opencode-codeops 1.4.0

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "opencode-codeops",
+  "version": "1.4.0",
+  "description": "Specification-first engineering for complex systems — CodeOps plugin for OpenCode",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "./plugin/index.ts",
+  "exports": {
+    ".": "./plugin/index.ts"
+  },
+  "bin": {
+    "opencode-codeops": "bin/index.mjs"
+  },
+  "scripts": {
+    "test": "node --test",
+    "typecheck": "tsc --noEmit",
+    "check:version": "node scripts/check-version.mjs",
+    "verify": "npm run typecheck && npm run test && npm run check:version",
+    "prepublishOnly": "npm run verify"
+  },
+  "files": [
+    "plugin/",
+    "skills/",
+    "_shared/",
+    "standards/",
+    "agents/",
+    "agent-templates/",
+    "scripts/",
+    "!scripts/*.test.mjs",
+    "!scripts/*.spec.test.mjs",
+    "bin/",
+    "!bin/*.test.mjs",
+    "!bin/*.spec.test.mjs",
+    "references/",
+    "schemas/",
+    "install.sh",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "opencode",
+    "codeops",
+    "requirements",
+    "planning",
+    "verification",
+    "specification"
+  ],
+  "license": "MIT",
+  "author": "blendsdk",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/blendsdk/opencode-codeops.git"
+  },
+  "homepage": "https://github.com/blendsdk/opencode-codeops#readme",
+  "bugs": {
+    "url": "https://github.com/blendsdk/opencode-codeops/issues"
+  },
+  "peerDependencies": {
+    "@opencode-ai/plugin": "^1.18.30"
+  },
+  "devDependencies": {
+    "@opencode-ai/plugin": "1.18.30",
+    "@types/node": "^22.20.2",
+    "typescript": "^5.0.0"
+  }
+}

