vgxness 1.20.5 → 1.20.7

package/docs/sdd/archive/2026-06-26-provider-install-adapter-boundary/design.md

@@ -0,0 +1,64 @@
+# Design: Provider Install Adapter Boundary
+
+## Technical Approach
+
+Perform a structural-only provider install migration. Move implementation modules out of `src/mcp` while keeping old files as facades. Prefer provider-owned canonical folders under `src/adapters/opencode/install/` and `src/adapters/claude/install/`; use application-provider-setup only for provider-neutral orchestration if needed.
+
+## Architecture Decisions
+
+### Decision: Provider install implementation belongs under adapters
+
+**Choice**: Canonical provider install/config modules live in `src/adapters/<provider>/install/`.
+**Alternatives considered**: Put everything in `src/application/provider-setup`.
+**Rationale**: Config file formats, CLI invocation, managed-memory formats, and provider-specific merge/write behavior are adapter details. Application services should orchestrate neutral workflows, not own provider formats.
+
+### Decision: Keep MCP import facades
+
+**Choice**: `src/mcp/client-install-*`, `src/mcp/claude-code-*`, and `src/mcp/opencode-*` remain re-export facades during this change.
+**Alternatives considered**: Rewrite all consumers directly to adapters immediately.
+**Rationale**: Compatibility keeps the move low risk and independently revertible.
+
+### Decision: Split by provider
+
+**Choice**: OpenCode and Claude Code moves are separate apply slices.
+**Alternatives considered**: Single full move.
+**Rationale**: Current line counts are high (`client-install-opencode.ts` alone is >600 lines). Provider slicing keeps review diffs smaller and narrows regressions.
+
+## Data Flow
+
+```text
+interfaces/mcp tool handler ──→ application/provider-setup boundary ──→ adapters/<provider>/install
+         ▲                                                                    │
+         └──────────── old src/mcp/* compatibility facades ───────────────────┘
+```
+
+## File Changes
+
+| File | Action | Description |
+|---|---|---|
+| `src/adapters/opencode/install/*` | Create | Canonical OpenCode install contract, apply, visibility/default config helpers. |
+| `src/adapters/claude/install/*` | Create | Canonical Claude install contract, apply, config, memory, scope, CLI helpers. |
+| `src/mcp/client-install-*` | Modify | Re-export canonical adapter modules. |
+| `src/mcp/claude-code-*`, `src/mcp/opencode-*` | Modify | Re-export canonical adapter modules. |
+| `test/mcp/*` | Modify | Update direct implementation-path assertions/imports where needed. |
+| `docs/module-boundaries.md` | Modify | Replace deferred-path note with completed canonical ownership. |
+
+## Interfaces / Contracts
+
+No product contract changes. Existing exported TypeScript types and functions remain available from old paths through facades.
+
+## Testing Strategy
+
+| Layer | What to Test | Approach |
+|---|---|---|
+| Type contracts | Old and new imports | `npx tsc --noEmit` |
+| Unit/contract | Provider install planning/apply | Existing `test/mcp/*install*` suites |
+| Runtime/package | Bun/provider package evidence | GitHub `Bun verify` and package evidence checks |
+
+## Migration / Rollout
+
+No data migration required. Roll out in stacked PRs: SDD docs, OpenCode move, Claude Code move, cleanup/docs verification.
+
+## Open Questions
+
+None.

package/docs/sdd/archive/2026-06-26-provider-install-adapter-boundary/proposal.md

