From ee4047ce8f97c9e277c8b34abc9c05d92ab5b742 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 16:59:50 +0900 Subject: [PATCH 01/20] chore: bump package.json to 1.3.2 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 08f5514..4b6043f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gooblin", - "version": "1.3.1", + "version": "1.3.2", "description": "A geeky product-engineering team for AI coding agents.", "license": "MIT", "repository": { From 6e32e24e62c40d359c5d553eba2bcd512d673db5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 16:59:51 +0900 Subject: [PATCH 02/20] chore: bump plugin.yaml to 1.3.2 --- plugin.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugin.yaml b/plugin.yaml index d4a9675..4493b18 100644 --- a/plugin.yaml +++ b/plugin.yaml @@ -1,5 +1,5 @@ name: gooblin -version: 1.3.1 +version: 1.3.2 description: A geeky product-engineering team for AI coding agents. author: jsleemaster license: MIT From 015efef4767fa0e1f6476f2d1f8180a25c78a4f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 16:59:52 +0900 Subject: [PATCH 03/20] chore: bump .claude-plugin/plugin.json to 1.3.2 --- .claude-plugin/plugin.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 09e16ce..3453d08 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "gooblin", - "version": "1.3.1", + "version": "1.3.2", "description": "A geeky product-engineering team for AI coding agents.", "author": { "name": "jsleemaster", From 662cfbc73bb5896ca63562baa3f2a810826c3809 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 16:59:53 +0900 Subject: [PATCH 04/20] chore: bump .codex-plugin/plugin.json to 1.3.2 --- .codex-plugin/plugin.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json index 6c1fb43..1f367fc 100644 --- a/.codex-plugin/plugin.json +++ b/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "gooblin", - "version": "1.3.1", + "version": "1.3.2", "description": "A geeky product-engineering team for AI coding agents.", "author": "jsleemaster", "homepage": "https://jsleemaster.github.io/gooblin/", From 890bd63cb4e398154ef3169b011f8b7a4fa3b211 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 16:59:54 +0900 Subject: [PATCH 05/20] chore: bump hooks/claude-codex-hooks.json to 1.3.2 --- hooks/claude-codex-hooks.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hooks/claude-codex-hooks.json b/hooks/claude-codex-hooks.json index 75ea6e2..87c2786 100644 --- a/hooks/claude-codex-hooks.json +++ b/hooks/claude-codex-hooks.json @@ -1,6 +1,6 @@ { "name": "gooblin-hooks", - "version": "1.3.1", + "version": "1.3.2", "description": "Reminder-only lifecycle hooks for Gooblin mode. Supports GOOBLIN_DISABLE and GOOBLIN_HOOK_MODE.", "hooks": { "SessionStart": [ From 5df34e7ad020b373917bd7a47acac6341c463510 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:00:40 +0900 Subject: [PATCH 06/20] docs: prepare README for 1.3.2 safety release --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 7a7fbdd..c33f511 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@

- version 1.3.1 + version 1.3.2 license MIT plugin style agent skills @@ -141,8 +141,8 @@ npx gooblin install Current status: -- npm registry shorthand `gooblin@1.3.1` is published, but its destructive lifecycle commands are unsafe: it predates the refusal guard in this repository. Until a fixed version is published, do not run `npx gooblin install --force` or `npx gooblin uninstall` from the registry package. -- The GitHub-source installer contains the refusal guard and remains available for users who need the source version. +- Source package version `gooblin@1.3.2` is the safety release candidate and contains the destructive-operation refusal guard. +- npm registry `latest` remains `1.3.1` until 1.3.2 is published and verified. Do not run `npx gooblin install --force` or `npx gooblin uninstall` from the 1.3.1 registry package. Repository-source fallback: @@ -150,7 +150,7 @@ Repository-source fallback: npx github:jsleemaster/gooblin install ``` -The source installer writes `.gooblin/` in the target project. It does not enable hooks, edit host settings, access the network, or collect telemetry. Use `--dry-run`, `--target