package/plugin/index.ts

@@ -0,0 +1,181 @@
+import type { Plugin } from "@opencode-ai/plugin"
+import { readFileSync } from "node:fs"
+import { homedir } from "node:os"
+import { join, dirname } from "node:path"
+import { fileURLToPath } from "node:url"
+
+// ---------------------------------------------------------------------------
+// Package root — resolved at module load time so it is always the plugin's
+// installed directory, regardless of the working directory at event time.
+// PLUGIN_DIR contains this entry point (plugin/); PACKAGE_ROOT is one level
+// above it and holds standards/, skills/, scripts/, and the agent templates.
+// ---------------------------------------------------------------------------
+const PLUGIN_DIR = dirname(fileURLToPath(import.meta.url))
+const PACKAGE_ROOT = dirname(PLUGIN_DIR)
+
+// ---------------------------------------------------------------------------
+// The plugin's own version, read from the package it shipped in. There is no
+// separate hardcoded version: the running plugin always reports the version of
+// the npm package that was installed, so it cannot drift from the package.
+// ---------------------------------------------------------------------------
+const packageVersion = readPackageVersion()
+
+/** Reads the `version` field of this package's package.json. */
+function readPackageVersion(): string {
+  try {
+    const manifest = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8"))
+    return typeof manifest.version === "string" ? manifest.version : "0.0.0"
+  } catch {
+    return "0.0.0"
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Load standards at startup (once). Both files are injected into every session.
+// ---------------------------------------------------------------------------
+const codingStandards = readFileSync(
+  join(PACKAGE_ROOT, "standards", "coding-standards.md"),
+  "utf8"
+)
+const outputStyle = readFileSync(
+  join(PACKAGE_ROOT, "standards", "output-style.md"),
+  "utf8"
+)
+const standardsText = `${codingStandards}\n\n${outputStyle}`
+
+// ---------------------------------------------------------------------------
+// Helper — inject standards into a session without triggering an AI reply.
+// Uses client.session.prompt with noReply: true (confirmed from OpenCode SDK).
+// ---------------------------------------------------------------------------
+async function injectStandards(
+  client: Parameters<Plugin>[0]["client"],
+  sessionId: string
+): Promise<void> {
+  await client.session.prompt({
+    path: { id: sessionId },
+    body: {
+      noReply: true,
+      parts: [{ type: "text", text: standardsText }],
+    },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Helper — read the version recorded in an installed skills marker, if any.
+// The marker (`.opencode-codeops.json`) is written by the skills installer.
+// Its absence means the skills are not managed — for example a development
+// symlink — so there is no version to compare against.
+// ---------------------------------------------------------------------------
+function installedSkillsVersion(skillsDir: string): string | undefined {
+  try {
+    const marker = JSON.parse(
+      readFileSync(join(skillsDir, ".opencode-codeops.json"), "utf8")
+    )
+    return typeof marker.version === "string" ? marker.version : undefined
+  } catch {
+    return undefined
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Helper — warn (non-blocking) when the installed skills were written by a
+// different CodeOps version than this plugin. The plugin and the skills are
+// installed by separate commands, so their versions can drift; a mismatch
+// usually means the skills need `npx opencode-codeops install-skills` again.
+// ---------------------------------------------------------------------------
+async function warnOnVersionSkew(
+  client: Parameters<Plugin>[0]["client"],
+  directory: string
+): Promise<void> {
+  const skillsDirs = [
+    join(homedir(), ".config", "opencode", "skills"),
+    join(directory, ".opencode", "skills"),
+  ]
+
+  for (const skillsDir of skillsDirs) {
+    const installed = installedSkillsVersion(skillsDir)
+    if (!installed || installed === packageVersion) continue
+
+    await client.app.log({
+      body: {
+        service: "codeops",
+        level: "warn",
+        message:
+          `CodeOps skills at ${skillsDir} are version ${installed}, ` +
+          `but the plugin is version ${packageVersion}. ` +
+          `Run \`npx opencode-codeops@${packageVersion} install-skills\` to match them.`,
+      },
+    })
+  }
+}
+
+// ---------------------------------------------------------------------------
+// CodeOps plugin for OpenCode
+// Replaces: hooks/hooks.json + hook_session_context.sh + hook_marker_guard.sh
+// ---------------------------------------------------------------------------
+export const CodeOpsPlugin: Plugin = async ({ client, directory }) => {
+  return {
+    // -----------------------------------------------------------------------
+    // Hook 1 & 2: inject standards on session.created and session.compacted.
+    // Both are dispatched via the generic event hook.
+    // session.created  → new session    (Codex: startup)
+    // session.compacted → after compact  (Codex: resume|compact)
+    // -----------------------------------------------------------------------
+    event: async ({ event }) => {
+      if (event.type === "session.created") {
+        const sessionId: string = (event.properties as { info: { id: string } }).info.id
+        await injectStandards(client, sessionId)
+        await warnOnVersionSkew(client, directory)
+      } else if (event.type === "session.compacted") {
+        const sessionId: string = (event.properties as { sessionID: string }).sessionID
+        await injectStandards(client, sessionId)
+      }
+    },
+
+    // -----------------------------------------------------------------------
+    // Hook 3: inject standards into the compaction context itself, so they
+    // survive through the compaction summary and are not lost mid-session.
+    // -----------------------------------------------------------------------
+    "experimental.session.compacting": async (_input, output) => {
+      output.context.push(
+        "## CodeOps Standards (always active — survive this compaction)\n\n" +
+          standardsText
+      )
+    },
+
+    // -----------------------------------------------------------------------
+    // Hook 4: export CODEOPS_PLUGIN_ROOT into every shell so skills can call
+    // scripts as: python3 "${CODEOPS_PLUGIN_ROOT}/scripts/codeops_plan.py"
+    // The value is the package root (parent of this plugin/ directory), which
+    // is where skills/, scripts/, and the other shipped assets live.
+    // -----------------------------------------------------------------------
+    "shell.env": async (_input, output) => {
+      output.env.CODEOPS_PLUGIN_ROOT = PACKAGE_ROOT
+    },
+
+    // -----------------------------------------------------------------------
+    // Hook 5: advisory guard — warn (non-blocking) if any edit tool targets
+    // codeops/.codeops.yml, which is owned exclusively by the setup-codeops
+    // skill. Equivalent to Codex PreToolUse hook_marker_guard.sh.
+    // args are on the output parameter per the OpenCode plugin type signature.
+    // -----------------------------------------------------------------------
+    "tool.execute.before": async (input, output) => {
+      const editTools = ["write", "edit", "apply_patch"]
+      if (!editTools.includes(input.tool)) return
+
+      const args = output.args as Record<string, unknown> | undefined
+      const filePath: string =
+        (args?.filePath as string | undefined) ??
+        (args?.path as string | undefined) ??
+        ""
+
+      if (filePath.includes("codeops/.codeops.yml")) {
+        process.stderr.write(
+          "CodeOps warning: codeops/.codeops.yml is the layout marker and is " +
+            "owned by setup-codeops. Edit it only through the setup/migration " +
+            "workflow (run the setup-codeops skill).\n"
+        )
+      }
+    },
+  }
+}