@@ -0,0 +1,62 @@
+# Proposal: Provider Install Adapter Boundary
+
+## Intent
+
+Move provider-install implementation details out of the MCP edge so the physical structure matches the post-reorganization boundary rules. MCP should expose tools and delegate; provider config formats, filesystem merge/write policies, and provider-specific CLI integration should live in adapters or provider-setup application services.
+
+## Scope
+
+### In Scope
+- Move OpenCode install contract/apply helpers from `src/mcp/client-install-opencode*` to canonical adapter/application-owned modules.
+- Move Claude Code install contract/apply helpers from `src/mcp/client-install-claude-code*` and `src/mcp/claude-code-*` to canonical adapter/application-owned modules.
+- Keep old `src/mcp/*` imports as compatibility facades.
+- Update tests/docs for canonical paths.
+
+### Out of Scope
+- Changing MCP tool names or provider install behavior.
+- Changing provider config schemas, backup semantics, or safety gates.
+- Removing old import paths without a compatibility bridge.
+
+## Capabilities
+
+### New Capabilities
+None.
+
+### Modified Capabilities
+None — this is an internal structural refactor.
+
+## Approach
+
+Split by provider in small reviewable slices: OpenCode first, then Claude Code. For each provider, move implementation modules under `src/adapters/<provider>/install/` or shared provider setup services, leave `src/mcp/*` as re-export facades, run typecheck and targeted MCP/provider tests.
+
+## Affected Areas
+
+| Area | Impact | Description |
+|---|---|---|
+| `src/mcp/client-install-*` | Modified | Become compatibility facades. |
+| `src/mcp/claude-code-*`, `src/mcp/opencode-*` | Modified | Move provider-specific implementation to adapter boundary. |
+| `src/adapters/opencode/*`, `src/adapters/claude/*` | Modified | Own provider install/render/config details. |
+| `test/mcp/*` | Modified | Prefer canonical adapter imports where tests inspect internals. |
+| `docs/module-boundaries.md` | Modified | Remove or update deferred-path note. |
+
+## Risks
+
+| Risk | Likelihood | Mitigation |
+|---|---:|---|
+| Large import churn | Medium | Split into OpenCode and Claude slices. |
+| Behavior drift in provider install | Medium | Keep facades, run existing install contract/apply tests and CI. |
+| Circular dependencies | Medium | Keep shared provider-neutral contracts outside provider adapters. |
+
+## Rollback Plan
+
+Each provider slice is independently revertible. If CI fails, revert the provider-specific move while keeping SDD artifacts.
+
+## Dependencies
+
+- Archived `ambitious-structure-reorganization` SDD and its final module-boundary docs.
+
+## Success Criteria
+
+- [ ] MCP provider-install files are implementation-free facades.
+- [ ] Provider-specific install/config code has canonical owners outside `src/mcp`.
+- [ ] Existing install behavior and tool contracts continue passing tests and CI.

package/docs/sdd/archive/2026-06-26-provider-install-adapter-boundary/spec.md

@@ -0,0 +1,51 @@
+# Spec: Provider Install Adapter Boundary
+
+## Requirements
+
+### Requirement: MCP Install Boundary
+
+MCP provider-install modules MUST not own provider-specific install implementation after the migration.
+
+#### Scenario: MCP old paths remain compatible
+
+- GIVEN an existing import from `src/mcp/client-install-opencode.ts` or `src/mcp/client-install-claude-code.ts`
+- WHEN TypeScript typecheck runs
+- THEN the import still compiles through a compatibility facade
+
+#### Scenario: MCP does not own provider install behavior
+
+- GIVEN a maintainer inspects provider-install implementation
+- WHEN they follow the facade export
+- THEN OpenCode and Claude Code install/config logic resolves to canonical adapter or application-provider-setup modules
+
+### Requirement: Provider Install Behavior Preservation
+
+The migration MUST preserve provider install semantics, safety gates, config merge rules, backup behavior, and rendered output.
+
+#### Scenario: OpenCode install contracts remain equivalent
+
+- GIVEN OpenCode MCP install contract tests
+- WHEN the OpenCode implementation is moved
+- THEN the existing contract tests pass without changing expected behavior
+
+#### Scenario: Claude Code install contracts remain equivalent
+
+- GIVEN Claude Code MCP install contract and apply tests
+- WHEN the Claude implementation is moved
+- THEN the existing tests pass without changing expected behavior
+
+### Requirement: Reviewable Provider Slices
+
+The migration SHOULD be split into provider-focused slices when the total diff would exceed the normal review budget.
+
+#### Scenario: OpenCode can land independently
+
+- GIVEN OpenCode install files are moved
+- WHEN typecheck and OpenCode-targeted tests pass
+- THEN that slice can be reviewed and merged without waiting for Claude Code
+
+#### Scenario: Claude can land independently
+
+- GIVEN Claude Code install files are moved
+- WHEN typecheck and Claude-targeted tests pass
+- THEN that slice can be reviewed and merged after or apart from OpenCode