`, and `status` to inspect the copy. Until ownership manifests are implemented in [#49](https://github.com/jsleemaster/gooblin/issues/49), this source version refuses `--force` replacement and `uninstall`. The published npm 1.3.1 package does **not** contain that guard; [#57](https://github.com/jsleemaster/gooblin/issues/57) remains open until a fixed registry version is published and verified. +The 1.3.2 source installer writes `.gooblin/` in the target project. It does not enable hooks, edit host settings, access the network, or collect telemetry. Use `--dry-run`, `--target `, and `status` to inspect the copy. Until ownership manifests are implemented in [#49](https://github.com/jsleemaster/gooblin/issues/49), this source version refuses `--force` replacement and `uninstall`. Published npm 1.3.1 does **not** contain that guard; [#57](https://github.com/jsleemaster/gooblin/issues/57) remains open until 1.3.2 is published and verified. ### Manual fallback From 74e75581df22abb8436c7d59eb8c66db26dabc28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:00:57 +0900 Subject: [PATCH 07/20] docs: prepare install guide for 1.3.2 --- docs/install.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/install.md b/docs/install.md index 071661b..b6a2293 100644 --- a/docs/install.md +++ b/docs/install.md @@ -51,8 +51,8 @@ Current status: | Path | Status | | --- | --- | -| `npx gooblin install` | Published npm 1.3.1 supports fresh copies, but its `install --force` and `uninstall` paths can delete consumer-owned files. Do not use those lifecycle commands. | -| `npx github:jsleemaster/gooblin install` | Repository-source fallback containing the temporary destructive-operation refusal guard. | +| `npx gooblin install` | npm `latest` remains 1.3.1 during release preparation. Its `install --force` and `uninstall` paths can delete consumer-owned files; do not use those lifecycle commands. | +| `npx github:jsleemaster/gooblin install` | Repository-source 1.3.2 release candidate containing the temporary destructive-operation refusal guard. | The installer copies a readable skill pack into `.gooblin/` in the current working directory. It copies: @@ -74,7 +74,7 @@ npx gooblin status npx gooblin uninstall ``` -Temporary safety guard: the source installer in this repository refuses `install --force` and `uninstall` because the current marker cannot distinguish installed files from consumer-owned additions or edits. Published npm 1.3.1 predates this guard; do not use those two registry-package lifecycle commands. Back up and review `.gooblin/` manually until [#57](https://github.com/jsleemaster/gooblin/issues/57) publishes and verifies a fixed version. Ownership-aware lifecycle support remains tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). +Temporary safety guard: the 1.3.2 source release candidate refuses `install --force` and `uninstall` because the current marker cannot distinguish installed files from consumer-owned additions or edits. Published npm 1.3.1 predates this guard; do not use those two registry-package lifecycle commands. Back up and review `.gooblin/` manually until [#57](https://github.com/jsleemaster/gooblin/issues/57) publishes and verifies 1.3.2. Ownership-aware lifecycle support remains tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). Repository-source fallback: @@ -211,4 +211,4 @@ Use the npx skill-pack installer or the manual fallback path. Gooblin is designe Gooblin hooks are reminder-only. They do not access the network, collect telemetry, run dangerous commands, or mutate user files automatically. -The npx installer is also local-only. A fresh install writes only `.gooblin/` in the target project unless you explicitly choose another target path. The source installer refuses automatic replacement and removal while file ownership cannot be verified; published npm 1.3.1 does not yet include that protection. +The npx installer is also local-only. A fresh install writes only `.gooblin/` in the target project unless you explicitly choose another target path. The 1.3.2 source release candidate refuses automatic replacement and removal while file ownership cannot be verified; published npm 1.3.1 does not include that protection. From 971ba7ebf7bb5cff8a0cbe1bd2d206608d8acd57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:01:12 +0900 Subject: [PATCH 08/20] docs: align operations examples with 1.3.2 --- docs/operations.