package/references/domains/compiler-and-language.md

@@ -0,0 +1,28 @@
+# Compiler and language ambiguity lens
+
+Use this lens for programming languages, compilers, interpreters, query languages, schemas, protocol decoders, and systems with formal transformation semantics.
+
+## Semantic closure checklist
+
+- Source encoding, lexical rules, whitespace/comments, reserved words, and error recovery
+- Complete grammar, precedence, associativity, ambiguity resolution, and parse-tree shape
+- Namespaces, scopes, shadowing, imports, visibility, forward references, and cycles
+- Type formation, equivalence, subtyping/coercion, inference, polymorphism, constraints, and error types
+- Compile-time versus runtime behavior and phase ordering
+- Constant evaluation, effects, evaluation order, overflow, undefined behavior, and determinism
+- Ownership/lifetime/resource semantics where applicable
+- IR invariants at every level and preservation between lowering passes
+- Optimization preconditions and semantic-equivalence obligations
+- Linking, modules, ABI, serialization, and version compatibility
+- Diagnostics: location, recovery, cascades, stability, and machine-readable forms
+- Incremental/parallel compilation invalidation and cache correctness
+- Tooling contracts: formatter, language server, debugger, package manager, and build system
+- Conformance, golden, differential, property, fuzz, and invalid-program tests
+
+## Required counterexamples
+
+For each semantic rule, seek minimal examples at boundaries: empty forms, recursive/cyclic forms, shadowing, ambiguous parses, conflicting constraints, order-sensitive effects, overflow, invalid encodings, partial programs, and cross-module interactions. A prose rule is incomplete until examples distinguish it from plausible alternatives.
+
+## Gate
+
+The semantics gate fails when two conforming implementations could produce observably different results from the same valid program/input, or when invalid input lacks a defined rejection/recovery class, unless that freedom is explicitly part of the language contract.

package/references/domains/data-and-migration.md

@@ -0,0 +1,22 @@
+# Data and migration ambiguity lens
+
+Use this lens for persistent schemas, imports/exports, migrations, indexing, backfills, retention, and data-model changes.
+
+## Data lifecycle checklist
+
+- Entity identity, ownership, cardinality, constraints, nullability, uniqueness, and invariants
+- Canonical representation, normalization/denormalization, units, encoding, and precision
+- Create/update/delete/archive/restore lifecycle and referential behavior
+- Transaction/isolation requirements and concurrent writers/readers
+- Query access patterns, indexes, scale assumptions, and performance bounds
+- Sensitive-data classification, encryption, access, masking, retention, deletion, and audit
+- Schema versioning and compatibility across application versions
+- Migration preconditions, online/offline mode, locks, batching, throttling, and checkpoints
+- Backfill correctness, resumability, idempotency, validation, and repair
+- Rollforward, rollback, irreversible steps, backups, restore proof, and disaster recovery
+- Import validation, duplicate/collision rules, partial files, and provenance
+- Derived data/cache/index rebuild and consistency checks
+
+## Gate
+
+The gate fails until every migration has measurable pre/postconditions, bounded operational impact, resumable/idempotent behavior, verification, and a recovery path appropriate to irreversibility and data criticality.

