diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 09e16ce..3453d08 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "gooblin", - "version": "1.3.1", + "version": "1.3.2", "description": "A geeky product-engineering team for AI coding agents.", "author": { "name": "jsleemaster", diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json index 6c1fb43..1f367fc 100644 --- a/.codex-plugin/plugin.json +++ b/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "gooblin", - "version": "1.3.1", + "version": "1.3.2", "description": "A geeky product-engineering team for AI coding agents.", "author": "jsleemaster", "homepage": "https://jsleemaster.github.io/gooblin/", diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 9518576..836ed89 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -20,11 +20,21 @@ jobs: steps: - name: Check out repository uses: actions/checkout@v4 + with: + fetch-depth: 2 - name: Set up Node uses: actions/setup-node@v4 with: node-version: ${{ matrix.node-version }} + - name: Check diff whitespace + if: matrix.node-version == 24 + run: git diff --check HEAD^ HEAD + - name: Run validation run: npm run validate + + - name: Check package payload + if: matrix.node-version == 24 + run: npm pack --dry-run diff --git a/README.md b/README.md index 7a7fbdd..95ee410 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@

- version 1.3.1 + version 1.3.2 license MIT plugin style agent skills @@ -141,8 +141,8 @@ npx gooblin install Current status: -- npm registry shorthand `gooblin@1.3.1` is published, but its destructive lifecycle commands are unsafe: it predates the refusal guard in this repository. Until a fixed version is published, do not run `npx gooblin install --force` or `npx gooblin uninstall` from the registry package. -- The GitHub-source installer contains the refusal guard and remains available for users who need the source version. +- Source package version `gooblin@1.3.2` contains the destructive-operation refusal guard. +- Before using registry lifecycle commands, run `npx --yes gooblin --version`. Version 1.3.1 does not contain the guard; use those commands only after the resolved version is 1.3.2 or newer. Repository-source fallback: @@ -150,7 +150,7 @@ Repository-source fallback: npx github:jsleemaster/gooblin install ``` -The source installer writes `.gooblin/` in the target project. It does not enable hooks, edit host settings, access the network, or collect telemetry. Use `--dry-run`, `--target

`, and `status` to inspect the copy. Until ownership manifests are implemented in [#49](https://github.com/jsleemaster/gooblin/issues/49), this source version refuses `--force` replacement and `uninstall`. The published npm 1.3.1 package does **not** contain that guard; [#57](https://github.com/jsleemaster/gooblin/issues/57) remains open until a fixed registry version is published and verified. +The 1.3.2 source installer writes `.gooblin/` in the target project. It does not enable hooks, edit host settings, access the network, or collect telemetry. Use `--dry-run`, `--target `, and `status` to inspect the copy. Until ownership manifests are implemented in [#49](https://github.com/jsleemaster/gooblin/issues/49), version 1.3.2 and newer refuse `--force` replacement and `uninstall`. Version 1.3.1 does **not** contain that guard; verify the resolved version before using registry lifecycle commands. ### Manual fallback diff --git a/docs/compatibility.md b/docs/compatibility.md index e958b27..0f52426 100644 --- a/docs/compatibility.md +++ b/docs/compatibility.md @@ -2,7 +2,7 @@ These notes record what has actually been checked. They are not marketplace approval claims. -Current package version: `1.3.1`. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked. +Current source package version: `1.3.2`. Registry state must be checked separately with `npm view gooblin version dist-tags --json`; version 1.3.1 lacks the destructive-operation guard and version 1.3.2 includes it. