[lchoquel]

TL;DR

• The validation hook bundle check.mjs is rebuilt on @pipelex/sdk 0.54.1 with @pipelex/tools-wasm 0.6.1, so its validate stage's User-Agent now names 0.54.1; its lint, its format and the request it sends are otherwise unchanged.
• The release gate make check-hook-fresh refused the next release because the vendored bundle still embedded @pipelex/sdk 0.53.0 and @pipelex/tools-wasm 0.6.0, behind npm's latest engine and behind a rebuild at pipelex-sdk dev.

Behaviour changes

• The User-Agent of the hook's validate stage names pipelex-sdk-js 0.53.0 → 0.54.1.

Changes

Hook bundle

• templates/hooks/assets/check.mjs re-vendored with make vendor-hook from pipelex-sdk dev at bc448bf, which pins @pipelex/tools-wasm 0.6.1, and propagated by make build to pipelex/hooks/check.mjs, pipelex-codex/hooks/check.mjs and pipelex-vibe/hooks/check.mjs.
• Provenance line: @pipelex/sdk 0.53.0 (5dfe747) + @pipelex/tools-wasm 0.6.0 (npm) → @pipelex/sdk 0.54.1 (bc448bf) + @pipelex/tools-wasm 0.6.1 (npm).
• Below the banner the rebuild differs in three places. The inlined engine's JavaScript loader is re-minified and loads the wasm module through the new rust-plugin 3 entry point; the engine moved from 0.6.0 to 0.6.1 by dependency refreshes only, with its embedded MTHDS schema, lint and formatter unchanged. SDK_VERSION reads 0.54.1. PipelexApiClient.getFile gains the SDK's withUseCreator normalization, which sets a file use's absent created_by to null; the hook calls only validate, and the method is in the bundle only because esbuild keeps a class's methods, so that change does not reach the hook's users and the changelog does not mention it.

Changelog

• The existing [Unreleased] bullet "The validation hook names each problem item of a refused method (Breaking)" is edited in place to name @pipelex/sdk 0.54.1, @pipelex/tools-wasm 0.6.1 and a User-Agent of 0.54.1, since the unreleased section is the delta since the last release.

How it was verified

• npm ci in pipelex-sdk/js before the vendor, since its node_modules still held tools-wasm 0.6.0; make vendor-hook printed the new provenance line above.
• make check-hook-fresh: "The bundle embeds 0.6.1, which is npm's latest", "A rebuild at dev is identical below the banner", "The vendored hook bundle is current", exit 0.
• make agent-check: all checks passed, the provenance guard and the notices check included ("Every package the hook bundle inlines is named in its notices file"); it rewrote no file.
• DO_NOT_TRACK=1 make agent-test: all tests passed, the hook's sweep over the corpus included.

Documentation

• CHANGELOG.md [Unreleased]: the hook bullet names the new versions. docs/hooks.md names no embedded version, so it needed no change.

Closes L-261025-087fe8

🤖 Generated with Claude Code

https://claude.ai/code/session_01ChCUgUaFZK7FTEAc8uPAVL