chore(release): bump @aictrl/cli to 0.4.4 and guard tag/package version drift

[byapparov]

Why

The first v0.4.4 publish only half-completed:

• publish.yml stamps the platform binaries (@aictrl/cli-*) with the tag version, so all of them published as 0.4.4;
• @aictrl/cli itself is published with the version in packages/cli/package.json, which was still 0.4.3. publish-if-new.sh tolerated "cannot publish over 0.4.3";
• the smoke test then failed with ETARGET No matching version found for @aictrl/cli@0.4.4.

Changes

• Bump packages/cli/package.json to 0.4.4.
• Add a step to publish.yml, before any publish, that fails fast if the release tag version differs from packages/cli/package.json. This stops a half-shipped release from happening again.

After merge

Re-create the v0.4.4 release at this PR's merge commit. The platform binaries are skipped as already published (same code), @aictrl/cli@0.4.4 publishes, and the smoke test runs.

🤖 Generated with Claude Code

https://claude.ai/code/session_016Uxnh5yTnJtZmnBwKDdVzK

[aictrl-dev]

Code review

Verdict: Address the major findings before merging. · 🔴 0 · 🟠 1 · 🟡 2 · ⚪ 1 · 0/4 resolved

• 🟡 .github/workflows/publish.yml:58-71 — Version guard runs after full turbo build; fail before it
• 🟡 .github/workflows/publish.yml:67-69 — No empty-AICTRL_VERSION check; non-tag runs mislead
• ⚪ .github/workflows/publish.yml:67 — Guard step uses node -p in a bun-based workflow
• 🟠 packages/cli/package.json:4 — Version bump ships without a lockfile update

🤖 Fix all 4 open findings with your agent

Fix the following code review findings on aictrl-dev/cli PR #125 (head branch).
Run the relevant tests/linters after each change.

1. .github/workflows/publish.yml:58-71 — Version guard runs after full turbo build; fail before it
   Detail: The new guard step is inserted after `bun turbo build`, so a tag/package.json mismatch (the exact scenario this guard exists to catch) still pays for the entire monorepo build before failing. The check only needs package.json + AICTRL_VERSION, so it should run before the build to fail fast and save CI minutes on broken releases.
   Suggested fix: Move the 'Verify the release tag matches the @aictrl/cli package version' step above the `bun turbo build` step (right after AICTRL_VERSION is exported to GITHUB_ENV).
2. .github/workflows/publish.yml:67-69 — No empty-AICTRL_VERSION check; non-tag runs mislead
   Detail: The guard compares PKG_VERSION to AICTRL_VERSION with exact string equality but never asserts AICTRL_VERSION is set/non-empty. If the workflow is ever triggered outside a tag context (workflow_dispatch, branch push) or the upstream derivation changes, the step fails with a confusing 'Release tag version  does not match ... 0.4.4' error instead of a clear 'not a versioned release' message. It also does not tolerate a leading `v` if the strip logic regresses, turning every valid release red.
   Suggested fix: Prepend: `if [ -z "$AICTRL_VERSION" ]; then echo '::error::AICTRL_VERSION is empty (non-tag run?)'; exit 1; fi` and compare against `"${AICTRL_VERSION#v}"` so a stray leading v cannot hard-fail valid releases.
3. .github/workflows/publish.yml:67 — Guard step uses node -p in a bun-based workflow
   Detail: The new step reads the version via `node -p "require('./packages/cli/package.json').version"` while the surrounding job's toolchain is bun (adjacent step runs `bun turbo build`). It works on GitHub-hosted runners where node is preinstalled, but mixing runtimes drifts from the file's bun convention and breaks if the job ever moves to a bun-only container.
   Suggested fix: Use the job's toolchain, e.g. `PKG_VERSION=$(bun -e "console.log(require('./packages/cli/package.json').version)")`, or pin the runtime explicitly.
4. packages/cli/package.json:4 — Version bump ships without a lockfile update
   Detail: The bump to 0.4.4 touches only packages/cli/package.json; the PR contains no bun.lock/bun.lockb (or package-lock.json) update. Bun lockfiles record workspace package versions, so CI installs using --frozen-lockfile (typical for this bun/turbo repo) can fail with an out-of-date lockfile, and the checked-in lockfile stays inconsistent with the manifest.
   Suggested fix: Run `bun install` on the release branch and commit the regenerated lockfile (bun.lock/bun.lockb) alongside the version bump, or verify CI installs without --frozen-lockfile before merging.

📋 Out-of-diff findings (4)

Sev	Location	Finding
🟡	.github/workflows/publish.yml:58-71	Version guard runs after full turbo build; fail before it
🟡	.github/workflows/publish.yml:67-69	No empty-AICTRL_VERSION check; non-tag runs mislead
⚪	.github/workflows/publish.yml:67	Guard step uses node -p in a bun-based workflow
🟠	packages/cli/package.json:4	Version bump ships without a lockfile update

Reviewed 2 files · 0 inline · view all 4 findings ↗

---

aictrl · AI code review for fast-moving teams · aictrl.dev

[byapparov]

Review response — PR #125

This PR merged before the automated review findings were answered. Verdicts are recorded below. No code changes are pushed here; the two valid findings are deferred to #126.

Issues addressed (pushed to this PR)

None. The PR is already merged. Accepted findings are deferred to #126.

Review claims verified false (no change needed)

• "Guard step uses node -p in a bun-based workflow" (NIT, .github/workflows/publish.yml:67): verified false. The job installs Node 22 with actions/setup-node, upgrades npm, publishes every package with npm publish, and already uses node -e to rewrite packages/cli/package.json. Node is a first-class tool in this workflow, so node -p matches the file's conventions.
• "Version bump ships without a lockfile update" (MAJOR, packages/cli/package.json:4): verified false. bun.lock has recorded the packages/cli workspace as 0.3.3 since 0.4.0, with no effect. On this PR, the verify job's bun install --frozen-lockfile passed, and the 0.4.4 publish succeeded. Keeping that workspace version in sync is a hygiene item and is listed in Chore: harden publish.yml release checks #126, item (d).

Not addressed here

• Version guard runs after the full turbo build (MINOR, .github/workflows/publish.yml:58-71): true. The guard only needs package.json and AICTRL_VERSION, so it should fail before bun turbo build. It still fails before any publish step, so correctness is unaffected. Deferred to Chore: harden publish.yml release checks #126, item (a).
• No empty-AICTRL_VERSION check (MINOR, .github/workflows/publish.yml:67-69): true. The workflow only triggers on release: published, so the tag is always set today, but an explicit empty check is cheap and gives a clearer error. Deferred to Chore: harden publish.yml release checks #126, item (b).