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/operations.md b/docs/operations.md index 84124fa..24edee6 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -15,7 +15,7 @@ codex plugin list Expected shape when installed: ```text -gooblin@gooblin installed, enabled 1.3.1 +gooblin@gooblin installed, enabled 1.3.2 ``` Claude Code: @@ -28,7 +28,7 @@ Expected shape when installed: ```text gooblin@gooblin -Version: 1.3.1 +Version: 1.3.2 Status: enabled ``` @@ -98,7 +98,7 @@ npx skill-pack copy: npx gooblin uninstall ``` -The source installer in this repository refuses automatic removal and leaves `.gooblin/` unchanged. Published npm 1.3.1 predates this guard and can recursively delete the directory, so do **not** run the registry-package uninstall command. Back up the directory, inspect consumer-added or modified files, and remove only files you have confirmed are disposable. A fixed registry release is tracked in [#57](https://github.com/jsleemaster/gooblin/issues/57); ownership-aware uninstall is tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). +The 1.3.2 source release candidate refuses automatic removal and leaves `.gooblin/` unchanged. Published npm 1.3.1 predates this guard and can recursively delete the directory, so do **not** run the 1.3.1 registry-package uninstall command. Back up the directory, inspect consumer-added or modified files, and remove only files you have confirmed are disposable. Publishing and verifying 1.3.2 is tracked in [#57](https://github.com/jsleemaster/gooblin/issues/57); ownership-aware uninstall is tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). Global package metadata: @@ -132,7 +132,7 @@ If plugin installation breaks, remove the plugin and marketplace entry, then use Use /gooblin for this task. Diagnose the task type first, then route to the smallest useful teammate set. ``` -If an npx copy breaks, first back up `.gooblin/`, then inspect it for consumer-added or modified files. The repository-source `uninstall` command intentionally refuses automatic deletion. Published npm 1.3.1 does not contain that refusal, so do not use its uninstall path; remove files manually only after confirming they are disposable. +If an npx copy breaks, first back up `.gooblin/`, then inspect it for consumer-added or modified files. The repository-source 1.3.2 `uninstall` command intentionally refuses automatic deletion. Published npm 1.3.1 does not contain that refusal, so do not use its uninstall path; remove files manually only after confirming they are disposable. If a host-specific statusline setting breaks, remove that host setting. Gooblin does not currently create statusline files or mutate host settings automatically. From fac2de015ca9c359626d364d83e9e5448d20f8aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:01:24 +0900 Subject: [PATCH 09/20] docs: record 1.3.2 pre-publish compatibility state --- docs/compatibility.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/compatibility.md b/docs/compatibility.md index e958b27..cb5f60b 100644 --- a/docs/compatibility.md +++ b/docs/compatibility.md @@ -2,7 +2,7 @@ These notes record what has actually been checked. They are not marketplace approval claims. -Current package version: `1.3.1`. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked. +Current source package version: `1.3.2`. npm `latest` remains `1.3.1` until the safety release is published and verified. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked. ## Latest Local Verification @@ -38,7 +38,7 @@ Result: `gooblin@gooblin` installed with version `1.2.0` and status `installed, ## npx Installer Status -Release `v1.3.1` verifies the npm registry shorthand for the minimal dependency-free bin installer: +Published npm `v1.3.1` remains the latest registry version during 1.3.2 release preparation. Its previously verified fresh-copy command is: ```bash npx gooblin install @@ -46,7 +46,7 @@ npx gooblin install The installer copies readable Gooblin files into `.gooblin/` and does not enable hooks, edit host settings, access the network, or collect telemetry. -Safety boundary: published npm 1.3.1 predates the destructive-operation refusal guard. Its fresh-copy path is