install.sh embeds v0.3.0 govern.mjs as heredoc — needs sync to current source

[davidcrowe]

Problem

install.sh writes govern.mjs to disk via an embedded heredoc:

cat > "$PLUGIN_DIR/bin/govern.mjs" << 'GOVERN'
#!/usr/bin/env node
import { readFileSync } from "fs";
...the entire govern.mjs source baked inline as a string literal...
GOVERN

The heredoc content is a copy of govern.mjs from a much earlier version (v0.3.0 — pre-PostToolUse, pre-error-categorization, pre-scoped-token-injection). When bin/govern.mjs was updated to v0.5.0 (then v0.5.1), the heredoc was NOT updated.

Net effect: anyone running the canonical install path

curl -sf https://agenticcontrolplane.com/install.sh | bash

gets v0.3.0 of the hook, not the latest. The plugin repo's bin/govern.mjs is effectively dead code — it's the canonical source on GitHub but doesn't reach users.

Two install.sh files exist

There are two divergent copies:

• claude-code-acp-plugin/install.sh (the plugin repo)
• agenticcontrolplane.com/install.sh (the marketing site, served at the URL above)

They're not symlinked or kept in sync. Both need updating for any user-facing change.

Suggested fix

Refactor install.sh to fetch govern.mjs from the plugin repo at install time rather than inlining it. Two reasonable approaches:

1. Fetch from https://raw.githubusercontent.com/davidcrowe/claude-code-acp-plugin/main/bin/govern.mjs (always-latest)
2. Pin to a tagged release: https://raw.githubusercontent.com/davidcrowe/claude-code-acp-plugin/v0.5.1/bin/govern.mjs

Option 2 (pinned) is safer — install.sh references a known-good version, controlled by tag.

Either way, both copies of install.sh need to be unified, ideally by symlinking the marketing-site copy to the plugin repo's, or by introducing a sync step in CI.

Acceptance criteria

• install.sh fetches govern.mjs from a known source rather than inlining it
• Both claude-code-acp-plugin/install.sh and agenticcontrolplane.com/install.sh are kept in sync (symlink, sync script, or shared origin)
• After running install.sh, ~/.acp/govern.mjs matches the canonical source for the current version
• Tagged releases work end-to-end: tag a release in the plugin repo, run install.sh, get that exact version

Related

• gatewaystack-connect#114 (cross-arch credential brokering epic)
• gatewaystack-connect#115 (Phase 1, which depends on getting users onto v0.5.x)