fix: use latest release assets for installers

Author: tw93

.github/workflows/release.yml

@@ -31,7 +31,12 @@ jobs:
         run: make test
       - run: make package
       - name: Upload waza.zip to release
-        run: gh release upload "${{ github.event.release.tag_name }}" dist/waza.zip --clobber
+        run: |
+          gh release upload "${{ github.event.release.tag_name }}" \
+            dist/waza.zip \
+            scripts/setup-rule.sh \
+            scripts/setup-statusline.sh \
+            --clobber
         env:
           GH_TOKEN: ${{ github.token }}
   publish-npm:

README.md

@@ -108,6 +108,7 @@ npx skills update -g -y
 
 Marketplace installs use `claude plugin update <skill>`. Claude Desktop users can replace the old skill with the latest [waza.zip](https://github.com/tw93/Waza/releases/latest/download/waza.zip).
 Pi users can run `pi update npm:@tw93/waza`, or `pi update --extensions` to update all installed Pi packages.
+To hear about new versions, watch [GitHub Releases](https://github.com/tw93/Waza/releases) for Waza.
 
 ## Project Context
 
@@ -143,7 +144,7 @@ A minimal statusline for Claude Code: context window, 5-hour quota, and 7-day qu
 </div>
 
 ```bash
-curl -sL https://raw.githubusercontent.com/tw93/Waza/v3.27.0/scripts/setup-statusline.sh | bash
+curl -sL https://github.com/tw93/Waza/releases/latest/download/setup-statusline.sh | bash
 ```
 
 **Codex** has native statusline items. Add to `~/.codex/config.toml`:
@@ -166,28 +167,28 @@ Optional rule for English practice. When your prompt contains an English mistake
 
 ```bash
 # Claude Code
-curl -sL https://raw.githubusercontent.com/tw93/Waza/v3.27.0/scripts/setup-rule.sh | bash -s -- english claude-code
+curl -sL https://github.com/tw93/Waza/releases/latest/download/setup-rule.sh | bash -s -- english claude-code
 
 # Codex
-curl -sL https://raw.githubusercontent.com/tw93/Waza/v3.27.0/scripts/setup-rule.sh | bash -s -- english codex
+curl -sL https://github.com/tw93/Waza/releases/latest/download/setup-rule.sh | bash -s -- english codex
 ```
 
 ### Anti-Patterns
 
 Optional always-on guardrails for cross-skill behaviors: stop acting before reading, no hallucinated paths, no scope creep, no unsolicited summaries. Skill-agnostic, applies in every session.
 
 ```bash
-curl -sL https://raw.githubusercontent.com/tw93/Waza/v3.27.0/scripts/setup-rule.sh | bash -s -- anti-patterns claude-code
+curl -sL https://github.com/tw93/Waza/releases/latest/download/setup-rule.sh | bash -s -- anti-patterns claude-code
 ```
 
-Use `codex` instead of `claude-code` for Codex. Curl URLs are pinned to the current release tag for reproducibility; swap `v3.27.0` for `main` if you want bleeding-edge scripts.
+Use `codex` instead of `claude-code` for Codex. Curl URLs use the latest GitHub release asset. Set `WAZA_REF=main` before the command if you want bleeding-edge scripts.
 
 ### Routing Hint
 
 Optional pointer that tells the host to prefer Waza skills when a request matches their triggers. Useful for Codex, Pi, and other agents that do not auto-route from skill `description`. Claude Code already routes through descriptions, so this is opt-in even there.
 
 ```bash
-curl -sL https://raw.githubusercontent.com/tw93/Waza/v3.27.0/scripts/setup-rule.sh | bash -s -- waza-routing claude-code
+curl -sL https://github.com/tw93/Waza/releases/latest/download/setup-rule.sh | bash -s -- waza-routing claude-code
 ```
 
 Use `codex` instead of `claude-code` for Codex.

scripts/build_metadata.py

@@ -194,19 +194,29 @@ def render_dispatcher(template: str, skills: list[dict]) -> str:
     return pattern.sub(block, template)
 
