fix(release): keep package-lock in sync with package.json so make-live stops needing --force (v0.331.2) - #606
Merged
Merged
Conversation
…e stops needing --force (v0.331.2) The lockfile had drifted to 0.330.0 while package.json moved on, because recent bumps edited package.json directly instead of running `npm version`. The lock records the root version in both `.version` and `.packages[""].version`, and npm rewrites both on the next `npm install` — which is exactly what the deploy box does. So every `scripts/make-live.sh` run found the live checkout dirty and had to be re-run with `--force`: a guard meant to catch someone editing the live checkout, reduced to noise, with force-deploying past it becoming the habit. Re-syncs the lock via `npm version`, and adds `scripts/version-sync-test.cjs` as the falsifier — it runs first in `npm run test:governance` (reads the two JSON files, no build needed), so drift fails the deploy's own gate and prints the one-line fix. CLAUDE.md → Versioning now states the rule instead of leaving it implied. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZUfffxY4hKv7M6wMCcaTz
vikasprogrammer
added a commit
that referenced
this pull request
Aug 11, 2026
…e stops needing --force (v0.331.2) (#606) The lockfile had drifted to 0.330.0 while package.json moved on, because recent bumps edited package.json directly instead of running `npm version`. The lock records the root version in both `.version` and `.packages[""].version`, and npm rewrites both on the next `npm install` — which is exactly what the deploy box does. So every `scripts/make-live.sh` run found the live checkout dirty and had to be re-run with `--force`: a guard meant to catch someone editing the live checkout, reduced to noise, with force-deploying past it becoming the habit. Re-syncs the lock via `npm version`, and adds `scripts/version-sync-test.cjs` as the falsifier — it runs first in `npm run test:governance` (reads the two JSON files, no build needed), so drift fails the deploy's own gate and prints the one-line fix. CLAUDE.md → Versioning now states the rule instead of leaving it implied. Claude-Session: https://claude.ai/code/session_015ZUfffxY4hKv7M6wMCcaTz Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
package-lock.jsonwas stuck at 0.330.0 whilepackage.jsonhad moved to 0.331.1 — recent bumpsedited
package.jsondirectly instead of runningnpm version. The lock records the root version intwo places (
.versionand.packages[""].version) and npm rewrites both on the nextnpm install.That install happens on the deploy box. So
scripts/make-live.shfound~/agent-os-livedirty onevery run and had to be re-run with
--force. The guard exists to catch someone having edited thelive checkout by hand — turning it into a routine
--forceis how a real signal gets trained away.The fix
npm version 0.331.2 --no-git-tag-version(updates both fields).scripts/version-sync-test.cjs— new, runs first innpm run test:governance, reads the twoJSON files (no build needed), fails with the exact one-line remedy. Since
make-live.shgates onthat suite, the drift can no longer reach a deploy.
npm version, never by hand) and explainsthe deploy-box consequence, so it survives the next person.
Verification
npm run build·npm run test:governance→ exit 0, 18 suites green, version-sync check passing.Falsified: hand-drifting the lock to
0.0.1makes the new test exit 1 and name both mismatched fields.🤖 Generated with Claude Code
https://claude.ai/code/session_015ZUfffxY4hKv7M6wMCcaTz