package/docs/sdd/archive/2026-06-26-provider-install-adapter-boundary/tasks.md

@@ -0,0 +1,50 @@
+# Tasks: Provider Install Adapter Boundary
+
+## Review Workload Forecast
+
+| Field | Value |
+|---|---|
+| Estimated changed lines | 900–1,600 across full migration |
+| 400-line budget risk | High |
+| Chained PRs recommended | Yes |
+| Suggested split | SDD docs → OpenCode adapter move → Claude adapter move → cleanup/verify |
+| Delivery strategy | auto-chain |
+| Chain strategy | stacked-to-main |
+
+Decision needed before apply: No
+Chained PRs recommended: Yes
+Chain strategy: stacked-to-main
+400-line budget risk: High
+
+### Suggested Work Units
+
+| Unit | Goal | Likely PR | Notes |
+|---|---|---|---|
+| 1 | SDD planning packet | PR 1 | Docs only, base `main`. |
+| 2 | OpenCode install adapter move | PR 2 | Move OpenCode install/config helpers; keep MCP facades. |
+| 3 | Claude Code install adapter move | PR 3 | Move Claude install/config/memory/CLI helpers; keep MCP facades. |
+| 4 | Final docs/verify cleanup | PR 4 | Update boundary docs and archive SDD if complete. |
+
+## Phase 1: SDD Planning
+
+- [x] 1.1 Create `docs/sdd/provider-install-adapter-boundary/proposal.md`.
+- [x] 1.2 Create `docs/sdd/provider-install-adapter-boundary/spec.md`.
+- [x] 1.3 Create `docs/sdd/provider-install-adapter-boundary/design.md` and this `tasks.md`.
+
+## Phase 2: OpenCode Adapter Slice
+
+- [x] 2.1 Move `src/mcp/client-install-opencode*.ts` to `src/adapters/opencode/install/` with old-path facades.
+- [x] 2.2 Move `src/mcp/opencode-*.ts` helpers to `src/adapters/opencode/install/` or a better OpenCode adapter subfolder.
+- [x] 2.3 Update OpenCode-focused tests/import assertions and run targeted MCP provider tests.
+
+## Phase 3: Claude Code Adapter Slice
+
+- [x] 3.1 Move `src/mcp/client-install-claude-code*.ts` to `src/adapters/claude/install/` with old-path facades.
+- [x] 3.2 Move `src/mcp/claude-code-*.ts` helpers to `src/adapters/claude/install/`.
+- [x] 3.3 Update Claude-focused tests/import assertions and run targeted MCP provider tests.
+
+## Phase 4: Cleanup and Verification
+
+- [x] 4.1 Update `docs/module-boundaries.md` to remove the deferred-path warning or narrow remaining exceptions.
+- [x] 4.2 Run `npx tsc --noEmit`, targeted install tests, full Node tests, and remote Bun CI.
+- [x] 4.3 Add apply-progress, verify report, and archive report when implementation completes.

package/docs/sdd/archive/2026-06-26-provider-install-adapter-boundary/verify-report.md

@@ -0,0 +1,66 @@
+# Verify Report: Provider Install Adapter Boundary
+
+## Verdict
+
+PASS WITH WARNINGS.
+
+## Change
+
+- Change: `provider-install-adapter-boundary`
+- Mode: filesystem SDD artifacts under `docs/sdd/`
+- Verification date: 2026-06-26
+
+## Task Completeness
+
+| Phase | Status | Evidence |
+|---|---|---|
+| Phase 1 SDD Planning | PASS | `tasks.md` marks 1.1-1.3 complete. |
+| Phase 2 OpenCode Adapter Slice | PASS | `tasks.md` marks 2.1-2.3 complete. |
+| Phase 3 Claude Code Adapter Slice | PASS | `tasks.md` marks 3.1-3.3 complete. |
+| Phase 4 Cleanup and Verification | PASS | `tasks.md` marks 4.1-4.3 complete. |
+
+No unchecked implementation tasks remain.
+
+## Requirement Compliance Matrix
+
+| Requirement | Status | Evidence |
+|---|---|---|
+| MCP Install Boundary | PASS | `src/mcp/client-install-*`, `src/mcp/claude-code-*`, and `src/mcp/opencode-*` are compatibility facades; canonical implementation lives under `src/adapters/{opencode,claude}/install/*`. |
+| Provider Install Behavior Preservation | PASS | Targeted OpenCode/Claude/provider tests passed; full Node suite passed; no product-contract changes. |
+| Reviewable Provider Slices | PASS | SDD docs, OpenCode, Claude, and cleanup/archive landed as separate stacked slices. |
+
+## Design Coherence
+
+| Decision | Status | Evidence |
+|---|---|---|
+| Provider install implementation belongs under adapters | PASS | OpenCode and Claude Code install/config/memory helpers now live under `src/adapters/*/install/`. |
+| Keep MCP import facades | PASS | Old MCP files re-export canonical adapter modules. |
+| Split by provider | PASS | OpenCode and Claude moved in separate PR slices. |
+
+## Runtime Evidence
+
+| Command / Evidence | Result |
+|---|---|
+| `npx tsc --noEmit` | PASS |
+| `npm run build` | PASS |
+| `node scripts/run-node-tests.mjs` | PASS — 516 tests, 513 pass, 3 skipped, 0 fail |
+| `git diff --check` | PASS |
+| Local Bun verification | SKIPPED — local environment reports `bun-not-installed` |
+
+## Issues
+
+### Critical
+
+None.
+
+### Warnings
+
+- Local environment does not have `bun`; required GitHub PR checks provide Bun Runtime CI validation.
+
+### Suggestions
+
+- After downstream imports stabilize, consider a future cleanup to remove old MCP compatibility facades if they are no longer part of the public API.
+
+## Final Verdict
+
+PASS WITH WARNINGS. The implementation satisfies the SDD requirements, all tasks are complete, and no critical issues block archive.