 
-# Matches both pinned (v3.24.0) and unpinned (main) install URLs so the
-# generator can rewrite either form to the current VERSION.
+# README installer entrypoints should follow the latest GitHub release asset.
+# The downloaded scripts themselves still default WAZA_REF to a release tag, so
+# users get a stable install without README churn on every version bump.
 README_INSTALL_URL_RE = re.compile(
-    r"raw\.githubusercontent\.com/tw93/Waza/(?:main|v\d+\.\d+\.\d+)/scripts/"
+    r"https://raw\.githubusercontent\.com/tw93/Waza/"
+    r"(?:main|v\d+\.\d+\.\d+)/scripts/(setup-(?:rule|statusline)\.sh)"
+)
+README_SWAP_TAG_RE = re.compile(
+    r"Curl URLs are pinned to the current release tag for reproducibility; "
+    r"swap `v\d+\.\d+\.\d+` for `main` if you want bleeding-edge scripts\."
 )
-README_SWAP_TAG_RE = re.compile(r"swap `v\d+\.\d+\.\d+` for `main`")
 WAZA_REF_RE = re.compile(r'WAZA_REF="\$\{WAZA_REF:-(?:main|v\d+\.\d+\.\d+)\}"')
 
 
 def render_readme(current: str, version: str) -> str:
-    pinned = f"raw.githubusercontent.com/tw93/Waza/v{version}/scripts/"
-    current = README_INSTALL_URL_RE.sub(pinned, current)
-    return README_SWAP_TAG_RE.sub(f"swap `v{version}` for `main`", current)
+    current = README_INSTALL_URL_RE.sub(
+        r"https://github.com/tw93/Waza/releases/latest/download/\1", current
+    )
+    return README_SWAP_TAG_RE.sub(
+        "Curl URLs use the latest GitHub release asset. Set `WAZA_REF=main` "
+        "before the command if you want bleeding-edge scripts.",
+        current,
+    )
 
 
 def render_script_ref(current: str, version: str) -> str:
@@ -284,7 +294,7 @@ def main() -> int:
             drift = True
         if readme_actual != readme_rendered:
             print(
-                f"DRIFT: README.md install URLs are not pinned to v{version}.\n"
+                "DRIFT: README.md installer URLs must use latest release assets.\n"
                 f"Run scripts/build_metadata.py (no flags) to regenerate.",
                 file=sys.stderr,
             )
@@ -322,7 +332,7 @@ def main() -> int:
         if drift:
             return 1
         print(f"ok: {target.relative_to(root)} matches generator")
-        print(f"ok: README.md install URLs pinned to v{version}")
+        print("ok: README.md install URLs use latest release assets")
         print(f"ok: package.json pinned to v{version}")
         print(f"ok: installer defaults pinned to v{version}")
         print(f"ok: {dispatcher_target.relative_to(root)} matches generator")
@@ -338,9 +348,9 @@ def main() -> int:
         print(f"ok: package.json already pinned to v{version}")
     if readme_actual != readme_rendered:
         readme.write_text(readme_rendered)
-        print(f"wrote: README.md (pinned install URLs to v{version})")
+        print("wrote: README.md (installer URLs use latest release assets)")
     else:
-        print(f"ok: README.md install URLs already pinned to v{version}")
+        print("ok: README.md install URLs already use latest release assets")
     for script, actual, rendered_script in script_pairs:
         if actual != rendered_script:
             script.write_text(rendered_script)

scripts/skill_checks.py

@@ -656,7 +656,21 @@ def check_readme_install_command(root: Path):
                 f"include {command!r}\n"
                 f"  Waza's documented agent support depends on this exact string."
             )
-    print("ok: README installs nested skills, Pi package, Antigravity, and OpenCode")
+    expected_installers = {
+        "setup-rule": "https://github.com/tw93/Waza/releases/latest/download/setup-rule.sh",
+        "setup-statusline": "https://github.com/tw93/Waza/releases/latest/download/setup-statusline.sh",
+    }
+    for label, url in expected_installers.items():
+        if url not in text:
+            fail(
+                f"README {label.upper()} URL: README.md must include {url!r}\n"
+                f"  Installer snippets should follow the latest release asset "
+                f"without per-release README churn."
+            )
+    print(
+        "ok: README installs nested skills, Pi package, Antigravity, OpenCode, "
+        "and latest installer assets"
+    )
 
 
 def check_release_workflow_npm_surface(root: Path):
@@ -674,6 +688,8 @@ def check_release_workflow_npm_surface(root: Path):
         "github.event.release.tag_name": "checks the GitHub release tag",
         "package.json').pi.skills[0]": "checks Pi package metadata",
         "dist-tags.latest": "confirms the npm latest dist-tag",
+        "scripts/setup-rule.sh": "uploads the rule installer as a latest release asset",
+        "scripts/setup-statusline.sh": "uploads the statusline installer as a latest release asset",
     }
     missing = [label for label, reason in required.items() if label not in text]
     if missing:
@@ -682,7 +698,7 @@ def check_release_workflow_npm_surface(root: Path):
             "must publish and verify @tw93/waza for Pi installs.\n"
             + "\n".join(f"  missing {label!r}: {required[label]}" for label in missing)
         )
-    print("ok: release workflow publishes and verifies npm package")
+    print("ok: release workflow publishes npm package and installer assets")
 
