Skip to content
crimes docs

crimes 0.28.1

Safe installation and refresh for project agent skills. This patch completes the skill lifecycle follow-ups from the 0.28 product review. Detector behavior, finding identity, scoring and JSON schema 0.8.0 are unchanged.

Upgrading

Section titled “Upgrading”

Npm updates the CLI and its embedded template; project skills are a separate, explicit step. After upgrading crimes, run from each repository root:

Terminal window
crimes init --refresh-skills --check
crimes init --refresh-skills

The check is read-only: exit 0 means current, 1 means updates are available, and 2 means a customization/newer template or setup error needs attention. Refresh never changes config or hooks. Use --agents, --agent-skill or --codex-skill to install missing copies or select hosts. Review custom-file diffs before explicitly replacing a selected skill with --force.

What changed

Section titled “What changed”
  • Skills carry a template version and body hash. Intact managed copies and exact npm 0.27/0.28 originals update safely. Customized, unknown and newer templates stay intact; conflicts prevent all selected writes.
  • First-run --no-init is honored; default flags no longer force re-entry. Setup is repeatable. Adding a second host does not require replacing the first. init --agents --force preserves customized config. Resetting config requires the separate init --force operation without agent flags.
  • Setup validates all selected files and hook settings before writing, stages writes, and rolls back replacements on errors. Failed restoration retains the original backup. Malformed settings are never erased by force.
  • The exact shipped broken Claude hook is migrated without duplicates; customized hooks and unrelated settings are preserved. Skill refresh does not alter hooks. No Codex hook integration is claimed.
  • Skills explain local CLI invocation, retained before/after snapshots, matching roots/scopes, opaque fingerprints and repository-specific policy. Both host copies are generated from one maintained template and checked by pnpm verify.
  • The installed-package smoke covers fresh setup and a real npm 0.28.0 upgrade, read-only checks, refresh, repeat setup and customized-file handling.

Installation, update and recovery details.

Verification

Section titled “Verification”
  • pnpm verify passes on Node 26.7.0: formatting, lint, build, generated documentation/skills, typecheck and 2,480 tests.
  • Clean package smoke passes fresh setup and a real npm 0.28.0-to-0.28.1 upgrade, read-only checks, repeat setup, forced replacement and protection of customized skills, config and hooks. Packaged TypeScript/Python scans, context and pin migration also pass.
  • Website build and version/schema/capability checks pass.
  • Ranking is unchanged: mean nDCG 0.4770 across 57 scored scenarios, 0.3895 across the same 32 deep scenarios. The self-scan introduces no new high findings (12 before and after).

Fresh Codex CLI 0.153.4 and Claude Code 2.1.261 sessions both discovered and loaded the installed skill, selected the project’s npm-installed 0.28.1, ran pre-edit context and a retained scoped scan, repeated the same scan after editing, compared fingerprints, and passed independent behavior assertions. Neither changed unrelated tracked or untracked files. The task did not name the skill or supply its body. The Claude hook was omitted so the skill itself had to direct the checks.

The first Codex trial selected a global 0.28.0 over the local candidate. That exposed an instruction flaw; the final skill explicitly prefers the local installation. Two preliminary successful sessions were excluded because launcher stdin contaminated their prompts; both hosts passed again with isolated stdin. These corrections and the final observations are recorded in skill host evidence.

These are workflow smoke tests on one small task per host, using host-default models. Both pre/post scans contained zero findings. They do not measure a general productivity gain, validate responses to high findings, or guarantee activation on every task/host version. The optional harness is scripts/eval-skills.py; it requires authenticated hosts and keeps raw traces in its explicit output directory.