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked. ## Latest Local Verification @@ -38,7 +38,7 @@ Result: `gooblin@gooblin` installed with version `1.2.0` and status `installed, ## npx Installer Status -Release `v1.3.1` verifies the npm registry shorthand for the minimal dependency-free bin installer: +At 1.3.2 release preparation on 2026-07-13, published npm `v1.3.1` was the last verified registry version. Its previously verified fresh-copy command was: ```bash npx gooblin install @@ -46,7 +46,7 @@ npx gooblin install The installer copies readable Gooblin files into `.gooblin/` and does not enable hooks, edit host settings, access the network, or collect telemetry. -Safety boundary: published npm 1.3.1 predates the destructive-operation refusal guard. Its fresh-copy path is available, but do not run `install --force` or `uninstall` from that registry package. The repository-source installer contains the guard; #57 stays open until a fixed npm version is published and verified. +Safety boundary: version 1.3.1 predates the destructive-operation refusal guard. Its fresh-copy path is available, but do not run `install --force` or `uninstall` with that version. Version 1.3.2 and newer contain the refusal guard; verify the resolved registry version before lifecycle commands. Repository-source fallback remains available: diff --git a/docs/install.md b/docs/install.md index 071661b..bf527e2 100644 --- a/docs/install.md +++ b/docs/install.md @@ -51,8 +51,8 @@ Current status: | Path | Status | | --- | --- | -| `npx gooblin install` | Published npm 1.3.1 supports fresh copies, but its `install --force` and `uninstall` paths can delete consumer-owned files. Do not use those lifecycle commands. | -| `npx github:jsleemaster/gooblin install` | Repository-source fallback containing the temporary destructive-operation refusal guard. | +| `npx gooblin install` | Registry behavior depends on the resolved version. Version 1.3.1 can delete consumer-owned files through `install --force` and `uninstall`; version 1.3.2 and newer refuse those operations. | +| `npx github:jsleemaster/gooblin install` | Repository-source version 1.3.2 containing the temporary destructive-operation refusal guard. | The installer copies a readable skill pack into `.gooblin/` in the current working directory. It copies: @@ -74,7 +74,7 @@ npx gooblin status npx gooblin uninstall ``` -Temporary safety guard: the source installer in this repository refuses `install --force` and `uninstall` because the current marker cannot distinguish installed files from consumer-owned additions or edits. Published npm 1.3.1 predates this guard; do not use those two registry-package lifecycle commands. Back up and review `.gooblin/` manually until [#57](https://github.com/jsleemaster/gooblin/issues/57) publishes and verifies a fixed version. Ownership-aware lifecycle support remains tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). +Temporary safety guard: version 1.3.2 and newer refuse `install --force` and `uninstall` because the current marker cannot distinguish installed files from consumer-owned additions or edits. Version 1.3.1 predates this guard. Run `npx --yes gooblin --version` and do not use those lifecycle commands unless the resolved registry version is 1.3.2 or newer. Ownership-aware lifecycle support remains tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). Repository-source fallback: @@ -211,4 +211,4 @@ Use the npx skill-pack installer or the manual fallback path. Gooblin is designe Gooblin hooks are reminder-only. They do not access the network, collect telemetry, run dangerous commands, or mutate user files automatically. -The npx installer is also local-only. A fresh install writes only `.gooblin/` in the target project unless you explicitly choose another target path. The source installer refuses automatic replacement and removal while file ownership cannot be verified; published npm 1.3.1 does not yet include that protection. +The npx installer is also local-only. A fresh install writes only `.gooblin/` in the target project unless you explicitly choose another target path. Version 1.3.2 and newer refuse automatic replacement and removal while file ownership cannot be verified; version 1.3.1 does not include that protection. diff --git a/docs/operations.md b/docs/operations.md index 84124fa..e2eb826 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -15,7 +15,7 @@ codex plugin list Expected shape when installed: ```text -gooblin@gooblin