skillwiki 0.9.55 → 0.9.57

package/dist/cli.js

@@ -66,6 +66,7 @@ import {
   runQuery,
   runSkillwikiMcpStdio,
   runStale,
+  runSyncLintDelta,
   runTagAudit,
   runTopicMapCheck,
   runValidate,
@@ -75,13 +76,15 @@ import {
   scanVault,
   snapshotterAliasForLocalHost,
   splitFrontmatter,
-  triggerAutoUpdate,
-  writeCache,
   writeDotenv
-} from "./chunk-4BT3HY4K.js";
+} from "./chunk-NIPZVIHT.js";
 import {
-  normalizeDistTag
-} from "./chunk-E6UWZ3S3.js";
+  normalizeDistTag,
+  readCache,
+  resolveAutoApplyAt,
+  triggerAutoUpdate,
+  writeCache
+} from "./chunk-7I2TPIV5.js";
 
 // src/cli.ts
 import { join as join26 } from "path";
@@ -1956,11 +1959,14 @@ async function runUpdate(input) {
       result: err("PREFLIGHT_FAILED", { message: `Failed to query npm registry: ${String(e)}` })
     };
   }
+  const { firstSeenAt, autoApplyAt } = resolveAutoApplyAt(readCache(input.home).cache, latest);
   const cache = {
     lastCheck: Date.now(),
     latestVersion: latest,
     currentVersion,
-    distTag: tag
+    distTag: tag,
+    firstSeenAt,
+    autoApplyAt
   };
   if (latest === currentVersion) {
     writeCache(input.home, cache);
@@ -3720,15 +3726,51 @@ async function runSyncPush(input) {
       })
     };
   }
-  const lintResult = await runLint({ vault, days: 90, lines: 200, logThreshold: 500 });
-  if (lintResult.result.ok && lintResult.result.data.summary.errors > 0) {
-    return {
-      exitCode: ExitCode.LINT_HAS_ERRORS,
-      result: err("LINT_ERRORS_BLOCK_PUSH", {
-        errors: lintResult.result.data.summary.errors,
-        buckets: lintResult.result.data.by_severity.error
-      })
-    };
+  let delta = { full_errors: 0, base_errors: 0, new_errors: 0, resolved_errors: 0 };
+  const preferredBase = git(vault, ["rev-parse", "--verify", "origin/main"]) ? "origin/main" : git(vault, ["rev-parse", "--verify", "origin/HEAD"]) ? "origin/HEAD" : "";
+  if (preferredBase) {
+    const deltaResult = await runSyncLintDelta({ vault, baseRef: preferredBase });
+    if (!deltaResult.result.ok) {
+      return {
+        exitCode: ExitCode.LINT_HAS_ERRORS,
+        result: err("LINT_DELTA_UNAVAILABLE", {
+          message: "lint-delta evidence missing or failed \u2014 fail closed",
+          detail: deltaResult.result
+        })
+      };
+    }
+    delta = deltaResult.result.data;
+    if (delta.new_errors > 0) {
+      return {
+        exitCode: ExitCode.LINT_HAS_ERRORS,
+        result: err("LINT_NEW_ERRORS_BLOCK_PUSH", {
+          full_errors: delta.full_errors,
+          base_errors: delta.base_errors,
+          new_errors: delta.new_errors,
+          resolved_errors: delta.resolved_errors,
+          new_fingerprints: deltaResult.result.data.new_fingerprints
+        })
+      };
+    }
+  } else {
+    const lintResult = await runLint({ vault, days: 90, lines: 200, logThreshold: 500 });
+    if (lintResult.result.ok) {
+      const fullErrors = lintResult.result.data.summary.errors;
+      delta = { full_errors: fullErrors, base_errors: 0, new_errors: fullErrors, resolved_errors: 0 };
+      if (fullErrors > 0) {
+        const buckets = "by_severity" in lintResult.result.data ? lintResult.result.data.by_severity.error : [];
+        return {
+          exitCode: ExitCode.LINT_HAS_ERRORS,
+          result: err("LINT_ERRORS_BLOCK_PUSH", {
+            errors: fullErrors,
+            buckets,
+            message: "no origin base ref for delta; absolute lint errors block push"
+          })
+        };
+      }
+    } else {
+      delta = { full_errors: 0, base_errors: 0, new_errors: 0, resolved_errors: 0 };
+    }
   }
   try {
     stageVaultContentChanges(vault);
@@ -3771,6 +3813,7 @@ async function runSyncPush(input) {
       })
     };
   }
+  const inheritedNote = delta.full_errors > 0 ? `; lint full=${delta.full_errors} base=${delta.base_errors} new=${delta.new_errors} resolved=${delta.resolved_errors} (inherited debt only)` : `; lint full=0 new=0`;
   return {
     exitCode: ExitCode.OK,
     result: ok({
@@ -3778,7 +3821,11 @@ async function runSyncPush(input) {
       commit_message: commitMessage,
       pushed,
       path_fixes: pathFixes,
-      humanHint: `committed and pushed ${dirtyFiles.length} file(s)${pathFixes > 0 ? ` after ${pathFixes} long-path fix(es)` : ""}`
+      lint_full_errors: delta.full_errors,
+      lint_base_errors: delta.base_errors,
+      lint_new_errors: delta.new_errors,
+      lint_resolved_errors: delta.resolved_errors,
+      humanHint: `committed and pushed ${dirtyFiles.length} file(s)${pathFixes > 0 ? ` after ${pathFixes} long-path fix(es)` : ""}${inheritedNote}`
     })
   };
 }
@@ -5493,6 +5540,11 @@ syncCmd.command("peers [vault]").description("list active locks and recent wiki-
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
   else emit(runSyncPeers({ vault: v.vault, sessionId: getCliSessionId() }));
 });
+syncCmd.command("lint-delta [vault]").description("compare lint errors against a base ref; block only on new errors").option("--base-ref <ref>", "base git ref to compare against", "origin/main").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else emit(await runSyncLintDelta({ vault: v.vault, baseRef: opts.baseRef }));
+});
 var backupCmd = program.command("backup").description("manage S3-compatible remote backup");
 backupCmd.command("sync [vault]").description("sync vault to S3-compatible remote backup").option("--dry-run", "list actions without executing").option("--bucket <name>", "S3 bucket name").option("--endpoint <url>", "S3 endpoint URL").option("--region <region>", "S3 region", "us-east-1").option("--prune", "delete orphaned S3 objects not in vault", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);