available, but do not run `install --force` or `uninstall` from that registry package. The repository-source installer contains the guard; #57 stays open until a fixed npm version is published and verified. +Safety boundary: published npm 1.3.1 predates the destructive-operation refusal guard. Its fresh-copy path is available, but do not run `install --force` or `uninstall` from that registry package. The repository-source 1.3.2 release candidate contains the guard; #57 stays open until 1.3.2 is published and verified. Repository-source fallback remains available: From 134322449e2c549be04b1e473bdb9b33d0371933 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:01:36 +0900 Subject: [PATCH 10/20] docs: track 1.3.2 pre-publish verification state --- docs/verified-install-paths.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/verified-install-paths.md b/docs/verified-install-paths.md index d78bbd7..3a7b558 100644 --- a/docs/verified-install-paths.md +++ b/docs/verified-install-paths.md @@ -2,7 +2,7 @@ This page separates verified behavior from intended distribution commands. -Current package version: `1.3.1`. +Current source package version: `1.3.2`. npm `latest` remains `1.3.1` until publish verification completes. ## Verified Locally @@ -13,10 +13,10 @@ Checked on 2026-06-29 from `/Users/smlee/Gooblin`. | Claude Code | `2.1.96` | `claude plugin marketplace add /Users/smlee/Gooblin`, `claude plugin install gooblin@gooblin --scope user`, `claude plugin list`. | | Codex CLI | `0.141.0` | `codex plugin marketplace add /Users/smlee/Gooblin --json`, `codex plugin add gooblin@gooblin --json`, `codex plugin list`. | -Expected local result for current package version v1.3.1: +Expected local result for source package version v1.3.2: -- Claude Code: `gooblin@gooblin`, version `1.3.1`, status `enabled`. -- Codex CLI: `gooblin@gooblin`, version `1.3.1`, status `installed, enabled`. +- Claude Code: `gooblin@gooblin`, version `1.3.2`, status `enabled`. +- Codex CLI: `gooblin@gooblin`, version `1.3.2`, status `installed, enabled`. ## Verified From Git Branch @@ -64,7 +64,7 @@ Verified checks: Release v1.3.1 updates the public README and docs so the npm package page no longer describes the shorthand as future work. -Safety boundary: npm 1.3.1 can perform recursive replacement/removal because it predates the refusal guard. Its fresh-install check above does not verify safe update or uninstall behavior. Do not run `npx gooblin install --force` or `npx gooblin uninstall` until #57 publishes and verifies a fixed registry version. +Safety boundary: npm 1.3.1 can perform recursive replacement/removal because it predates the refusal guard. Its fresh-install check above does not verify safe update or uninstall behavior. The source 1.3.2 release candidate refuses both operations. Do not run the 1.3.1 lifecycle commands until #57 publishes and verifies 1.3.2. ## Intended Remote Commands From 3c9f4890b371e91777dae41bbd40d807026d5113 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:01:58 +0900 Subject: [PATCH 11/20] docs: add 1.3.2 safety release checklist --- docs/releases/v1.3.2.md | 42 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 docs/releases/v1.3.2.md diff --git a/docs/releases/v1.3.2.md b/docs/releases/v1.3.2.md new file mode 100644 index 0000000..ede697c --- /dev/null +++ b/docs/releases/v1.3.2.md @@ -0,0 +1,42 @@ +# Gooblin v1.3.2 + +Goal: deliver the npx installer data-loss guard to the npm registry without overstating what has been published. + +## Changes + +- Refuse `install --force` when `.gooblin/` already exists. +- Refuse automatic `uninstall` until owned-file tracking is available. +- Keep dry-run operations non-mutating. +- Verify marked and markerless installs with full-tree path and byte-hash snapshots. +- Cover consumer-modified installed files and consumer-added files. +- Run validation on Node.js 18, 20, and 24. +- Keep npm 1.3.1 warnings visible until this release is actually published and verified. + +## Verified Source State + +- The safety implementation was merged through [PR #58](https://github.com/jsleemaster/gooblin/pull/58) as commit `b272cb6f4aad5523cc83c2af41aa8575e1a74c1c`. +- The test-only commit failed as intended in [Validate run 