package/references/domains/distributed-and-concurrent.md

@@ -0,0 +1,26 @@
+# Distributed and concurrent system ambiguity lens
+
+Use this lens for multiple threads/processes/nodes, queues, actors, workflows, replicated state, caches, background jobs, and asynchronous integrations.
+
+## Concurrency and failure checklist
+
+- State ownership, mutation authority, synchronization, and atomicity boundaries
+- Ordering guarantees per key, partition, stream, request, and observer
+- Delivery semantics, deduplication, idempotency, replay, and poison-message behavior
+- Consistency model, visibility, stale reads, conflict resolution, and convergence
+- Transactions across resources, outbox/inbox, sagas, compensation, and orphan recovery
+- Timeout, cancellation, deadline propagation, retries, backoff, jitter, and retry budgets
+- Leader election, leases, fencing tokens, split brain, and clock assumptions
+- Backpressure, admission control, queue bounds, overload, fairness, and starvation
+- Deadlock/livelock/race prevention and safe shutdown
+- Partial availability, dependency degradation, circuit breaking, and health semantics
+- Schema/protocol evolution with mixed-version participants
+- Observability and correlation sufficient to reconstruct distributed outcomes
+
+## Required interleavings
+
+Specify and test at least: concurrent duplicate requests, read during write, fail before/after durable commit, timeout with unknown outcome, retry on a different node, reordered delivery, delayed stale worker, partition and heal, cancellation during side effect, and rolling mixed-version deployment.
+
+## Gate
+
+The gate fails when correctness relies on unstated timing, a single delivery, synchronized clocks, failure-free dependencies, or process-local state that is not process-local in deployment.

package/references/domains/financial-system.md

@@ -0,0 +1,28 @@
+# Financial-system ambiguity lens
+
+Use this lens whenever the system records, calculates, authorizes, transfers, reconciles, reports, or audits monetary value or financially consequential state.
+
+## Integrity closure checklist
+
+- Ledger model, account types, posting rules, balancing invariants, and immutable history
+- Currency identity, minor units, decimal precision, rounding mode, allocation, and residual handling
+- Effective, posting, settlement, and event timestamps with timezone and business-day rules
+- Idempotency keys, duplicate detection windows, replay behavior, and exactly-once claims
+- Transaction boundaries, isolation, locking, partial failure, rollback, retry, and compensation
+- Authorization, limits, approvals, segregation of duties, and credential/recovery flows
+- Holds, reservations, pending/posted/failed/reversed state transitions
+- Reversal, refund, chargeback, correction, backdating, and restatement semantics
+- Fees, taxes, rates, rate sources, rate timestamps, and rounding order
+- Reconciliation sources, tolerances, unmatched items, dispute handling, and repair authority
+- Audit event completeness, immutability, provenance, retention, and privacy
+- Overflow, negative values, zero, extreme scale, and malformed/external data
+- Reporting consistency, close periods, snapshots, and historical reproducibility
+- Regulatory, jurisdictional, and data-residency constraints explicitly supplied by qualified owners
+
+## Required failure narratives
+
+Specify observable state after every boundary failure: request timeout before/after commit, duplicate delivery, dependency outage, partial batch, stale authorization, concurrency conflict, reconciliation mismatch, and crash during recovery. “Retry” is not a complete rule without idempotency and state-observation semantics.
+
+## Gate
+
+The financial-integrity gate fails until every value-changing operation preserves its accounting invariants under duplication, concurrency, failure, retry, reversal, and audit reconstruction.

package/references/domains/selection.md

@@ -0,0 +1,19 @@
+# Domain-lens selection
+
+Before requirements discovery and again before specification preflight, classify the system using repository evidence and user intent. Select every applicable lens; complex systems commonly require several.
+
+| Evidence | Lens |
+|---|---|
+| Grammar, parser, IR, optimizer, type checker, evaluator, query planner, protocol codec | compiler and language |
+| Money, balances, invoices, payments, pricing, tax, ledger, reconciliation | financial system |
+| Browser UI, HTTP API, sessions, roles, tenant resources | web application |
+| Threads, workers, queues, events, replicas, workflows, caches, multiple nodes | distributed and concurrent |
+| Persistent schema, migration, backfill, import/export, retention, serialized artifacts, durable caches, file/protocol format evolution, or mixed-version compatibility | data and migration |
+
+Treat compatibility language as evidence, not decoration. If an old artifact,
+database, cache entry, message, module, or client must continue to work after a
+change, select **data and migration** and define the version boundary, upgrade or
+invalidation path, rollback behavior, and mixed-version window. An artifact does
+not need to be a database row for evolution semantics to matter.
+
+Always apply universal CodeOps ambiguity categories as well. Domain lenses add questions; they never replace scope, actors, failure behavior, security, quality attributes, traceability, or verification.