installed, enabled 1.3.1 +gooblin@gooblin installed, enabled 1.3.2 ``` Claude Code: @@ -28,7 +28,7 @@ Expected shape when installed: ```text gooblin@gooblin -Version: 1.3.1 +Version: 1.3.2 Status: enabled ``` @@ -98,7 +98,7 @@ npx skill-pack copy: npx gooblin uninstall ``` -The source installer in this repository refuses automatic removal and leaves `.gooblin/` unchanged. Published npm 1.3.1 predates this guard and can recursively delete the directory, so do **not** run the registry-package uninstall command. Back up the directory, inspect consumer-added or modified files, and remove only files you have confirmed are disposable. A fixed registry release is tracked in [#57](https://github.com/jsleemaster/gooblin/issues/57); ownership-aware uninstall is tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). +Version 1.3.2 and newer refuse automatic removal and leave `.gooblin/` unchanged. Version 1.3.1 predates this guard and can recursively delete the directory, so do **not** run its uninstall command. Confirm the resolved registry version with `npx --yes gooblin --version`, back up the directory, and inspect consumer-added or modified files. Ownership-aware uninstall is tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). Global package metadata: @@ -132,7 +132,7 @@ If plugin installation breaks, remove the plugin and marketplace entry, then use Use /gooblin for this task. Diagnose the task type first, then route to the smallest useful teammate set. ``` -If an npx copy breaks, first back up `.gooblin/`, then inspect it for consumer-added or modified files. The repository-source `uninstall` command intentionally refuses automatic deletion. Published npm 1.3.1 does not contain that refusal, so do not use its uninstall path; remove files manually only after confirming they are disposable. +If an npx copy breaks, first back up `.gooblin/`, then inspect it for consumer-added or modified files. Version 1.3.2 and newer intentionally refuse automatic deletion. Version 1.3.1 does not contain that refusal, so do not use its uninstall path; remove files manually only after confirming they are disposable. If a host-specific statusline setting breaks, remove that host setting. Gooblin does not currently create statusline files or mutate host settings automatically. diff --git a/docs/releases/v1.3.2.md b/docs/releases/v1.3.2.md new file mode 100644 index 0000000..175cf2a --- /dev/null +++ b/docs/releases/v1.3.2.md @@ -0,0 +1,46 @@ +# Gooblin v1.3.2 + +Goal: deliver the npx installer data-loss guard to the npm registry without overstating what has been published. + +## Changes + +- Refuse `install --force` when `.gooblin/` already exists. +- Refuse automatic `uninstall` until owned-file tracking is available. +- Keep dry-run operations non-mutating. +- Verify marked and markerless installs with full-tree path and byte-hash snapshots. +- Cover consumer-modified installed files and consumer-added files. +- Run validation on Node.js 18, 20, and 24. +- Document that npm 1.3.1 predates the guard and require a resolved-version check before lifecycle commands. + +## Verified Source State + +- The safety implementation was merged through [PR #58](https://github.com/jsleemaster/gooblin/pull/58) as commit `b272cb6f4aad5523cc83c2af41aa8575e1a74c1c`. +- The test-only commit failed as intended in [Validate run 29229998885](https://github.com/jsleemaster/gooblin/actions/runs/29229998885). +- The fixed PR head passed Node 18, 20, and 24 in [Validate run 29230650426](https://github.com/jsleemaster/gooblin/actions/runs/29230650426). +- The merged main commit passed in [Validate run 29233659273](https://github.com/jsleemaster/gooblin/actions/runs/29233659273). + +## Required Before Publish + +- Release PR `npm run validate` succeeds. +- Release PR `git diff --check` succeeds. +- Release PR `npm pack --dry-run` succeeds and the payload is reviewed. +- Version metadata is `1.3.2` across package, plugin, hook, README, compatibility, and operations surfaces. +- Independent review finds no unsupported publish or compatibility claim. +- The publish commit is merged to `main`. +- Current Claude Code and Codex CLI plugin install paths are rechecked from `main`, with exact host