chore(release): bump to 5.2.6 — Pro installer workspace hijack hotfix by rafaelscosta · Pull Request #743 · SynkraAI/aiox-core

rafaelscosta · 2026-05-17T10:08:54Z

Summary

Hotfix release for #742 (already merged in main as squash 20e79996).

Bumps:

@aiox-squads/core: 5.2.5 → 5.2.6
aiox-core (compat wrapper): 5.2.5 → 5.2.6 (+ dep @aiox-squads/core: 5.2.5 → 5.2.6)
@aiox-squads/installer: 3.3.4 → 3.3.5

Why this exists

Cohort students hit Pro activation failed: Installed Pro artifact did not create node_modules/@aiox-squads/pro whenever they ran aiox install in a directory that sits beneath an ancestor with a package.json or a declared workspaces: array. Root cause was npm 10+ walking up to find a manifest. Fix in #742 anchors the install with --prefix + --workspaces=false and adds a graceful temp-cache fallback.

E2E validated against the real @aiox-squads/pro@0.4.3 tgz across 5 install topologies (5/5 PASS):

Subpasta vazia + parent com package.json (cenário exato do print)
Subpasta de monorepo com workspaces:
Pasta fresh ~/aiox-pro (happy path)
Projeto próprio com package.json
Sub-sub-subpasta com workspace 3 níveis acima

Release mechanics

Merging this PR + pushing tag v5.2.6 triggers .github/workflows/npm-publish.yml, which publishes to npmjs.org using NPM_TOKEN_AIOX_SQUADS. Tag push will follow immediately after merge.

Test plan

npm run lint → clean
npm run test:ci → 8472 passed, 151 skipped, 0 failures (343 suites)
Installer regression suite → 259/259 (incl. 8 new hijack tests)
E2E with real Pro tgz → 5/5 PASS
Versions consistent across package.json, compat/aiox-core/package.json, packages/installer/package.json, package-lock.json
After merge: tag v5.2.6, push tag, watch npm-publish.yml workflow, verify npm view @aiox-squads/core version returns 5.2.6

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes
- Fixed Pro installer failing when running from directories nested under package.json or workspaces declarations, with improved error diagnostics.
Documentation
- Updated setup guidance with simplified one-command workaround and removed previous manual workaround.

Hotfix release for #742 (already merged). Bumps: * @aiox-squads/core: 5.2.5 → 5.2.6 * aiox-core (compat wrapper): 5.2.5 → 5.2.6 + dependency @aiox-squads/core: 5.2.5 → 5.2.6 * @aiox-squads/installer: 3.3.4 → 3.3.5 Pushing tag v5.2.6 triggers .github/workflows/npm-publish.yml which publishes to npmjs.org using NPM_TOKEN_AIOX_SQUADS. After publish, students hit by "Installed Pro artifact did not create node_modules/@aiox-squads/pro" can update via: npx -y -p @aiox-squads/core@latest aiox install without the previously recommended fresh-directory workaround. Includes: - package-lock.json refreshed to 5.2.6 - CHANGELOG.md entry under [5.2.6] - 2026-05-17 - .aiox-core/data/entity-registry.yaml regenerated by pre-commit hook (757 → 815 entities — incidental sync, not caused by this release) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

vercel · 2026-05-17T10:09:00Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aiox-core	Ready	Preview, Comment	May 17, 2026 10:09am

coderabbitai · 2026-05-17T10:09:06Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 21137d38-f7f5-4902-890e-e9a5a09f947b

📥 Commits

Reviewing files that changed from the base of the PR and between 20e7999 and 462de9b.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

.aiox-core/data/entity-registry.yaml
.aiox-core/install-manifest.yaml
CHANGELOG.md
compat/aiox-core/package.json
package.json
packages/installer/package.json

Walkthrough

This PR coordinates the 5.2.6 release by documenting a Pro installer fix for nested workspace failures, updating all package versions consistently across the monorepo, and refreshing the install manifest with new integrity metadata for entity-registry.yaml.