package/docs/sdd/manager-prompt-autonomy/apply-progress.md

@@ -0,0 +1,28 @@
+# Apply Progress: Manager Prompt Autonomy
+
+## Completed Tasks
+
+- [x] 1.1 Bump canonical prompt contract version to v19.
+- [x] 1.2 Add compact OpenCode instruction-layering guidance.
+- [x] 1.3 Add exact user-request / immediate confirmation guidance for `explicitRequest` and duplicate-confirmation avoidance.
+- [x] 2.1 Regenerate `seeds/agents/agent-seed-v1.json` from canonical projection.
+- [x] 2.2 Update OpenCode config drift assertions for v19 and prompt anchors.
+- [x] 2.3 Add permission evaluator coverage for user-requested test-run and git push.
+- [x] 3.1 Run focused tests and typecheck.
+- [x] 3.2 Reinstall local OpenCode config from the source checkout for smoke verification.
+
+## Verification Evidence
+
+- `npx biome check --write --unsafe src/domain/agents/canonical-agent-manifest.ts test/mcp/opencode-agent-config-drift.test.ts test/permissions/policy-evaluator.test.ts` passed.
+- `node --import tsx --test test/mcp/opencode-agent-config-drift.test.ts test/permissions/policy-evaluator.test.ts` passed: 29/29.
+- `npx tsc --noEmit` passed.
+- `bun test test/agents/agent-seed-service.test.ts` passed: 10/10.
+- `npm run build` passed.
+- Local checkout runtime evidence showed `promptContractVersion: 19` and entrypoint `dist/cli/bun-bin.js`.
+- `vgxness mcp install opencode --yes --reinstall --json` installed user OpenCode config.
+- `vgxness mcp doctor opencode --scope user --json` reported ready.
+- Config smoke: default agent `vgxness-manager`, prompt v19, instruction layering present, hazlo/dale autonomy present, duplicate-confirmation avoidance present, no missing referenced `vgxness_*` permissions, manager bash `deny`, top-level bash `ask`.
+
+## Remaining Tasks
+
+- [ ] 3.3 Create PR, watch CI, and merge if clean.