versions and results recorded in `docs/verified-install-paths.md`. + +## Required After Publish + +- `npm view gooblin name version dist-tags --json` reports `1.3.2` and `latest: 1.3.2`. +- `npx --yes gooblin --version` returns `1.3.2`. +- A fresh temporary install writes `GOOBLIN_INSTALL.json` with version `1.3.2`. +- `install --force`, `uninstall`, and `uninstall --force` return nonzero and preserve the full fixture tree byte-for-byte. +- The immutable `v1.3.2` tag and GitHub release point to the published source commit. +- README, install, compatibility, operations, and verified-install docs are updated from pre-publish state to exact observed results. + +## Not Claimed + +- No ownership-aware update or uninstall support; that remains tracked in #49. +- No complete installed-README link set; the current copy-only installer omits referenced examples, also tracked in #49. +- No official host vendor support or marketplace approval claim. +- No performance, cost, or general safety benchmark claim. diff --git a/docs/verified-install-paths.md b/docs/verified-install-paths.md index d78bbd7..c9dd632 100644 --- a/docs/verified-install-paths.md +++ b/docs/verified-install-paths.md @@ -2,7 +2,7 @@ This page separates verified behavior from intended distribution commands. -Current package version: `1.3.1`. +Current source package version: `1.3.2`. Registry state can change independently; run `npm view gooblin name version dist-tags --json` before npm lifecycle commands. Version `1.3.1` predates the destructive-operation refusal guard. ## Verified Locally @@ -13,10 +13,10 @@ Checked on 2026-06-29 from `/Users/smlee/Gooblin`. | Claude Code | `2.1.96` | `claude plugin marketplace add /Users/smlee/Gooblin`, `claude plugin install gooblin@gooblin --scope user`, `claude plugin list`. | | Codex CLI | `0.141.0` | `codex plugin marketplace add /Users/smlee/Gooblin --json`, `codex plugin add gooblin@gooblin --json`, `codex plugin list`. | -Expected local result for current package version v1.3.1: +Expected local result for source package version v1.3.2: -- Claude Code: `gooblin@gooblin`, version `1.3.1`, status `enabled`. -- Codex CLI: `gooblin@gooblin`, version `1.3.1`, status `installed, enabled`. +- Claude Code: `gooblin@gooblin`, version `1.3.2`, status `enabled`. +- Codex CLI: `gooblin@gooblin`, version `1.3.2`, status `installed, enabled`. ## Verified From Git Branch @@ -64,7 +64,7 @@ Verified checks: Release v1.3.1 updates the public README and docs so the npm package page no longer describes the shorthand as future work. -Safety boundary: npm 1.3.1 can perform recursive replacement/removal because it predates the refusal guard. Its fresh-install check above does not verify safe update or uninstall behavior. Do not run `npx gooblin install --force` or `npx gooblin uninstall` until #57 publishes and verifies a fixed registry version. +Safety boundary: npm 1.3.1 can perform recursive replacement/removal because it predates the refusal guard. Its fresh-install check above does not verify safe update or uninstall behavior. The 1.3.2 source package refuses both operations. Before any npm lifecycle command, run `npx --yes gooblin --version`; do not run `install --force` or `uninstall` when it resolves to 1.3.1. ## Intended Remote Commands diff --git a/hooks/claude-codex-hooks.json b/hooks/claude-codex-hooks.json index 75ea6e2..87c2786 100644 --- a/hooks/claude-codex-hooks.json +++ b/hooks/claude-codex-hooks.json @@ -1,6 +1,6 @@ { "name": "gooblin-hooks", - "version": "1.3.1", + "version": "1.3.2", "description": "Reminder-only lifecycle hooks for Gooblin mode. Supports GOOBLIN_DISABLE and GOOBLIN_HOOK_MODE.", "hooks": { "SessionStart": [ diff --git a/package.json b/package.json index 08f5514..4b6043f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gooblin", - "version": "1.3.1", + "version": "1.3.2", "description": "A geeky product-engineering team for AI coding agents.", "license": "MIT", "repository": { diff --git a/plugin.yaml b/plugin.yaml index d4a9675..4493b18 100644 --- a/plugin.yaml +++ b/plugin.yaml @@ -1,5 +1,5 @@ name: gooblin -version: 1.3.1 +version: 1.3.2 description: A geeky product-engineering team for AI coding agents. author: jsleemaster license: MIT