs = remove_empty_directories(directories)
     for directory in removed_dirs:
         print(f"REMOVED_DIR: {directory}")
     for directory in kept_dirs:
         print(f"PRESERVED: {directory}: a folder above it is a link now, so it is left as it is")
+    for directory in shared_dirs:
+        print(f"PRESERVED: {directory}: another folder in the record leads to the same folder, so it is left as it is")
     if "created_dirs" not in state:
         # A record from before the folder list still gets its skills folder removed when empty.
         # One with the list says which folders the setup made, so no other is touched.
@@ -1366,6 +1378,9 @@ def main(argv: list[str] | None = None) -> int:
         # The record's own folder counts: a home that does not exist yet is made for it alone
         # when a client variable puts the skills and the instructions elsewhere.
         new_directories = missing_directories(destination, profile_target.parent, state.parent)
+        # They are recorded as they really are, links resolved, and a path the record cannot
+        # hold stops the run here, before anything is written.
+        require_utf8(*(physical_path(path) for path in new_directories))
         # Inspect every target before writing any of them. This keeps a later
         # conflict from leaving a partial selection installed.
         for name in install_names:

package/skills/nobrainer-tech-flow/VERSION

@@ -1 +1 @@
-2.4.0
+2.4.1