package/docs/sdd/manager-prompt-autonomy/design.md

@@ -0,0 +1,63 @@
+# Design: Manager Prompt Autonomy
+
+## Technical Approach
+
+Make the smallest durable change in canonical sources: update the manager prompt contract, regenerate the seed snapshot, and pin behavior with prompt-drift and permission tests. This keeps generated OpenCode config as an output, not a hand-edited source.
+
+## Architecture Decisions
+
+### Decision: Prompt owns conversational friction guidance
+
+**Choice**: Teach the manager how to interpret direct user intent and immediate “hazlo”/“dale” confirmations.
+**Alternatives considered**: Add broad automatic policy allows; remove preflight; edit OpenCode config permissions.
+**Rationale**: Preflight is still useful for audit and hard stops. The friction came from the manager treating a user confirmation as expanded/ambiguous rather than binding it to the concrete operations it just listed.
+
+### Decision: Policy remains exact-match based
+
+**Choice**: Keep `evaluateExplicitRequestAuthorization` strict; add tests proving exact explicit requests allow test and push operations.
+**Alternatives considered**: Loosen parser expansion rules globally.
+**Rationale**: Loosening global policy would risk over-authorizing vague requests. The correct behavior is to generate exact `explicitRequest` context when the conversation is exact.
+
+### Decision: OpenCode instruction layering is documented inside the manager prompt
+
+**Choice**: Add a compact `## Instruction layering` section.
+**Rationale**: OpenCode replaces provider base prompts when `agent.prompt` exists, then appends env/instructions/MCP/skills. The manager must be self-aware about this layered context.
+
+## Data Flow
+
+```text
+User asks concrete action
+  -> manager records exact explicitRequest
+  -> vgxness_run_preflight evaluates policy/risk
+  -> authorizationMode explicit-request => execute without re-asking
+  -> approval-needed/blocked/ambiguous => stop or ask focused question
+```
+
+## File Changes
+
+| File | Action | Description |
+|------|--------|-------------|
+| `src/domain/agents/canonical-agent-manifest.ts` | Modify | Prompt contract v19, layering and exact-request guidance. |
+| `seeds/agents/agent-seed-v1.json` | Regenerate | Seed snapshot aligned with canonical projection. |
+| `test/mcp/opencode-agent-config-drift.test.ts` | Modify | Version/anchor/budget assertions. |
+| `test/permissions/policy-evaluator.test.ts` | Modify | Tests for explicit user-requested test-run/git push. |
+
+## Interfaces / Contracts
+
+No public API shape changes. Existing `explicitRequest` schema remains the contract.
+
+## Testing Strategy
+
+| Layer | What to Test | Approach |
+|-------|-------------|----------|
+| Unit | Exact explicit requests authorize test-run and git push | `test/permissions/policy-evaluator.test.ts` |
+| Projection | OpenCode prompt contains layering/autonomy anchors and seed matches canonical projection | `test/mcp/opencode-agent-config-drift.test.ts`, `test/agents/agent-seed-service.test.ts` |
+| Type/build | No TS regressions | `npx tsc --noEmit` |
+
+## Migration / Rollout
+
+No data migration. Reinstall OpenCode config after release/local link to push the new prompt into `~/.config/opencode/opencode.json`.
+
+## Open Questions
+
+None.

package/docs/sdd/manager-prompt-autonomy/proposal.md

@@ -0,0 +1,57 @@
+# Proposal: Manager Prompt Autonomy
+
+## Intent
+
+Reduce friction when users explicitly ask VGXNESS/OpenCode to run concrete actions. The manager should recognize direct user requests and immediate confirmations such as “hazlo”/“dale” as authorization for the exact listed operations, while preserving hard stops for secrets, ambiguity, unsafe paths, destructive/privileged scope not named, and provider/global config mutation not explicitly requested.
+
+## Scope
+
+### In Scope
+- Clarify OpenCode prompt layering in the manager contract.
+- Teach the manager to pass `explicitRequest` for concrete user-requested operations and avoid duplicate confirmation when preflight allows `authorizationMode: "explicit-request"`.
+- Add regression coverage for user-requested test and git push operations.
+
+### Out of Scope
+- Removing SDD human acceptance requirements.
+- Allowing secrets, unsafe workspace escapes, or unnamed destructive/provider-global mutations.
+- Directly editing user OpenCode config in this change.
+
+## Capabilities
+
+### New Capabilities
+- None.
+
+### Modified Capabilities
+- `manager-prompt`: clarifies prompt layering and exact user-request authorization behavior.
+- `permissions`: regression coverage for explicit-request preflight authorization.
+
+## Approach
+
+Update the canonical manager prompt and registry seed instructions, bump the prompt contract version, regenerate the checked-in agent seed, and add focused permission/prompt drift tests.
+
+## Affected Areas
+
+| Area | Impact | Description |
+|------|--------|-------------|
+| `src/domain/agents/canonical-agent-manifest.ts` | Modified | Manager prompt contract and prompt version. |
+| `seeds/agents/agent-seed-v1.json` | Modified | Regenerated canonical seed. |
+| `test/mcp/opencode-agent-config-drift.test.ts` | Modified | Prompt anchors and contract version. |
+| `test/permissions/policy-evaluator.test.ts` | Modified | Explicit-request test-run/git push coverage. |
+
+## Risks
+
+| Risk | Likelihood | Mitigation |
+|------|------------|------------|
+| Over-authorizing vague confirmations | Medium | Limit “hazlo”/“dale” binding to immediately listed concrete operations; keep ambiguity hard stops. |
+| Prompt budget growth | Medium | Keep wording compact and assert byte budget. |
+
+## Rollback Plan
+
+Revert the prompt contract version, prompt text, seed snapshot, and test changes.
+
+## Success Criteria
+
+- [ ] Manager prompt documents OpenCode instruction layering.
+- [ ] Manager prompt avoids duplicate confirmation for exact user-requested operations.
+- [ ] Explicit-request preflight tests cover test-run and git push.
+- [ ] Focused OpenCode config drift and permission tests pass.

