fix: close install manifest packaging gaps by konstapukarifastnetfi · Pull Request #2172 · affaan-m/ECC

konstapukarifastnetfi · 2026-06-05T23:31:10Z

What Changed

manifests/install-modules.json:

Added scripts/harness-audit.js and scripts/skills-health.js to commands-core paths - their commands (/harness-audit, /skill-health) currently ship without their engines
Added scripts/claw.js to agentic-patterns - the nanoclaw-repl skill ships without its script
Dropped commands/multi-workflow.md and commands/sessions.md from the orchestration module: orchestration already declares a dependency on commands-core, which ships the whole commands/ directory, so these two entries were pure duplicates. The two scripts/lib/* paths in orchestration are deliberately KEPT - hooks-runtime is not a declared dependency, so dropping them would break a standalone orchestration install. That asymmetry is the point of this diff
package.json: scripts/skills-health.js added to the npm files array (alphabetical position within its run)
tests/scripts/npm-publish-surface.test.js: removed scripts/claw.js and scripts/harness-audit.js from the hardcoded extraPaths allowlist - they are now covered by module paths, and keeping both entries would mask a future module-path removal

Why This Change

Selective installs resolve files from module paths. A module that installs a command but not its engine produces a command that fails at first use; the duplicated command paths inflate the orchestration module for files its dependency already provides.

Testing Done

Manual testing completed - validate-install-manifests, catalog:check, and the npm publish-surface contract all pass
Automated tests pass locally (node tests/run-all.js) - full suite 2619/2619 in a clean Linux container (node:22-bookworm, fresh npm ci)
Edge cases considered and tested - standalone orchestration install retains its scripts/lib runtime; npm pack --dry-run includes the newly wired scripts

Type of Change

fix: Bug fix

Security & Quality Checklist

No secrets or API keys committed (ghp_, sk-, AKIA, xoxb, xoxp patterns checked)
JSON files validate cleanly
Shell scripts pass shellcheck (if applicable)
Pre-commit hooks pass locally (if configured)
No sensitive data exposed in logs or output
Follows conventional commits format

Documentation

Updated relevant documentation - n/a, manifest + test only
Added comments for complex logic - asymmetry explained above and in the commit message
README updated (if needed) - n/a

Summary by cubic

Fixes install manifest coverage so module installs include their backing engines and avoid duplicate files. Adds missing script paths, removes redundant command docs, and aligns the npm publish surface.

Bug Fixes
- commands-core: add scripts/harness-audit.js and scripts/skills-health.js so /harness-audit and /skill-health work on selective installs.
- agentic-patterns: add scripts/claw.js for the nanoclaw-repl skill.
- orchestration: remove commands/multi-workflow.md and commands/sessions.md (already provided by commands-core).
- package.json: include scripts/skills-health.js in files to keep the publish surface in sync.
- Tests: drop scripts/claw.js and scripts/harness-audit.js from the extra-paths allowlist since module paths now cover them.

^{Written for commit bacf3ce. Summary will update on new commits.}

Summary by CodeRabbit

Release Notes

Chores
- Updated module configuration manifests to reflect current script organization across core rules, orchestration, and agentic patterns modules.
- Modified npm package distribution configuration to include additional utility scripts in published releases.
- Updated test expectations to align with current distribution surface configuration.

- commands-core now ships scripts/harness-audit.js and scripts/skills-health.js: the module installs the whole commands/ dir, so /harness-audit and /skill-health were installed without their backing engines on manifest-driven installs (the original 1.10.0 failure mode) - agentic-patterns now ships scripts/claw.js: the module installs the nanoclaw-repl skill, whose workflow operates scripts/claw.js - package.json files array gains scripts/skills-health.js so the npm publish surface stays aligned with the module graph (claw.js and harness-audit.js were already listed) - orchestration drops commands/multi-workflow.md and commands/sessions.md from its explicit paths: both are already shipped by commands-core, which is a declared dependency of the module, so the duplicate ownership produced two copy operations per destination in install-state. The two scripts/lib entries are kept because hooks-runtime is NOT a declared dependency and a standalone orchestration install still needs them

coderabbitai · 2026-06-05T23:31:22Z

Too much diff to scan? Review this PR in Change Stack to start with the highest-impact changes.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 80f8f75a-3e1b-4c39-94ad-f7d376786a9d

📥 Commits

Reviewing files that changed from the base of the PR and between 7113b5b and bacf3ce.

📒 Files selected for processing (3)

manifests/install-modules.json
package.json
tests/scripts/npm-publish-surface.test.js

💤 Files with no reviewable changes (1)

tests/scripts/npm-publish-surface.test.js

📝 Walkthrough

Walkthrough

This PR updates module manifest paths in manifests/install-modules.json to reflect script reorganization across modules (rules-core, orchestration, agentic-patterns), adds scripts/skills-health.js to npm's distributable files allowlist in package.json, and adjusts test expectations to align with the updated publish surface.

Changes

Module Manifest and Publish Configuration

Layer / File(s)	Summary
Module manifest paths and npm publish surface alignment `manifests/install-modules.json`, `package.json`, `tests/scripts/npm-publish-surface.test.js`	`rules-core` paths add `scripts/harness-audit.js` and `scripts/skills-health.js`; `orchestration` paths remove `commands/multi-workflow.md` and `commands/sessions.md`; `agentic-patterns` paths add `scripts/claw.js`. `package.json` adds `scripts/skills-health.js` to npm `files`. Test expectations remove `scripts/claw.js` and `scripts/harness-audit.js` from expected publish paths.

🎯 1 (Trivial) | ⏱️ ~3 minutes

📦 Scripts hop module lanes with grace,
Skills and claw find their rightful place,
Publish surfaces align and test,
Manifests orchestrate the rest! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: close install manifest packaging gaps' accurately and concisely summarizes the main objective: addressing packaging gaps in install manifests and related configuration files by adding missing script paths and removing duplicated entries.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cubic-dev-ai

No issues found across 3 files

_{Re-trigger cubic}

- commands-core now ships scripts/harness-audit.js and scripts/skills-health.js: the module installs the whole commands/ dir, so /harness-audit and /skill-health were installed without their backing engines on manifest-driven installs (the original 1.10.0 failure mode) - agentic-patterns now ships scripts/claw.js: the module installs the nanoclaw-repl skill, whose workflow operates scripts/claw.js - package.json files array gains scripts/skills-health.js so the npm publish surface stays aligned with the module graph (claw.js and harness-audit.js were already listed) - orchestration drops commands/multi-workflow.md and commands/sessions.md from its explicit paths: both are already shipped by commands-core, which is a declared dependency of the module, so the duplicate ownership produced two copy operations per destination in install-state. The two scripts/lib entries are kept because hooks-runtime is NOT a declared dependency and a standalone orchestration install still needs them

konstapukarifastnetfi requested a review from affaan-m as a code owner June 5, 2026 23:31

cubic-dev-ai Bot reviewed Jun 5, 2026

View reviewed changes

affaan-m merged commit b189e8e into affaan-m:main Jun 7, 2026
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: close install manifest packaging gaps#2172

fix: close install manifest packaging gaps#2172
affaan-m merged 1 commit into
affaan-m:mainfrom
Spartallan:fix/install-manifest-packaging

konstapukarifastnetfi commented Jun 5, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 5, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

konstapukarifastnetfi commented Jun 5, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Changed

Why This Change

Testing Done

Type of Change

Security & Quality Checklist

Documentation

Summary by cubic

Summary by CodeRabbit

Release Notes

Uh oh!

coderabbitai Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

konstapukarifastnetfi commented Jun 5, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 5, 2026 •

edited

Loading