Clay Good
63666c8bb2
* ci: report the correct pnpmDeps hash when flake.nix is stale Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * ci: scope the reported hash to the pnpmDeps block Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * ci(flake): scope every hash rewrite to the pnpmDeps block alfred-openspec on #1817: the workflow read is scoped now, but the script it runs is not. update-flake.sh read CURRENT_HASH from the first hash assignment anywhere in flake.nix, and all three in-place rewrites matched every hash assignment. flake.nix holds one fixed-output derivation today, so that lands on the right line by luck; add a second and the script stamps the placeholder over both, reads back whichever mismatch Nix reported first, and writes pnpmDeps' hash into the other derivation. Scoping only the workflow left that path fragile, as the review says. The address range is declared once as PNPM_DEPS_BLOCK and used by the read and all three rewrites, so the scoping cannot drift between call sites. Also guards the read: an unmatched block previously left CURRENT_HASH empty, and the failure path would then restore hash = "". It now exits before touching the file. Verified against a three-derivation fixture with pnpmDeps in the middle, which catches both shapes of the bug: the scoped read returns the pnpmDeps hash while an unscoped read returns the first derivation's, the placeholder is written once rather than three times, and the neighbouring hashes survive the restore. That fixture is the new test, alongside a static check that no hash read or rewrite in the script is missing the range. Verified the static check fails when any one call site is unscoped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(flake): run the scoping fixture on its own volume The new test failed on windows-pwsh with 'sed: cannot rename ./sedKaAflu: Invalid cross-device link'. sed -i writes its temp file in the working directory and renames it over the target; on a GitHub Windows runner the repo is on D: and os.tmpdir() is on C:, so that rename crosses volumes. bash now runs with cwd set to the fixture directory and addresses the file by name, which keeps the temp file and its rename on one volume. The assertions are unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
OpenSpec Scripts
Utility scripts for OpenSpec maintenance and development.
update-flake.sh
Updates flake.nix pnpm dependency hash automatically.
When to use: After updating dependencies (pnpm install, pnpm update).
Usage:
./scripts/update-flake.sh
What it does:
- Reads version from
package.json(dynamically used byflake.nix) - Automatically determines the correct pnpm dependency hash
- Updates the hash in
flake.nix - Verifies the build succeeds
Example workflow:
# After dependency updates
pnpm install
./scripts/update-flake.sh
git add flake.nix
git commit -m "chore: update flake.nix dependency hash"
regen-parity-hashes.mjs
Recomputes the golden hashes pinned in
test/core/templates/skill-templates-parity.test.ts.
When to use: After any intended workflow-template change, and after rebasing a branch that edits templates — two branches touching different templates collide on the same hash map, and hand-editing 64-character hashes during a conflict is where transcription mistakes happen.
Usage:
pnpm build && pnpm regen:parity-hashes
pnpm vitest run test/core/templates/skill-templates-parity.test.ts
What it does:
- Refuses to run if
dist/is missing or older thansrc/— hashes come from the build, while the parity test readssrc/, so regenerating against a stale build writes hashes the test then rejects - Recomputes every pinned hash from the built
dist/ - Rewrites the map in place and prints which entries moved
- Exits non-zero, writing nothing, if it cannot account for every pinned hash:
a label with no matching export (a renamed or deleted template), or a hash
line these patterns do not recognise. Both would otherwise be left stale
while the run reported success, so
nothing to updatealways means it.
Line endings round-trip unchanged, so a CRLF checkout is safe — test/** has no
text eol=lf attribute, so the file arrives with CRLF on Windows.
The parity test recomputes the same hashes independently, so this script cannot silently produce a wrong value. Always run the test afterwards; it, not this script, is the authority.
The rewriting lives in parity-hash-shared.mjs so its guards can be exercised
against fabricated input — see test/core/templates/parity-hash-shared.test.ts.
A test that ran this script for real would rewrite the repository's own parity
test file mid-suite.
pack-version-check.mjs
Validates package version consistency before publishing.