package/dist/skillwiki-mcp.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-4BT3HY4K.js";
-import "./chunk-E6UWZ3S3.js";
+} from "./chunk-NIPZVIHT.js";
+import "./chunk-7I2TPIV5.js";
 
 // src/mcp-entry.ts
 runSkillwikiMcpStdio().catch((error) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.9.55",
+  "version": "0.9.57",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.9.55",
+  "version": "0.9.57",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 18 prompt-only skills (wiki-*, proj-*, using-skillwiki) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.9.55",
+  "version": "0.9.57",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 18 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/README.md

@@ -1,11 +1,22 @@
 # @skillwiki/skills
 
-Prompt-only Markdown skills for Claude Code. Installed via `skillwiki install`.
+Prompt-only Markdown skills for Claude Code. Installed via `skillwiki install`
+or the Claude/Codex/Antigravity plugin packaging paths.
+
+Current package inventory: **18 skills**.
 
 | Namespace | Skills |
 |---|---|
-| `wiki-*` | `wiki-init`, `wiki-ingest`, `wiki-query`, `wiki-lint`, `wiki-crystallize`, `wiki-audit` |
+| `wiki-*` | `wiki-init`, `wiki-ingest`, `wiki-query`, `wiki-lint`, `wiki-crystallize`, `wiki-audit`, `wiki-archive`, `wiki-reingest`, `wiki-adapter-prd`, `wiki-add-task`, `wiki-sync`, `wiki-canvas`, `wiki-gate-plan-mode` |
 | `proj-*` | `proj-init`, `proj-work`, `proj-distill`, `proj-decide` |
+| onboarding | `using-skillwiki` |
+
+Verify the live inventory from source:
+
+```bash
+find packages/skills -mindepth 2 -maxdepth 2 -name SKILL.md -print | sort
+bash scripts/verify-manifests.sh
+```
 
 Each top-level skill subdirectory holds one canonical `SKILL.md`. The nested
 `skills/<skill>/SKILL.md` tree mirrors those files for Codex plugin discovery;
@@ -20,3 +31,6 @@ Codex-specific hook files. That root exposes `hooks/hooks-codex.json` and
 Run `npm run materialize:plugins` from the repository root after changing
 canonical skill, agent, or hook assets. Run
 `npm run materialize:plugins:check` for read-only drift detection.
+
+The sibling `vault-sync` plugin ships six additional operational skills under
+`packages/vault-sync/skills/` and is packaged separately from this skill set.