package/docs/sdd/manager-prompt-autonomy/tasks.md

@@ -0,0 +1,19 @@
+# Tasks: Manager Prompt Autonomy
+
+## Phase 1: Prompt contract
+
+- [x] 1.1 Bump canonical prompt contract version.
+- [x] 1.2 Add compact OpenCode instruction-layering guidance.
+- [x] 1.3 Add exact user-request / immediate confirmation guidance for `explicitRequest` and duplicate-confirmation avoidance.
+
+## Phase 2: Seed and regression coverage
+
+- [x] 2.1 Regenerate `seeds/agents/agent-seed-v1.json` from canonical projection.
+- [x] 2.2 Update OpenCode config drift assertions for v19 and prompt anchors.
+- [x] 2.3 Add permission evaluator coverage for user-requested test-run and git push.
+
+## Phase 3: Verification and rollout
+
+- [x] 3.1 Run focused tests and typecheck.
+- [x] 3.2 Reinstall local OpenCode config from the source checkout for smoke verification.
+- [ ] 3.3 Create PR, watch CI, and merge if clean.

package/docs/storage.md

@@ -34,7 +34,7 @@ Local SQLite storage is supported through `bun:sqlite`. Node.js is not the stora
 
 ## Migration layout
 
-SQL migrations live in `src/memory/sqlite/migrations/` and are applied in lexicographic order. The package build copies them into `dist/memory/sqlite/migrations` so installed bins can apply them on first use. The current migration list:
+SQL migrations live in `src/storage/memory/sqlite/migrations/` and are applied in lexicographic order. The package build copies them into `dist/storage/memory/sqlite/migrations` so installed bins can apply them on first use. The current migration list:
 
 | # | File | Adds |
 |---|---|---|
@@ -83,7 +83,7 @@ Memory observations are for reusable context, not raw work logs. Capture only in
 
 Prefer update over duplicate save: if a known observation `id` or `topicKey` already represents the fact, update that record so revision history stays attached to one durable topic. Do not save secrets, credentials, hidden reasoning, raw large logs, full transcripts, full SDD artifacts, or sensitive user data.
 
-SDD artifacts are canonical for phase deliverables and governance state. Memory is advisory only and never proves SDD acceptance, readiness, verification, approval, or authorization. Active-work memory remains advisory; it can summarize current context, but it does not replace runs, checkpoints, or artifacts. `memory-write` is a durable governed action and requires preflight/explicit consent when policy marks it governed or risky.
+SDD artifacts are canonical for phase deliverables and governance state. Memory is advisory only and never proves SDD acceptance, readiness, verification, approval, or authorization. Active-work memory remains advisory; it can summarize current context, but it does not replace runs, checkpoints, or artifacts. Ordinary qualifying `memory-write` operations are agent-decided and audit-only so the manager can preserve durable decisions, architecture choices, reusable project conventions, workflow preferences, and non-obvious gotchas without duplicate confirmation. Ask first when the content is sensitive, ambiguous, user-personal beyond stated preferences, or the user explicitly says not to persist it.
 
 ## Backup and recovery
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vgxness",
-  "version": "1.20.5",
+  "version": "1.20.7",
   "description": "CLI and MCP control plane for guided AI-agent workflows, SDD, memory, and OpenCode setup.",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
@@ -22,7 +22,7 @@
   "scripts": {
     "cli": "tsx src/cli/index.ts",
     "cli:bun": "bun src/cli/index.ts",
-    "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.build.json && node scripts/copy-migrations.mjs",
+    "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.build.json && node scripts/copy-migrations.mjs && node scripts/ensure-bin-executable.mjs",
     "verify": "bun run verify:typecheck && bun run verify:test && bun run verify:test:bun-storage && bun run verify:bun-sqlite && bun run verify:package",
     "verify:typecheck": "tsc --noEmit",
     "verify:test": "node scripts/run-node-tests.mjs",