v0.2.1

v0.2.1: Doctor trusts the embedded OpenSpec

A small follow-up to v0.2.0 that finishes teaching cospec about its own embedded OpenSpec bundle: cospec doctor no longer reports a healthy standalone install as broken.

Fixed

• cospec doctor false failure on standalone installs (#15 by @replygirl) — v0.2.0 gave every wrapped command an embedded-OpenSpec fallback, but doctor never learned it: checkOpenspecVersion resolved @fission-ai/openspec only from the project's node_modules. On a runtime-free mise/GitHub-release install (no project install), that produced a false openspec-resolve ERROR ("run bun install") and a non-zero exit, even though every wrapped command worked via the embedded bundle. Spawns and diagnostics now share one resolveOpenspec() path so they can't drift, and doctor reports the embedded pin as INFO while staying read-only (it reads the compile-time pin and extracts nothing):

  INFO openspec-resolve: no project @fission-ai/openspec; wrapped calls use the embedded pinned 1.5.0
  

  Project-copy diagnostics are unchanged — an in-range copy produces no finding, and an out-of-range copy still raises the existing openspec-version ERROR. The now-obsolete doctor caveat was also removed from both READMEs.

Changed

• npm trusted publishing with provenance (#14 by @replygirl) — the release pipeline now publishes all packages via npm trusted publishing (OIDC) with --provenance, so published artifacts carry verifiable build provenance attestations.

Full Changelog: v0.2.0...v0.2.1