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.9.55",
+  "version": "0.9.57",
   "private": true,
   "files": [
     "wiki-*",

package/skills/skills/wiki-sync/SKILL.md

@@ -44,8 +44,8 @@ On every invocation, count `wiki-sync:*` stashes older than 24 hours via `skillw
 
 ### Push workflow
 4. If vault is dirty, ask the user to review uncommitted changes before proceeding.
-5. Run `skillwiki lint <vault>`. If errors exist, stop and report — do not push lint errors to remote.
-6. If lint passes (errors = 0), stage and commit:
+5. Run `skillwiki sync lint-delta <vault> --base-ref origin/main`. Block only when `new_errors > 0`. Report full/base/new/resolved. Malformed delta evidence fails closed — do not push.
+6. If lint-delta allows (new_errors = 0), stage and commit:
    - `git -C <vault> add -A`
    - `git -C <vault> commit -m "sync: vault update $(date -u +%Y-%m-%dT%H:%MZ)"`
 7. Run `git -C <vault> push origin HEAD`. Report result.
@@ -62,7 +62,7 @@ On every invocation, count `wiki-sync:*` stashes older than 24 hours via `skillw
     MSG="wiki-sync:${SESSION_ID}:${CWD_HASH}:${ISO_TS}:pre-pull"
     git -C "$VAULT" stash push -m "$MSG"
     ```
-11. Run `git -C <vault> pull --rebase origin HEAD`. Report result.
+11. Prefer the canonical pull helper (`wiki-pull-with-auto-resolve.sh` / vault-presync `--execute`) so stale-clean rebase state uses recovery-ref + `rebase --quit`, active rebases fail closed, and only fully materialized commits are dropped. If invoking git directly: `git -C <vault> pull --rebase origin HEAD`. Report result.
 12. If a stash was created, pop it: `git -C <vault> stash pop`.
 13. If conflicts occur during stash pop, identify them and present to the user for resolution (see Conflict Resolution below).
 14. Run `skillwiki lint <vault>` after pull to verify vault integrity.
@@ -240,3 +240,20 @@ bash ~/.hermes/scripts/wiki-snapshot.sh  # Re-sync fresh
 - Modifying files in `raw/` to resolve conflicts (N9 — archive and re-ingest instead).
 - Stashing without the `wiki-sync:...` name format (breaks peer detection).
 - Force-deleting a peer's lockfile (use `--force` only if peer is confirmed dead).
+
+## Convergence safeguards (2026-07-11)
+
+### Rebase-state classification
+- `stale-clean`: recovery ref at tip + `git rebase --quit` (preserves advanced tip; never abort-reset to orig-head).
+- `active` (REBASE_HEAD / UU paths): leave untouched; fail closed.
+- Recovery refs live under `refs/vault-sync/recovery/<UTC timestamp>`.
+
+### Materialized-commit proof
+Drop a local commit from rebase only when every path is proven present on the target ref (exact blobs; byte-identical added `## ` log sections). Partial/raw/rename mismatches retain or stop.
+
+### Lint-delta fail-closed
+- Fingerprints: `<bucket>\0<page>\0<normalized-detail>`
+- CLI: `skillwiki sync lint-delta <vault> --base-ref origin/main`
+- Block publication only when `new_errors > 0`; inherited full debt remains visible.
+- Missing/malformed delta evidence blocks (never silent lint skip).
+

package/skills/wiki-sync/SKILL.md

@@ -44,8 +44,8 @@ On every invocation, count `wiki-sync:*` stashes older than 24 hours via `skillw
 
