ForgeBox wheels-core artifact ships internal docs/superpowers planning files (specs, PR drafts, patches)

[bpamiri]

Problem

tools/build/scripts/prepare-core.sh copies the whole repo docs tree into the package:

rm -rf "${BUILD_DIR}/wheels/docs"
mkdir -p "${BUILD_DIR}/wheels/docs"
cp -r docs/* "${BUILD_DIR}/wheels/docs/"

The published wheels-core 4.0.3 zip (verified via unzip -l) therefore contains 75 files under docs/superpowers/ — internal AI planning artifacts such as docs/superpowers/specs/2026-04-20-wheels-deploy-kamal-port-design.md, docs/superpowers/artifacts/lucli-pr-1/cfml-exit-code.patch, and draft PR.md/ISSUE.md files — plus docs/plans/. These are working documents, not user documentation, and they're now distributed into every app's vendor/wheels/docs/ on box install wheels-core.

Suggested fix

Either curate the copy (e.g. cp -r docs/api docs/contributing ... allowlist) or exclude internal trees explicitly:

cp -r docs/* "${BUILD_DIR}/wheels/docs/"
rm -rf "${BUILD_DIR}/wheels/docs/superpowers" "${BUILD_DIR}/wheels/docs/plans"

Check whether prepare-base.sh / prepare-cli.sh / prepare-starterApp.sh have the same exposure, and consider a validation step in release.yml's "Validate Package Structure" that fails if docs/superpowers appears in any build dir.

🤖 Generated with Claude Code

[wheels-bot]

Wheels Bot — Triage

Classified as bug.

The report describes observable wrong behavior confirmed against the published artifact: "The published wheels-core 4.0.3 zip ... contains 75 files under docs/superpowers/ — internal AI planning artifacts." The cause is reproducible in isolation — tools/build/scripts/prepare-core.sh:37-39 does an unfiltered cp -r docs/* into the package, sweeping in docs/superpowers/ and docs/plans/.

Suspected layer

cli — nearest documented layer, but the actual target is release/build tooling (tools/build/scripts/), which sits outside the runtime layer taxonomy. There is no .ai/wheels/<layer>/ doc for the packaging pipeline; propose-fix should work directly from the script.

Fix sketch

Single-file mechanical change in tools/build/scripts/prepare-core.sh: after the cp -r docs/* "${BUILD_DIR}/wheels/docs/" line (39), exclude internal trees — rm -rf "${BUILD_DIR}/wheels/docs/superpowers" "${BUILD_DIR}/wheels/docs/plans" — or switch to an allowlist copy. Verified the sibling prepare scripts (prepare-base.sh / prepare-cli.sh / prepare-starterApp.sh) do not copy docs/*, so the exposure is isolated to this one script. Optionally add a guard to release.yml's "Validate Package Structure" step that fails if docs/superpowers appears in any build dir.

Confidence: high

The what-happened / what-expected is explicit and artifact-verified, the target is a single unambiguous bash file with a mechanical fix, and no runtime/cross-engine/security/migration/DI surface is involved.

<!-- wheels-bot:triage:3179 -->
<!-- wheels-bot:triage-class:bug -->
<!-- wheels-bot:triage-confidence:high -->

[wheels-bot]

Wheels Bot — Fix proposed

Draft PR: #3186

Spec: vendor/wheels/tests/specs/security/PackageDocsHygieneSpec.cfc — failing → passing
Implementation: tools/build/scripts/prepare-core.sh (excludes docs/superpowers + docs/plans after the docs copy)

The spec is a structural source-scan guard (mirrors buildArtifactLicenseSpec.cfc); the fail→passing transition was validated deterministically against the script source, since the live CFML runner (wheels CLI) isn't available in the bot sandbox. The three sibling prepare scripts don't copy docs/*, so the guard covers them vacuously and blocks any copy-paste regression.

A human review is required before merge. The Reviewer will weigh in shortly. Doc updates (MDX guides, .ai/wheels/, CLAUDE.md) are handled separately by bot-update-docs.yml.

[bpamiri]

Fixed on develop by #3194 (merged): prepare-core.sh now ships only the user-facing reference docs and explicitly excludes docs/superpowers, docs/plans, docs/releases from the public artifact.