29229998885](https://github.com/jsleemaster/gooblin/actions/runs/29229998885). +- The fixed PR head passed Node 18, 20, and 24 in [Validate run 29230650426](https://github.com/jsleemaster/gooblin/actions/runs/29230650426). +- The merged main commit passed in [Validate run 29233659273](https://github.com/jsleemaster/gooblin/actions/runs/29233659273). + +## Required Before Publish + +- Release PR `npm run validate` succeeds. +- Release PR `npm pack --dry-run` succeeds and the payload is reviewed. +- Version metadata is `1.3.2` across package, plugin, hook, README, compatibility, and operations surfaces. +- The publish commit is merged to `main`. + +## Required After Publish + +- `npm view gooblin name version dist-tags --json` reports `1.3.2` and `latest: 1.3.2`. +- `npx --yes gooblin --version` returns `1.3.2`. +- A fresh temporary install writes `GOOBLIN_INSTALL.json` with version `1.3.2`. +- `install --force`, `uninstall`, and `uninstall --force` return nonzero and preserve the full fixture tree byte-for-byte. +- The immutable `v1.3.2` tag and GitHub release point to the published source commit. +- README, install, compatibility, operations, and verified-install docs are updated from pre-publish state to exact observed results. + +## Not Claimed + +- No ownership-aware update or uninstall support; that remains tracked in #49. +- No official host vendor support or marketplace approval claim. +- No performance, cost, or general safety benchmark claim. From 66553929e8871f6eb511f3bff442bb456a8e9aa8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:02:13 +0900 Subject: [PATCH 12/20] ci: verify npm package payload --- .github/workflows/validate.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 9518576..3280d90 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -28,3 +28,7 @@ jobs: - name: Run validation run: npm run validate + + - name: Check package payload + if: matrix.node-version == 24 + run: npm pack --dry-run From 6bb241d04812f53471970e643ef58756d57071d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:04:33 +0900 Subject: [PATCH 13/20] docs: record known 1.3.2 payload limitation --- docs/releases/v1.3.2.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/releases/v1.3.2.md b/docs/releases/v1.3.2.md index ede697c..e0d92c8 100644 --- a/docs/releases/v1.3.2.md +++ b/docs/releases/v1.3.2.md @@ -38,5 +38,6 @@ Goal: deliver the npx installer data-loss guard to the npm registry without over ## Not Claimed - No ownership-aware update or uninstall support; that remains tracked in #49. +- No complete installed-README link set; the current copy-only installer omits referenced examples, also tracked in #49. - No official host vendor support or marketplace approval claim. - No performance, cost, or general safety benchmark claim. From bc1a0088499f5f04c6602c4a0efe2f18eeaf3820 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:09:02 +0900 Subject: [PATCH 14/20] docs: make registry safety guidance release-durable --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c33f511..95ee410 100644 --- a/README.md +++ b/README.md @@ -141,8 +141,8 @@ npx gooblin install Current status: -- Source package version `gooblin@1.3.2` is the safety release candidate and contains the destructive-operation refusal guard. -- npm registry `latest` remains `1.3.1` until 1.3.2 is published and verified. Do not run `npx gooblin install --force` or `npx gooblin uninstall` from the 1.3.1 registry package. +- Source package version `gooblin@1.3.2` contains the destructive-operation refusal guard. +- Before using registry lifecycle commands, run `npx --yes gooblin --version`. Version 1.3.1 does not contain the guard; use those commands only after the resolved version is 1.3.2 or newer. Repository-source fallback: @@ -150,7 +150,7 @@ Repository-source fallback: npx github:jsleemaster/gooblin install ``` -The 1.3.2 source installer writes `.gooblin/` in the target project. It does not enable hooks, edit host settings, access the network, or collect telemetry. Use `--dry-run`, `--target `, and `status` to inspect the copy. Until ownership manifests are implemented in [#49](https://github.com/jsleemaster/gooblin/issues/49), this source version refuses `--force` replacement and `uninstall`. Published npm 1.3.1 does **not** contain