 ### Push workflow
 4. If vault is dirty, ask the user to review uncommitted changes before proceeding.
-5. Run `skillwiki lint <vault>`. If errors exist, stop and report — do not push lint errors to remote.
-6. If lint passes (errors = 0), stage and commit:
+5. Run `skillwiki sync lint-delta <vault> --base-ref origin/main`. Block only when `new_errors > 0`. Report full/base/new/resolved. Malformed delta evidence fails closed — do not push.
+6. If lint-delta allows (new_errors = 0), stage and commit:
    - `git -C <vault> add -A`
    - `git -C <vault> commit -m "sync: vault update $(date -u +%Y-%m-%dT%H:%MZ)"`
 7. Run `git -C <vault> push origin HEAD`. Report result.
@@ -62,7 +62,7 @@ On every invocation, count `wiki-sync:*` stashes older than 24 hours via `skillw
     MSG="wiki-sync:${SESSION_ID}:${CWD_HASH}:${ISO_TS}:pre-pull"
     git -C "$VAULT" stash push -m "$MSG"
     ```
-11. Run `git -C <vault> pull --rebase origin HEAD`. Report result.
+11. Prefer the canonical pull helper (`wiki-pull-with-auto-resolve.sh` / vault-presync `--execute`) so stale-clean rebase state uses recovery-ref + `rebase --quit`, active rebases fail closed, and only fully materialized commits are dropped. If invoking git directly: `git -C <vault> pull --rebase origin HEAD`. Report result.
 12. If a stash was created, pop it: `git -C <vault> stash pop`.
 13. If conflicts occur during stash pop, identify them and present to the user for resolution (see Conflict Resolution below).
 14. Run `skillwiki lint <vault>` after pull to verify vault integrity.
@@ -240,3 +240,20 @@ bash ~/.hermes/scripts/wiki-snapshot.sh  # Re-sync fresh
 - Modifying files in `raw/` to resolve conflicts (N9 — archive and re-ingest instead).
 - Stashing without the `wiki-sync:...` name format (breaks peer detection).
 - Force-deleting a peer's lockfile (use `--force` only if peer is confirmed dead).
+
+## Convergence safeguards (2026-07-11)
+
+### Rebase-state classification
+- `stale-clean`: recovery ref at tip + `git rebase --quit` (preserves advanced tip; never abort-reset to orig-head).
+- `active` (REBASE_HEAD / UU paths): leave untouched; fail closed.
+- Recovery refs live under `refs/vault-sync/recovery/<UTC timestamp>`.
+
+### Materialized-commit proof
+Drop a local commit from rebase only when every path is proven present on the target ref (exact blobs; byte-identical added `## ` log sections). Partial/raw/rename mismatches retain or stop.
+
+### Lint-delta fail-closed
+- Fingerprints: `<bucket>\0<page>\0<normalized-detail>`
+- CLI: `skillwiki sync lint-delta <vault> --base-ref origin/main`
+- Block publication only when `new_errors > 0`; inherited full debt remains visible.
+- Missing/malformed delta evidence blocks (never silent lint skip).
+

package/dist/chunk-E6UWZ3S3.js

@@ -1,62 +0,0 @@
-#!/usr/bin/env node
-
-// src/utils/semver.ts
-function semverGt(a, b) {
-  const pa = parseSemver(a);
-  const pb = parseSemver(b);
-  if (!pa || !pb) return a > b;
-  if (pa.major !== pb.major) return pa.major > pb.major;
-  if (pa.minor !== pb.minor) return pa.minor > pb.minor;
-  if (pa.patch !== pb.patch) return pa.patch > pb.patch;
-  if (!pa.pre && pb.pre) return true;
-  if (pa.pre && !pb.pre) return false;
-  if (!pa.pre && !pb.pre) return false;
-  const aParts = pa.pre.split(".");
-  const bParts = pb.pre.split(".");
-  const len = Math.max(aParts.length, bParts.length);
-  for (let i = 0; i < len; i++) {
-    const ai = aParts[i];
-    const bi = bParts[i];
-    if (ai === void 0) return false;
-    if (bi === void 0) return true;
-    const aNum = parseInt(ai, 10);
-    const bNum = parseInt(bi, 10);
-    if (!isNaN(aNum) && !isNaN(bNum)) {
-      if (aNum !== bNum) return aNum > bNum;
-    } else {
-      if (ai !== bi) return ai > bi;
-    }
-  }
-  return false;
-}
-function parseSemver(version) {
-  const match = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);
-  if (!match) return null;
-  return {
-    major: parseInt(match[1], 10),
-    minor: parseInt(match[2], 10),
-    patch: parseInt(match[3], 10),
-    pre: match[4] ?? null
-  };
-}
-
-// src/utils/update-consts.ts
-var DIST_TAG = "latest";
-var CACHE_FILENAME = ".update-cache.json";
-var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var ENV_DISABLE_KEY = "NO_UPDATE_NOTIFIER";
-var CLI_DISABLE_FLAG = "--no-update-notifier";
-function normalizeDistTag(tag) {
-  const value = (tag ?? DIST_TAG).trim();
-  return /^[A-Za-z0-9._-]+$/.test(value) ? value : DIST_TAG;
-}
-
-export {
-  semverGt,
-  DIST_TAG,
-  CACHE_FILENAME,
-  CHECK_INTERVAL_MS,
-  ENV_DISABLE_KEY,
-  CLI_DISABLE_FLAG,
-  normalizeDistTag
-};