worclaude 2.4.7 → 2.4.9

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to worclaude are documented in this file. Format loosely fol
 
 ## [Unreleased]
 
+## [2.4.9] — 2026-04-20
+
+CI fix release — the daily `upstream-check` workflow failed at `anthropics/claude-code-action` with `Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable`. The action exchanges an OIDC token for a GitHub App token before the Anthropic API auth layer runs; that exchange requires `id-token: write` in workflow permissions regardless of `CLAUDE_CODE_OAUTH_TOKEN`. Prior runs succeeded intermittently because GitHub does not consistently inject the token URL when no job in the run declares the permission.
+
+### Fixed
+
+- `.github/workflows/upstream-check.yml` now grants `id-token: write` alongside `contents: write` and `issues: write`. Matches the canonical workflow template at `anthropics/claude-code-action/examples/claude.yml`.
+
+### Changed
+
+- `docs/reference/upstream-automation.md` — permissions row lists all three permissions with a note on why `id-token: write` is required.
+
+## [2.4.8] — 2026-04-20
+
+Bug fix release — `worclaude doctor` reported `File integrity: 1/54 files missing` on every v2.4.6+ install. `checkHashIntegrity` resolved every `workflow-meta.json` `fileHashes` key under `.claude/`, so `root/AGENTS.md` (tracked at project root since v2.4.6) got looked up at `.claude/root/AGENTS.md` — which doesn't exist. `worclaude upgrade` already handled the `root/` prefix correctly; only doctor had missed the update.
+
+### Fixed
+
+- `worclaude doctor` now uses the shared `resolveKeyPath` helper from `src/core/file-categorizer.js` for every `fileHashes` key, so `root/<path>` entries resolve at the project root and `hooks/<name>` entries resolve under `.claude/hooks/`. No behavior change for `agents/`, `commands/`, or `skills/` keys.
+
+### Changed
+
+- `docs/reference/configuration.md` — `fileHashes` example extended with `hooks/` and `root/` entries and a one-line description of the key-prefix vocabulary. The field description no longer claims scope is "all files in `.claude/`" — that stopped being true in v2.4.6 when `root/AGENTS.md` started being tracked.
+
 ## [2.4.7] — 2026-04-20
 
 Bug fix release — the learn-capture Stop hook writes `.claude/.stop-hook-active` as a runtime re-entry guard, but the scaffolded `.gitignore` never covered it. Every project scaffolded or upgraded to 2.4.6 saw a dirty `git status` right after the Stop hook fired. `worclaude delete` also left the now-stale line in `.gitignore`. Both are fixed symmetrically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "worclaude",
-  "version": "2.4.7",
+  "version": "2.4.9",
   "description": "The Workflow Layer for Claude Code — scaffold agents, commands, skills, hooks, and memory into any project",
   "type": "module",
   "bin": {

package/src/commands/doctor.js

@@ -11,6 +11,7 @@ import {
   TEMPLATE_SKILLS,
 } from '../data/agents.js';
 import { hasClaudeMdMemoryGuidance, readClaudeMd } from '../core/drift-checks.js';
+import { resolveKeyPath } from '../core/file-categorizer.js';
 import * as display from '../utils/display.js';
 
 // Check categories
@@ -534,7 +535,7 @@ async function checkHashIntegrity(projectRoot, meta) {
   let intact = 0;
 
   for (const [relPath, storedHash] of Object.entries(meta.fileHashes)) {
-    const fullPath = path.join(projectRoot, '.claude', ...relPath.split('/'));
+    const fullPath = resolveKeyPath(relPath, projectRoot);
     if (!(await fileExists(fullPath))) {
       missing++;
     } else {