that guard; [#57](https://github.com/jsleemaster/gooblin/issues/57) remains open until 1.3.2 is published and verified. +The 1.3.2 source installer writes `.gooblin/` in the target project. It does not enable hooks, edit host settings, access the network, or collect telemetry. Use `--dry-run`, `--target `, and `status` to inspect the copy. Until ownership manifests are implemented in [#49](https://github.com/jsleemaster/gooblin/issues/49), version 1.3.2 and newer refuse `--force` replacement and `uninstall`. Version 1.3.1 does **not** contain that guard; verify the resolved version before using registry lifecycle commands. ### Manual fallback From 98c598b5e4642d2b31f7f0917ab0761f15cfca05 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:09:19 +0900 Subject: [PATCH 15/20] docs: make install safety rules version-based --- docs/install.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/install.md b/docs/install.md index b6a2293..bf527e2 100644 --- a/docs/install.md +++ b/docs/install.md @@ -51,8 +51,8 @@ Current status: | Path | Status | | --- | --- | -| `npx gooblin install` | npm `latest` remains 1.3.1 during release preparation. Its `install --force` and `uninstall` paths can delete consumer-owned files; do not use those lifecycle commands. | -| `npx github:jsleemaster/gooblin install` | Repository-source 1.3.2 release candidate containing the temporary destructive-operation refusal guard. | +| `npx gooblin install` | Registry behavior depends on the resolved version. Version 1.3.1 can delete consumer-owned files through `install --force` and `uninstall`; version 1.3.2 and newer refuse those operations. | +| `npx github:jsleemaster/gooblin install` | Repository-source version 1.3.2 containing the temporary destructive-operation refusal guard. | The installer copies a readable skill pack into `.gooblin/` in the current working directory. It copies: @@ -74,7 +74,7 @@ npx gooblin status npx gooblin uninstall ``` -Temporary safety guard: the 1.3.2 source release candidate refuses `install --force` and `uninstall` because the current marker cannot distinguish installed files from consumer-owned additions or edits. Published npm 1.3.1 predates this guard; do not use those two registry-package lifecycle commands. Back up and review `.gooblin/` manually until [#57](https://github.com/jsleemaster/gooblin/issues/57) publishes and verifies 1.3.2. Ownership-aware lifecycle support remains tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). +Temporary safety guard: version 1.3.2 and newer refuse `install --force` and `uninstall` because the current marker cannot distinguish installed files from consumer-owned additions or edits. Version 1.3.1 predates this guard. Run `npx --yes gooblin --version` and do not use those lifecycle commands unless the resolved registry version is 1.3.2 or newer. Ownership-aware lifecycle support remains tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). Repository-source fallback: @@ -211,4 +211,4 @@ Use the npx skill-pack installer or the manual fallback path. Gooblin is designe Gooblin hooks are reminder-only. They do not access the network, collect telemetry, run dangerous commands, or mutate user files automatically. -The npx installer is also local-only. A fresh install writes only `.gooblin/` in the target project unless you explicitly choose another target path. The 1.3.2 source release candidate refuses automatic replacement and removal while file ownership cannot be verified; published npm 1.3.1 does not include that protection. +The npx installer is also local-only. A fresh install writes only `.gooblin/` in the target project unless you explicitly choose another target path. Version 1.3.2 and newer refuse automatic replacement and removal while file ownership cannot be verified; version 1.3.1 does not include that protection. From 41b8bce86733aa41fa587734b7a0fc3b4778d904 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:09:35 +0900 Subject: [PATCH 16/20] docs: make uninstall guidance version-based --- docs/operations.