package/references/domains/web-application.md

@@ -0,0 +1,23 @@
+# Web application ambiguity lens
+
+Use this lens for browser applications, HTTP APIs, mobile backends, and user-facing network services.
+
+## Behavior and boundary checklist
+
+- Actors, roles, tenant boundaries, resource ownership, authorization matrix, and administrative exceptions
+- Authentication, session/token lifecycle, revocation, recovery, MFA, and device behavior
+- API request/response schemas, validation, errors, pagination, filtering, ordering, idempotency, and versioning
+- UI states: initial, loading, empty, partial, success, stale, offline, unauthorized, forbidden, validation error, and server failure
+- State transitions, optimistic updates, retries, duplicate submission, and conflict resolution
+- Accessibility: semantics, keyboard, focus, announcements, contrast, motion, and error association
+- Responsive/browser/device support and localization/timezone behavior
+- Caching layers, invalidation, privacy, consistency, and stale-data UX
+- File/upload/download handling and untrusted content
+- CSRF, XSS, injection, SSRF, redirect, cookie, CORS, CSP, and rate-limit boundaries
+- Background jobs, notifications, webhooks, scheduling, and eventual-consistency visibility
+- Observability, privacy-safe logging, support diagnostics, feature flags, rollout, and rollback
+- Deployment compatibility, migrations, zero-downtime constraints, and client skew
+
+## Gate
+
+The web gate fails when any actor/action/resource combination lacks an authorization result, any user-visible transition lacks a defined state, or any network operation lacks validation, error, retry/idempotency, and stale/concurrent behavior appropriate to its risk.

package/schemas/codeops-config.schema.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/blendsdk/codex-codeops/schemas/codeops-config.schema.json",
+  "title": "CodeOps project configuration",
+  "type": "object",
+  "required": ["schema", "mode", "artifacts"],
+  "additionalProperties": false,
+  "properties": {
+    "schema": {"const": 1},
+    "mode": {"enum": ["strict", "adaptive"]},
+    "artifacts": {
+      "type": "object",
+      "required": ["layout", "root"],
+      "additionalProperties": false,
+      "properties": {
+        "layout": {"enum": ["nested", "flat"]},
+        "root": {"type": "string", "minLength": 1}
+      }
+    },
+    "quality": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "independentReview": {"type": "boolean"},
+        "minimumReviewers": {"type": "integer", "minimum": 1},
+        "stopOnMajorFinding": {"type": "boolean"}
+      }
+    },
+    "routing": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "maxConcurrentAgents": {"type": "integer", "minimum": 1},
+        "roles": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "model": {"type": "string", "minLength": 1},
+              "effort": {"type": "string", "minLength": 1},
+              "sandbox": {"enum": ["read-only", "workspace-write", "danger-full-access"]}
+            }
+          }
+        }
+      }
+    },
+    "metrics": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {"type": "boolean"}
+      }
+    }
+  }
+}