 
 def check_english_coaching_guard(root: Path):

tests/python/test_build_metadata.py

@@ -8,22 +8,22 @@
 import build_metadata as bm
 
 
-def test_render_readme_pins_main_to_version():
+def test_render_readme_rewrites_main_to_latest_asset():
     body = "curl https://raw.githubusercontent.com/tw93/Waza/main/scripts/setup-rule.sh"
     out = bm.render_readme(body, "9.9.9")
-    assert "tw93/Waza/v9.9.9/scripts/" in out
-    assert "tw93/Waza/main/scripts/" not in out
+    assert "https://github.com/tw93/Waza/releases/latest/download/setup-rule.sh" in out
+    assert "raw.githubusercontent.com" not in out
 
 
-def test_render_readme_repins_older_version():
+def test_render_readme_rewrites_pinned_version_to_latest_asset():
     body = "curl https://raw.githubusercontent.com/tw93/Waza/v1.2.3/scripts/setup-rule.sh"
     out = bm.render_readme(body, "9.9.9")
-    assert "tw93/Waza/v9.9.9/scripts/" in out
+    assert "https://github.com/tw93/Waza/releases/latest/download/setup-rule.sh" in out
     assert "v1.2.3" not in out
 
 
-def test_render_readme_no_change_when_already_pinned():
-    body = "curl https://raw.githubusercontent.com/tw93/Waza/v9.9.9/scripts/setup-rule.sh"
+def test_render_readme_no_change_when_already_latest_asset():
+    body = "curl https://github.com/tw93/Waza/releases/latest/download/setup-rule.sh"
     assert bm.render_readme(body, "9.9.9") == body
 
 

tests/test_codegen.sh

@@ -36,19 +36,23 @@ test "$(jq -r '.name' "$tmpdir/regen/package.json")" = "@tw93/waza"
 test "$(jq -r '.pi.skills[0]' "$tmpdir/regen/package.json")" = "./skills"
 test "$(jq -r '.publishConfig.access' "$tmpdir/regen/package.json")" = "public"
 
-# README install URLs must be pinned to VERSION, not floating on main.
+# README installer URLs should use latest release assets. The installer scripts
+# themselves still pin WAZA_REF to VERSION.
 copy_repo "$tmpdir/readme"
 version=$(cat "$tmpdir/readme/VERSION")
-sed -i.bak "s|tw93/Waza/v${version}/scripts/|tw93/Waza/main/scripts/|g" "$tmpdir/readme/README.md"
+sed -i.bak \
+  "s|https://github.com/tw93/Waza/releases/latest/download/setup-rule.sh|https://raw.githubusercontent.com/tw93/Waza/v${version}/scripts/setup-rule.sh|g; s|https://github.com/tw93/Waza/releases/latest/download/setup-statusline.sh|https://raw.githubusercontent.com/tw93/Waza/v${version}/scripts/setup-statusline.sh|g" \
+  "$tmpdir/readme/README.md"
 rm "$tmpdir/readme/README.md.bak"
 if (cd "$tmpdir/readme" && python3 scripts/build_metadata.py --check >"$tmpdir/readme.out" 2>"$tmpdir/readme.err"); then
-  echo "build_metadata --check should detect unpinned README URLs"; exit 1
+  echo "build_metadata --check should detect raw README installer URLs"; exit 1
 fi
-grep -q "README.md install URLs are not pinned" "$tmpdir/readme.err"
+grep -q "README.md installer URLs must use latest release assets" "$tmpdir/readme.err"
 (cd "$tmpdir/readme" && python3 scripts/build_metadata.py >"$tmpdir/readme-regen.out")
-grep -q "tw93/Waza/v${version}/scripts/" "$tmpdir/readme/README.md"
-if grep -q "tw93/Waza/main/scripts/" "$tmpdir/readme/README.md"; then
-  echo "README still has unpinned install URLs after regen"; exit 1
+grep -q "tw93/Waza/releases/latest/download/setup-rule.sh" "$tmpdir/readme/README.md"
+grep -q "tw93/Waza/releases/latest/download/setup-statusline.sh" "$tmpdir/readme/README.md"
+if grep -q "raw.githubusercontent.com/tw93/Waza/.*/scripts/setup-" "$tmpdir/readme/README.md"; then
+  echo "README still has raw installer URLs after regen"; exit 1
 fi
 
 # package.json is generated too; package version and Pi metadata must stay