fix(devstack): bump syncs extension pins to the NEW version before committing

Post-stable-release, settings.json pins sit at the stable tag, so the
first dev bump failed its own pre-commit validate (pins != VERSION) —
and a post-hook sync would target the OLD version since the hook runs
before the bump lands. cmd_bump now updates pins to the new VERSION
(non-interactive, no-op when settings.json is absent) right after
writing it.

Author: lpb-docs

scripts/localpibox/stack/workspace.py

@@ -450,6 +450,27 @@ def _update_pinned_versions(settings: dict, target_version: str) -> list[tuple[s
 
 # ─── Workspace: sync extension pins ───────────────────────────────────────
 
+def sync_pins_quiet(agent_dir: str | Path, target_version: str,
+                    cons: Console) -> int:
+    """Non-interactive pin update: write pins != *target_version* in
+    settings.json. Returns the number of changed extension(s); 0 if nothing
+    to do or no settings.json (a missing file is not an error here —
+    callers treat it as 'nothing to sync'). Used by `lpb-devstack bump`
+    so a VERSION commit never lands with stale pins (the pre-commit
+    validate would fail, and a post-hook sync would target the OLD
+    version)."""
+    settings = _read_settings(agent_dir)
+    if settings is None:
+        return 0
+    changed = _update_pinned_versions(settings, target_version)
+    if not changed:
+        return 0
+    _write_settings(agent_dir, settings)
+    for name, old, new in changed:
+        cons.info(f"  pin {name}: {old} → {new}")
+    return len(changed)
+
+
 def cmd_workspace_sync_pins(pipeline: str, cons: Console) -> int:
     """Sync settings.json extension pins to the pipeline's stack version."""
     agent_dir = Path(DEFAULT_AGENT_DIR)

scripts/lpb-devstack

@@ -73,6 +73,7 @@ from localpibox.stack.workspace import (  # noqa: E402
     _resolve_repo_path,
     cmd_workspace_status,
     cmd_workspace_sync,
+    sync_pins_quiet,
 )
 from localpibox.stack.validate import cmd_validate  # noqa: E402
 from localpibox.stack.release import (  # noqa: E402
@@ -130,6 +131,17 @@ def cmd_bump(cons: Console, *, minor: bool = False, major: bool = False,
     vf.write_text(new + "\n")
     cons.info(f"VERSION: {current} → {new}")
 
+    # Keep settings.json pins in lockstep with the new VERSION, BEFORE the
+    # commit: the pre-commit validate checks pins == VERSION, and syncing
+    # after the hook would target the OLD version (the hook runs before the
+    # bump lands). Without this, the first dev bump after a stable release
+    # (pins still at the stable tag) fails its own gate.
+    from localpibox.stack.repos import DEFAULT_AGENT_DIR as _agent_dir
+    n = sync_pins_quiet(_agent_dir, new, cons)
+    if n:
+        cons.info(f"Synced {n} extension pin(s) to {new} "
+                  f"(run 'pi update --extensions' after the tags exist)")
+
     if no_commit:
         cons.info("--no-commit: file written, not committed (review + commit manually)")
         return 0

scripts/test_localpibox_devstack.py

@@ -6,7 +6,9 @@
 from testharness import run_lpbx_suite, _bare_remote, _quiet_console, _load_script, SCRIPTS_DIR
 
 import os
+import json
 import subprocess
+from pathlib import Path
 from contextlib import ExitStack
 from unittest import mock
 
@@ -171,6 +173,46 @@ def test_devstack_bump_gate_blocks_and_force_bypasses(tmpdir):
             p.stop()
 
 
+def test_devstack_bump_syncs_pins_before_commit(tmpdir):
+    """bump updates settings.json pins to the NEW version before committing
+    (post-stable-release case: pins sit at the stable tag; without this the
+    pre-commit validate fails and a post-hook sync would target the old
+    version)."""
+    root = tmpdir / "devstack"
+    root.mkdir()
+    (root / "VERSION").write_text("0.0.78-lpb-dev\n")
+    agent = tmpdir / "agent"
+    agent.mkdir(parents=True, exist_ok=True)
+    settings = {"packages": [
+        "git:github.com/lpb-stack/lemonade-pi-plugin@0.0.77-lpb",
+        "git:github.com/lpb-stack/lpb-memory@0.0.77-lpb",
+        "git:github.com/lpb-stack/pi-subagents@0.0.77-lpb",
+    ]}
+    (agent / "settings.json").write_text(json.dumps(settings))
+    with _devstack_root_patch(root, tmpdir), \
+         mock.patch.object(repos_mod, "DEFAULT_AGENT_DIR", str(agent)), \
+         mock.patch.object(ws_mod, "_read_settings",
+                           lambda ad: json.loads((Path(ad) / "settings.json").read_text())), \
+         mock.patch.object(ws_mod, "_write_settings",
+                           lambda ad, s: (Path(ad) / "settings.json").write_text(json.dumps(s))):
+        code = ld.cmd_bump(_quiet_console(), no_commit=True)
+    assert code == 0
+    pins = json.loads((agent / "settings.json").read_text())
+    if isinstance(pins, dict):
+        pins = pins.get("packages", [])
+    assert all(p.endswith("@0.0.79-lpb-dev") for p in pins)
+
+
+def test_devstack_bump_missing_settings_is_noop(tmpdir):
+    """No settings.json → pin sync is a no-op, bump still succeeds."""
+    root = tmpdir / "devstack"
+    root.mkdir()
+    (root / "VERSION").write_text("0.0.57-lpb-dev\n")
+    with _devstack_root_patch(root, tmpdir), \
+         mock.patch.object(repos_mod, "DEFAULT_AGENT_DIR", str(tmpdir / "no-agent")):
+        assert ld.cmd_bump(_quiet_console(), no_commit=True) == 0
+
+
 # ─── lpb-devstack: repo tagging ───────────────────────────────────────────
 
 def test_devstack_tag_repos(tmpdir):