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/operations.md b/docs/operations.md index 24edee6..e2eb826 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -98,7 +98,7 @@ npx skill-pack copy: npx gooblin uninstall ``` -The 1.3.2 source release candidate refuses automatic removal and leaves `.gooblin/` unchanged. Published npm 1.3.1 predates this guard and can recursively delete the directory, so do **not** run the 1.3.1 registry-package uninstall command. Back up the directory, inspect consumer-added or modified files, and remove only files you have confirmed are disposable. Publishing and verifying 1.3.2 is tracked in [#57](https://github.com/jsleemaster/gooblin/issues/57); ownership-aware uninstall is tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). +Version 1.3.2 and newer refuse automatic removal and leave `.gooblin/` unchanged. Version 1.3.1 predates this guard and can recursively delete the directory, so do **not** run its uninstall command. Confirm the resolved registry version with `npx --yes gooblin --version`, back up the directory, and inspect consumer-added or modified files. Ownership-aware uninstall is tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49). Global package metadata: @@ -132,7 +132,7 @@ If plugin installation breaks, remove the plugin and marketplace entry, then use Use /gooblin for this task. Diagnose the task type first, then route to the smallest useful teammate set. ``` -If an npx copy breaks, first back up `.gooblin/`, then inspect it for consumer-added or modified files. The repository-source 1.3.2 `uninstall` command intentionally refuses automatic deletion. Published npm 1.3.1 does not contain that refusal, so do not use its uninstall path; remove files manually only after confirming they are disposable. +If an npx copy breaks, first back up `.gooblin/`, then inspect it for consumer-added or modified files. Version 1.3.2 and newer intentionally refuse automatic deletion. Version 1.3.1 does not contain that refusal, so do not use its uninstall path; remove files manually only after confirming they are disposable. If a host-specific statusline setting breaks, remove that host setting. Gooblin does not currently create statusline files or mutate host settings automatically. From e5433c6d3deb2ffad0704288872e9efb5b260445 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:09:50 +0900 Subject: [PATCH 17/20] docs: make compatibility status durable across publish --- docs/compatibility.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/compatibility.md b/docs/compatibility.md index cb5f60b..0f52426 100644 --- a/docs/compatibility.md +++ b/docs/compatibility.md @@ -2,7 +2,7 @@ These notes record what has actually been checked. They are not marketplace approval claims. -Current source package version: `1.3.2`. npm `latest` remains `1.3.1` until the safety release is published and verified. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked. +Current source package version: `1.3.2`. Registry state must be checked separately with `npm view gooblin version dist-tags --json`; version 1.3.1 lacks the destructive-operation guard and version 1.3.2 includes it. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked. ## Latest Local Verification @@ -38,7 +38,7 @@ Result: `gooblin@gooblin` installed with version `1.2.0` and status `installed, ## npx Installer Status -Published npm `v1.3.1` remains the latest registry version during 1.3.2 release preparation. Its previously verified fresh-copy command is: +At 1.3.2 release preparation on 2026-07-13, published npm `v1.3.1` was the last verified registry version. Its previously verified fresh-copy command was: ```bash npx gooblin install @@ -46,7 +46,7 @@ npx gooblin install The installer copies readable Gooblin files into `.gooblin/` and does not enable hooks, edit host settings, access the network, or collect telemetry. -Safety boundary: published npm 1.3.1 predates the destructive-operation refusal guard. Its fresh-copy path is available, but do not run `install --force` or `uninstall` from that registry package. The repository-source 1.3.2 release candidate contains the guard; #57 stays open until 1.3.2 is published and verified. +Safety boundary: version 1.3.1 predates the destructive-operation refusal guard. Its fresh-copy path is available, but do not run `install --force` or `uninstall` with that version. Version 1.3.2 and newer contain the refusal guard; verify the resolved registry version before lifecycle commands. Repository-source fallback remains available: From 0fab8c793da61874feb6fb592747f48fb601e800 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:13:38 +0900 Subject: [PATCH 18/20] docs: make installer safety guidance durable --- docs/verified-install-paths.