Changes

Version 5.2.6 Release Coordination

Layer / File(s)	Summary
Release notes for version 5.2.6 `CHANGELOG.md`	The changelog documents the Pro installer fix for failures when running `aiox install` under directories nested beneath ancestor `package.json` or `workspaces` declarations, including fallback behavior using sha256-verified cache retrieval, new regression test coverage in `tests/installer/pro-setup-target-install.test.js`, and CI coverage via `.github/workflows/installer-smoke-matrix.yml`. User guidance includes an `npx` workaround and removal of the prior fresh-directory requirement.
Package version bumps `package.json`, `compat/aiox-core/package.json`, `packages/installer/package.json`	Top-level package and compat wrapper are bumped to 5.2.6; the installer package is bumped to 3.3.5. The compat wrapper's `@aiox-squads/core` dependency is aligned to 5.2.6.
Install manifest integrity updates `.aiox-core/install-manifest.yaml`	Manifest header version and timestamp are refreshed to 5.2.6, and the SHA256 hash and size for `data/entity-registry.yaml` are updated to reflect content changes.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

SynkraAI/aiox-core#728: Both PRs update .aiox-core/install-manifest.yaml metadata (version, timestamp, and file integrity hashes).
SynkraAI/aiox-core#730: Both PRs update the compat/aiox-core package, with this PR aligning its version and dependency on @aiox-squads/core to 5.2.6.

Suggested labels

area: installer, area: core, area: devops, area: docs

Suggested reviewers

Pedrovaleriolopez
oalanicolas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically identifies this as a version bump release (5.2.6) that addresses a Pro installer workspace hijack hotfix, which directly corresponds to the main changes documented in the PR objectives and changelog.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/release-5.2.6

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-05-17T10:10:35Z

📊 Coverage Report

Coverage report not available

📈 Full coverage report available in Codecov

Generated by PR Automation (Story 6.1)

…SynkraAI#743) Hotfix release for SynkraAI#742 (already merged). Bumps: * @aiox-squads/core: 5.2.5 → 5.2.6 * aiox-core (compat wrapper): 5.2.5 → 5.2.6 + dependency @aiox-squads/core: 5.2.5 → 5.2.6 * @aiox-squads/installer: 3.3.4 → 3.3.5 Pushing tag v5.2.6 triggers .github/workflows/npm-publish.yml which publishes to npmjs.org using NPM_TOKEN_AIOX_SQUADS. After publish, students hit by "Installed Pro artifact did not create node_modules/@aiox-squads/pro" can update via: npx -y -p @aiox-squads/core@latest aiox install without the previously recommended fresh-directory workaround. Includes: - package-lock.json refreshed to 5.2.6 - CHANGELOG.md entry under [5.2.6] - 2026-05-17 - .aiox-core/data/entity-registry.yaml regenerated by pre-commit hook (757 → 815 entities — incidental sync, not caused by this release) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rafaelscosta requested review from Pedrovaleriolopez and oalanicolas as code owners May 17, 2026 10:08

github-actions Bot added area: installer Installer and setup (packages/installer/) area: docs Documentation (docs/) labels May 17, 2026

coderabbitai Bot approved these changes May 17, 2026

View reviewed changes

rafaelscosta merged commit 9b837ed into main May 17, 2026
47 of 49 checks passed

rafaelscosta deleted the chore/release-5.2.6 branch May 17, 2026 10:14

This was referenced May 17, 2026

fix(release): harden npm-publish pipeline + document release SOP #744

Merged

docs: align ecosystem with release-procedure SOP + add Issue 10 troubleshooting #745

Merged

This was referenced May 17, 2026

fix: align legacy path references with current directory layout (closes #741) #747

Merged

chore(release): 5.2.7 — consolidate PRs #744-#750 from 5.2.6 #751

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(release): bump to 5.2.6 — Pro installer workspace hijack hotfix - #743

chore(release): bump to 5.2.6 — Pro installer workspace hijack hotfix#743
rafaelscosta merged 1 commit into
mainfrom
chore/release-5.2.6

rafaelscosta commented May 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented May 17, 2026

Uh oh!

coderabbitai Bot commented May 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

rafaelscosta commented May 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why this exists

Release mechanics

Test plan

Summary by CodeRabbit

Uh oh!

vercel Bot commented May 17, 2026

Uh oh!

coderabbitai Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Uh oh!

github-actions Bot commented May 17, 2026

📊 Coverage Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

rafaelscosta commented May 17, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 17, 2026 •

edited

Loading