promptkit-os 2.0.0 → 2.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jonell (lowqualityloey)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,6 @@
 # `promptkit-os` (npm)
 
-The open-source engineering control plane for AI coding agents (Claude Code, Cursor, Copilot, Antigravity, Gemini CLI) — managing task ceremony levels (L0–L3), context economy, JIT stack playbooks, and evidence-gated verification.
+The open-source engineering control plane for AI coding agents (Claude Code, Cursor, Windsurf, GitHub Copilot, Cline/Roo Code, Trae, OpenCode, Aider, Gemini CLI/Antigravity) — managing task ceremony levels (L0–L3), context economy, JIT stack playbooks, and evidence-gated verification.
 
 > **Note**: This npm package is the **courier**, not the product. PromptKit OS itself is pure repository-native markdown with no runtime, no daemon, and no model lock-in — it lives at [lowqualityloey/promptkit-os](https://github.com/lowqualityloey/promptkit-os).
 
@@ -16,9 +16,11 @@ npx promptkit-os@latest --turbo --experimental
 npx promptkit-os@latest /path/to/project
 ```
 
-Pass-through flags: `--lite`, `--balanced`, `--turbo`, `--experimental`, `--host=`, `--target=`, `--tracking=`, `--reconfigure`.
+Pass-through flags: `--lite`, `--balanced`, `--turbo`, `--experimental`, `--host=`, `--add-host=`, `--target=`, `--tracking=`, `--reconfigure`.
 
-Requires Node 18+ (the courier runs on Node; the installed product does not). On Windows it also requires **PowerShell 7 (`pwsh`)**, which is what `init.ps1` targets — stock Windows PowerShell 5.1 is not supported.
+Requires Node 18+ (the courier runs on Node; the installed product does not) — the courier checks at startup and prints a clear error on older runtimes instead of failing on a missing `fetch`. On Windows it also requires **PowerShell 7 (`pwsh`)**, which is what `init.ps1` targets — stock Windows PowerShell 5.1 is not supported.
+
+> The `version` in this repository's `package/package.json` is intentionally `0.0.0`: the release workflow stamps the real version from the git tag and mints the tarball integrity pin at publish time (`docs/internal/release-evaluation.md` §1 records the mechanics). Running the courier from an unstamped checkout refuses with a clear error.
 
 ## Updating an existing install
 

package/bin/promptkit-os.js

@@ -12,7 +12,6 @@ const { spawnSync } = require("node:child_process");
 const crypto = require("node:crypto");
 const fs = require("node:fs");
 const path = require("node:path");
-const os = require("node:os");
 
 const PKG = require("../package.json");
 const REPO = "lowqualityloey/promptkit-os";
@@ -39,7 +38,7 @@ const KIT_DIR = ".promptkit";
 const TARBALL_SHA256_BY_VERSION = {
   "1.10.1": "1e55459914a1c46aa71df8f9cb8ce4c9ff37d1c02d67f70e5607b3bfd4f48d4b",
   "1.11.0": "6503fdfcde286055b8c053aa0ffa8bdf244cf77df3321cccd6a8d8f780195ade",
-  "2.0.0": "4fb5b9d85e0f19bfe333c361e00465705b60636a8026edd62c15c6f2d61cbf4b",
+  "2.1.0": "44a8a25e16c7abf31b412b8129ecead8bf1f0d1e3c75deb7d1cb1059d1ba9b17",
   // @pin-insert
 };
 
@@ -61,12 +60,12 @@ function passthroughFlags(argv) {
   const out = [];
   for (const arg of argv) {
     if (arg === "--force") continue; // courier-only flag, never forwarded to the installer
-    if (known.has(arg) || arg.startsWith("--host=") || arg.startsWith("--target=") || arg.startsWith("--tracking=")) {
+    if (known.has(arg) || arg.startsWith("--host=") || arg.startsWith("--add-host=") || arg.startsWith("--target=") || arg.startsWith("--tracking=")) {
       out.push(arg);
     } else if (!arg.startsWith("-")) {
       out.push(arg); // positional project root
     } else {
-      die(`unknown flag '${arg}' — pass it through after the install target, or see init --help`);
+      die(`unknown flag '${arg}' — the courier forwards a fixed allowlist; run the installer directly for full flags (init.sh --help / init.ps1 --help)`);
     }
   }
   return out;
@@ -144,13 +143,21 @@ async function download(url) {
 }
 
 async function extract(tarball, dest) {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "promptkit-os-"));
-  const tarPath = path.join(tmp, "release.tar.gz");
-  fs.writeFileSync(tarPath, tarball);
-
-  const res = spawnSync("tar", ["-xzf", tarPath, "-C", dest, "--strip-components=1"], { stdio: "inherit" });
-  if (res.status !== 0) die("failed to extract release tarball (is `tar` available?)");
