oxe-cc 1.4.0 → 1.5.0

package/.github/workflows/ci.yml

@@ -1,20 +1,57 @@
-name: CI
-
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
-      - run: npm ci
-      - run: npm test
-      - run: npm run scan:assets
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm ci
+      - run: npm test
+      - run: npm run scan:assets
+      - run: npm run release:doctor
+
+  doctor:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm ci
+      - name: OXE Doctor
+        run: node bin/oxe-cc.js doctor
+
+  wrapper-audit:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm ci
+      - name: Audit runtime wrappers
+        run: |
+          node -e "
+            const rs = require('./bin/lib/oxe-runtime-semantics.cjs');
+            const r = rs.auditRuntimeTargets('.');
+            if (!r.ok) {
+              console.error('Wrapper audit failed:');
+              console.error(JSON.stringify(r.mismatches, null, 2));
+              process.exit(1);
+            }
+            console.log('Wrapper audit passed — all targets in sync');
+          "

package/.github/workflows/release.yml

@@ -0,0 +1,94 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm ci
+      - run: npm test
+      - run: npm run scan:assets
+      - run: npm run release:doctor
+      - run: node bin/oxe-cc.js --version
+
+  publish-npm:
+    needs: validate
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm ci
+      - run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  build-vsix:
+    needs: validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm ci
+      - run: npm run build:vscode-ext
+      - uses: actions/upload-artifact@v4
+        with:
+          name: oxe-agents-vsix
+          path: '*.vsix'
+          if-no-files-found: warn
+
+  create-release:
+    needs: [publish-npm, build-vsix]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Extract changelog entry
+        id: changelog
+        run: |
+          TAG="${{ github.ref_name }}"
+          VERSION="${TAG#v}"
+          # Extract the block for this version from CHANGELOG.md
+          awk "/^## \[${VERSION}\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md > CHANGELOG_EXTRACT.md
+          echo "Extracted changelog for ${VERSION}"
+          cat CHANGELOG_EXTRACT.md
+      - uses: actions/download-artifact@v4
+        with:
+          name: oxe-agents-vsix
+          path: dist/
+        continue-on-error: true
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ github.ref_name }}"
+          VSIX_FILES=$(find dist/ -name "*.vsix" 2>/dev/null || true)
+          if [ -n "$VSIX_FILES" ]; then
+            gh release create "$TAG" \
+              --title "oxe-cc $TAG" \
+              --notes-file CHANGELOG_EXTRACT.md \
+              $VSIX_FILES
+          else
+            gh release create "$TAG" \
+              --title "oxe-cc $TAG" \
+              --notes-file CHANGELOG_EXTRACT.md
+          fi

package/AGENTS.md

@@ -4,7 +4,7 @@ Este repositório empacota o fluxo **OXE** (spec-driven, artefatos em `.oxe/`).
 
 - **npm:** `npx oxe-cc@latest` · pacote `oxe-cc` · [README.md](README.md)
 - **Workflows canónicos:** [oxe/workflows/](oxe/workflows/) — editar aqui primeiro; todas as integrações apontam para estes ficheiros. Referência **legado / brownfield:** [oxe/workflows/references/legacy-brownfield.md](oxe/workflows/references/legacy-brownfield.md).
-- **CLI:** `oxe-cc install | doctor | status | init-oxe | update | uninstall` + `oxe-cc runtime <status|compile|verify|gates|replay|recover|ci|promote|agents>` — ver [README.md](README.md#cli-oxe-cc).
+- **CLI:** `oxe-cc install | doctor | doctor --release | status | init-oxe | update | uninstall` + `oxe-cc runtime <status|compile|verify|gates|replay|recover|ci|promote|agents>` — ver [README.md](README.md#cli-oxe-cc).
 - **SDK:** `require('oxe-cc')` expõe `runDoctorChecks`, `health`, `workflows`, `install`, `manifest`, `agents`, `verifyRun` e bridges `operational.*` do runtime enterprise — ver [lib/sdk/README.md](lib/sdk/README.md).
 
 ---
@@ -98,3 +98,5 @@ Quando o utilizador pedir uma etapa OXE por linguagem natural, seguir o ficheiro
 Os wrappers por runtime podem carregar metadata cognitiva (`oxe_reasoning_mode`, `oxe_question_policy`, `oxe_output_contract`, `oxe_tool_profile`, `oxe_confidence_policy`), mas o comportamento canónico continua no workflow. Use essa metadata para adaptar a postura do agente sem bifurcar a lógica do OXE por ferramenta.
 
 Para `execute` e `verify`, o comportamento atual esperado é **runtime-first**: se `oxe-cc runtime` estiver disponível, preferir `runtime compile/project/verify/gates` e tratar markdown como projeção derivada; se o runtime não puder ser executado, declarar `fallback legado` explicitamente.
+
+Para publicação, o gate local esperado passa por `oxe-cc doctor --release --write-manifest`. Essa verificação deve falhar se houver drift de versão, topo inválido no `CHANGELOG`, wrapper dirty após sync, runtime não compilado ou ausência dos relatórios `.oxe/release/*.json` exigidos pela release.