package/scripts/check-version.mjs

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+/**
+ * Version-parity guard for the `opencode-codeops` package.
+ *
+ * The product version must exist in exactly one place: the `version` field of
+ * `package.json`. This check fails the build when that value drifts from
+ * `package-lock.json`, when it is not a plain semantic version, or when a
+ * source file hardcodes the current version instead of deriving it.
+ *
+ * The independent schema versions (the `codeops/` layout version, the artifact
+ * schema stamp, and the auto-design policy version) are intentionally unrelated
+ * to the product version and are not checked here.
+ *
+ * @module check-version
+ */
+
+import { readFileSync, readdirSync, realpathSync } from "node:fs"
+import { dirname, join, relative } from "node:path"
+import { fileURLToPath } from "node:url"
+
+import { isValidVersion } from "./release.mjs"
+
+/** Repository root: this file lives in `<root>/scripts/`. */
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)))
+
+/**
+ * Directories that ship code or templates and therefore must not hardcode the
+ * product version.
+ */
+const SCANNED_DIRS = [
+  "bin",
+  "plugin",
+  "scripts",
+  "skills",
+  "_shared",
+  "standards",
+  "agents",
+  "agent-templates",
+  "schemas",
+]
+
+/** Files that legitimately contain the version and are exempt from the scan. */
+const EXEMPT_FILES = new Set(["package.json", "package-lock.json", "CHANGELOG.md"])
+
+/**
+ * Reads the three version declarations that must agree.
+ *
+ * @returns The package version, the lockfile root version, and the lockfile
+ *   `packages[""]` version
+ */
+export function readVersions() {
+  const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf-8"))
+  const lock = JSON.parse(readFileSync(join(ROOT, "package-lock.json"), "utf-8"))
+  return {
+    package: pkg.version,
+    lock: lock.version,
+    lockRoot: lock.packages?.[""]?.version,
+  }
+}
+
+/**
+ * Recursively lists files under a directory.
+ *
+ * @param dir - Absolute directory to walk
+ * @returns Absolute file paths
+ */
+function listFiles(dir) {
+  const files = []
+
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name)
+    if (entry.isDirectory()) files.push(...listFiles(full))
+    else if (entry.isFile()) files.push(full)
+  }
+
+  return files
+}
+
+/**
+ * Finds files that contain the version string as a whole word.
+ *
+ * @param version - Version to search for
+ * @returns Paths relative to the repository root
+ */
+export function findVersionLiterals(version) {
+  const pattern = new RegExp(`(?<![0-9.])${version.replace(/\./g, "\\.")}(?![0-9.])`)
+  const hits = []
+
+  for (const dir of SCANNED_DIRS) {
+    const absolute = join(ROOT, dir)
+    let files
+    try {
+      files = listFiles(absolute)
+    } catch {
+      continue
+    }
+
+    for (const file of files) {
+      const name = relative(ROOT, file)
+      if (EXEMPT_FILES.has(name) || name.endsWith(".test.mjs") || name.endsWith(".spec.test.mjs")) {
+        continue
+      }
+      let content
+      try {
+        content = readFileSync(file, "utf-8")
+      } catch {
+        continue
+      }
+      if (pattern.test(content)) hits.push(name)
+    }
+  }
+
+  return hits
+}
+
+/**
+ * Runs the parity check.
+ *
+ * @returns Process exit code; `0` when every declaration agrees
+ */
+export function main() {
+  const { package: pkgVersion, lock, lockRoot } = readVersions()
+
+  if (!isValidVersion(pkgVersion)) {
+    console.error(`error: package.json version is not plain semver: ${pkgVersion}`)
+    return 1
+  }
+
+  const mismatches = []
+  if (lock !== pkgVersion) mismatches.push(`package-lock.json version=${lock}`)
+  if (lockRoot !== pkgVersion) mismatches.push(`package-lock.json packages[""]=${lockRoot}`)
+
+  if (mismatches.length > 0) {
+    console.error(`error: version drift for ${pkgVersion}: ${mismatches.join(", ")}`)
+    console.error("Run `npm install --package-lock-only` to resync the lockfile.")
+    return 1
+  }
+
+  const literals = findVersionLiterals(pkgVersion)
+  if (literals.length > 0) {
+    console.error(
+      `error: the product version ${pkgVersion} is hardcoded in: ${literals.join(", ")}\n` +
+        "Derive it from package.json instead of copying the value."
+    )
+    return 1
+  }
+
+  console.log(`version ok: ${pkgVersion}`)
+  return 0
+}
+
+function isMainModule() {
+  if (!process.argv[1]) return false
+  try {
+    return fileURLToPath(import.meta.url) === realpathSync(process.argv[1])
+  } catch {
+    return false
+  }
+}
+
+if (isMainModule()) {
+  process.exitCode = main()
+}