-  fs.rmSync(tmp, { recursive: true, force: true });
+  // Every tar operand must stay relative: GNU tar — the first `tar` on PATH inside
+  // Git Bash — reads `C:\...` operands as remote host:path and dies with
+  // "Cannot connect to C: resolve failed", so the staging-temp-dir + absolute -C
+  // form broke the Windows leg wherever Git Bash leads PATH. Staging the archive
+  // inside `dest` (created by the caller) and extracting with cwd=dest leaves no
+  // absolute path in argv at all, on GNU tar, bsdtar, and POSIX tar alike.
+  const stagedTarball = path.join(dest, ".promptkit-release.tar.gz");
+  fs.writeFileSync(stagedTarball, tarball);
+  const res = spawnSync("tar", ["-xzf", ".promptkit-release.tar.gz", "--strip-components=1"], { cwd: dest, stdio: "inherit" });
+  fs.rmSync(stagedTarball, { force: true });
+  if (res.error) {
+    const hint = res.error.code === "ENOENT" ? "tar not found on PATH" : res.error.message;
+    die(`failed to extract release tarball: ${hint}`);
+  }
+  if (res.status !== 0) die(`failed to extract release tarball (tar exit ${res.status ?? res.signal})`);
 }
 
 function runInstaller(kitDir, args) {
@@ -159,13 +166,25 @@ function runInstaller(kitDir, args) {
     const ps = path.join(kitDir, "init.ps1");
     if (!fs.existsSync(ps)) die("init.ps1 missing from release tarball");
     const res = spawnSync("pwsh", ["-NoProfile", "-File", ps, ...args], { stdio: "inherit" });
-    if (res.status !== 0) die("init.ps1 failed");
+    if (res.error) {
+      const hint = res.error.code === "ENOENT"
+        ? "pwsh not found — PowerShell 7 is required on Windows (aka.ms/powershell); or use the git-submodule door and run bash .promptkit/init.sh"
+        : res.error.message;
+      die(`failed to launch init.ps1: ${hint}`);
+    }
+    if (res.status !== 0) die(`init.ps1 failed (exit ${res.status ?? res.signal})`);
   } else {
     const sh = path.join(kitDir, "init.sh");
     if (!fs.existsSync(sh)) die("init.sh missing from release tarball");
     fs.chmodSync(sh, 0o755);
     const res = spawnSync("bash", [sh, ...args], { stdio: "inherit" });
-    if (res.status !== 0) die("init.sh failed");
+    if (res.error) {
+      const hint = res.error.code === "ENOENT"
+        ? "bash not found — a POSIX shell is required to run init.sh"
+        : res.error.message;
+      die(`failed to launch init.sh: ${hint}`);
+    }
+    if (res.status !== 0) die(`init.sh failed (exit ${res.status ?? res.signal})`);
   }
 }
 
@@ -174,6 +193,14 @@ function installerArgs(args, version) {
 }
 
 async function main() {
+  const nodeMajor = parseInt(String(process.versions.node).split(".")[0], 10);
+  if (nodeMajor < 18 || typeof fetch !== "function") {
+    die(
+      `Node 18+ is required (found ${process.versions.node}) — the courier uses global fetch.\n` +
+        `            upgrade Node, or install via the canonical git submodule path:\n` +
+        `            git submodule add https://github.com/${REPO}.git .promptkit && ./.promptkit/init.sh`
+    );
+  }
   const version = PKG.version;
   if (version === "0.0.0") {
     die(
@@ -193,7 +220,7 @@ async function main() {
         "  npx promptkit-os@latest --lite\n" +
         "  npx promptkit-os@latest --turbo --experimental\n" +
         "  npx promptkit-os@latest /path/to/project\n\n" +
-        "Pass-through flags: --lite --balanced --turbo --experimental --host= --target= --tracking= --reconfigure\n" +
+        "Pass-through flags: --lite --balanced --turbo --experimental --host= --add-host= --target= --tracking= --reconfigure\n" +
         "Courier flags: --force (overlay a non-empty .promptkit/; not recommended)\n\n" +
         "Updating an existing install? Use the canonical path instead:\n" +
         "  git submodule update --remote --merge .promptkit && bash .promptkit/init.sh\n\n" +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "promptkit-os",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Courier for PromptKit OS: fetches a pinned release tarball and runs the canonical installer. Not a runtime dependency.",
   "keywords": [
     "promptkit",
@@ -25,13 +25,14 @@
   },
   "files": [
     "bin/promptkit-os.js",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "engines": {
     "node": ">=18"
   },
   "scripts": {
-    "test": "bash test/smoke.sh"
+    "test": "bash -c 'if [ -d test ]; then bash test/smoke.sh; fi'"
   },
   "publishConfig": {
     "access": "public",