fix(engine): print engine version, so a stale plugin cache is visible

Measured 2026-08-04: two repos (llm-security, config-audit) independently
proved the /repo-standard skill had resolved ${CLAUDE_PLUGIN_ROOT} to a
cached 0.1.1 while 0.2.0 was installed and the catalog pinned it — same
instruction, same variable, wrong engine. 0.1.1 has neither BADGE-COUNT nor
README-LANGUAGE, so a broadcast recommending the skill produced clean-looking
runs that could not have found what they were sent to find.

The header line and --json output now carry `repo-standard v<version>`
(headerLine/withEngineVersion, both pure and unit tested). SKILL.md tells the
reader to confirm it against the catalog pin before trusting green. The
stale-cache resolution itself is the harness's, not this repo's — not fixed
here, only made visible instead of silent.

TDD: 4 new tests. 111/111 green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01496ZWasKPnA627crFBXWhe

scripts/repo-standard-check.mjs

@@ -29,6 +29,13 @@ import { fileURLToPath } from 'node:url';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REGISTER_PATH = join(HERE, '..', 'register', 'repos.json');
+const PACKAGE_PATH = join(HERE, '..', 'package.json');
+
+// This engine's own version, not the target repo's — distinct from
+// readPackageVersion(dir) below, which reads the REPO BEING CHECKED.
+export function readEngineVersion(path = PACKAGE_PATH) {
+  return JSON.parse(readFileSync(path, 'utf8')).version;
+}
 
 const LEVELS = ['OK', 'SKIP', 'WARN', 'ERROR'];
 
@@ -980,11 +987,25 @@ const BUCKET_TITLE = {
   weakening: 'WEAKENING — present, but it reads as amateur',
 };
 
-function render(result) {
-  const mark = { OK: '✓', WARN: '!', ERROR: '✗', SKIP: '·' };
+// A stale plugin cache once served 0.1.1 while 0.2.0 was installed and
+// pinned, silently — the output looked like a clean pass, because nothing
+// said which engine had run. This is the fix: name the version so a wrong
+// engine is visible, not just correctable in hindsight.
+const MARK = { OK: '✓', WARN: '!', ERROR: '✗', SKIP: '·' };
+
+export function headerLine(result, engineVersion) {
   const klass = result.klass ? ` [${result.klass}]` : '';
   const traits = result.traits?.length ? ` {${result.traits.join(', ')}}` : '';
-  console.log(`\n${mark[result.status]} ${result.name}${klass}${traits} — ${result.status}`);
+  return `${MARK[result.status]} ${result.name}${klass}${traits} — ${result.status}  (repo-standard v${engineVersion})`;
+}
+
+export function withEngineVersion(result, engineVersion) {
+  return { ...result, engineVersion };
+}
+
+function render(result, engineVersion) {
+  const mark = MARK;
+  console.log(`\n${headerLine(result, engineVersion)}`);
 
   for (const bucket of BUCKETS) {
     const inBucket = result.findings.filter((f) => f.bucket === bucket);
@@ -1047,11 +1068,12 @@ async function main(argv) {
   }
 
   const result = inspectRepo(dir, name, register, description, catalogNames);
+  const engineVersion = readEngineVersion();
 
   if (argv.includes('--json')) {
-    console.log(JSON.stringify(result, null, 2));
+    console.log(JSON.stringify(withEngineVersion(result, engineVersion), null, 2));
   } else {
-    render(result);
+    render(result, engineVersion);
   }
   process.exit(result.status === 'ERROR' ? 1 : 0);
 }

scripts/repo-standard-check.test.mjs

@@ -31,6 +31,8 @@ import {
   parseRepoNameFromRemote,
   extractChangelogTop,
   fetchWithRetry,
+  headerLine,
+  withEngineVersion,
 } from './repo-standard-check.mjs';
 
 const REGISTER = {
@@ -1117,3 +1119,31 @@ test('a non-429 response returns immediately — no retry, no sleep', async () =
   assert.equal(fetchCalls, 1);
   assert.equal(sleepCalls, 0);
 });
+
+// --------------------------------------------------- engine version stamp
+// Measured 2026-08-04: the /repo-standard skill resolved to a cached 0.1.1
+// plugin root while 0.2.0 was installed and the catalog pinned it. Two repos
+// independently proved it by running both engines against the same checkout:
+// 0.2.0 gave 0 WARN, 0.1.1 resurrected the three false positives fixed in
+// v0.1.2/v0.1.3 — and nothing in the output said which engine had run. The
+// header carrying no version is what let a stale engine look like a pass.
+test('headerLine names the engine version, not just the repo status', () => {
+  const line = headerLine({ name: 'voyage', klass: 'plugin', traits: [], status: 'OK' }, '0.2.1');
+  assert.match(line, /voyage/);
+  assert.match(line, /OK/);
+  assert.match(line, /0\.2\.1/);
+});
+
+test('headerLine includes traits when present, same as the unversioned line did', () => {
+  const line = headerLine({ name: 'llm-security', klass: 'plugin', traits: ['security'], status: 'WARN' }, '0.2.1');
+  assert.match(line, /\{security\}/);
+});
+
+test('withEngineVersion adds the version without disturbing existing fields', () => {
+  const result = { name: 'x', klass: 'plugin', status: 'OK', findings: [] };
+  const stamped = withEngineVersion(result, '0.2.1');
+  assert.equal(stamped.engineVersion, '0.2.1');
+  assert.equal(stamped.name, 'x');
+  assert.equal(stamped.status, 'OK');
+  assert.deepEqual(result, { name: 'x', klass: 'plugin', status: 'OK', findings: [] });
+});