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/verified-install-paths.md b/docs/verified-install-paths.md index 3a7b558..c9dd632 100644 --- a/docs/verified-install-paths.md +++ b/docs/verified-install-paths.md @@ -2,7 +2,7 @@ This page separates verified behavior from intended distribution commands. -Current source package version: `1.3.2`. npm `latest` remains `1.3.1` until publish verification completes. +Current source package version: `1.3.2`. Registry state can change independently; run `npm view gooblin name version dist-tags --json` before npm lifecycle commands. Version `1.3.1` predates the destructive-operation refusal guard. ## Verified Locally @@ -64,7 +64,7 @@ Verified checks: Release v1.3.1 updates the public README and docs so the npm package page no longer describes the shorthand as future work. -Safety boundary: npm 1.3.1 can perform recursive replacement/removal because it predates the refusal guard. Its fresh-install check above does not verify safe update or uninstall behavior. The source 1.3.2 release candidate refuses both operations. Do not run the 1.3.1 lifecycle commands until #57 publishes and verifies 1.3.2. +Safety boundary: npm 1.3.1 can perform recursive replacement/removal because it predates the refusal guard. Its fresh-install check above does not verify safe update or uninstall behavior. The 1.3.2 source package refuses both operations. Before any npm lifecycle command, run `npx --yes gooblin --version`; do not run `install --force` or `uninstall` when it resolves to 1.3.1. ## Intended Remote Commands From 2ca32a44edb571e2a59eddf82782da0a7d4be1b3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:14:01 +0900 Subject: [PATCH 19/20] docs: complete v1.3.2 release gates --- docs/releases/v1.3.2.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/releases/v1.3.2.md b/docs/releases/v1.3.2.md index e0d92c8..175cf2a 100644 --- a/docs/releases/v1.3.2.md +++ b/docs/releases/v1.3.2.md @@ -10,7 +10,7 @@ Goal: deliver the npx installer data-loss guard to the npm registry without over - Verify marked and markerless installs with full-tree path and byte-hash snapshots. - Cover consumer-modified installed files and consumer-added files. - Run validation on Node.js 18, 20, and 24. -- Keep npm 1.3.1 warnings visible until this release is actually published and verified. +- Document that npm 1.3.1 predates the guard and require a resolved-version check before lifecycle commands. ## Verified Source State @@ -22,9 +22,12 @@ Goal: deliver the npx installer data-loss guard to the npm registry without over ## Required Before Publish - Release PR `npm run validate` succeeds. +- Release PR `git diff --check` succeeds. - Release PR `npm pack --dry-run` succeeds and the payload is reviewed. - Version metadata is `1.3.2` across package, plugin, hook, README, compatibility, and operations surfaces. +- Independent review finds no unsupported publish or compatibility claim. - The publish commit is merged to `main`. +- Current Claude Code and Codex CLI plugin install paths are rechecked from `main`, with exact host versions and results recorded in `docs/verified-install-paths.md`. ## Required After Publish From 4fabc738fdeda7cc700614c57290908bd1449080 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9D=B4=EC=88=9C=EB=AA=85?= <75053960+jsleemaster@users.noreply.github.com> Date: Mon, 13 Jul 2026 17:14:10 +0900 Subject: [PATCH 20/20] ci: enforce release diff whitespace check --- .github/workflows/validate.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 3280d90..836ed89 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -20,12 +20,18 @@ jobs: steps: - name: Check out repository uses: actions/checkout@v4 + with: + fetch-depth: 2 - name: Set up Node uses: actions/setup-node@v4 with: node-version: ${{ matrix.node-version }} + - name: Check diff whitespace + if: matrix.node-version == 24 + run: git diff --check HEAD^ HEAD + - name: Run validation run: npm run validate