From 7cf7b33945bbc9017080413b0dc019b46fcff362 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 12:40:48 +0200 Subject: [PATCH 1/2] Certify pm-linear on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates Pin @unbrained/pm-cli to 2026.10.4 with pm-ops 2026.10.4 and pm-changelog 2026.9.25, take the @types/node lockfile bump (26.6.4) and the codeql-action pinned SHA group 2892aa5 from Dependabot, and recopy the canonical pm-ops merge-driver launcher byte-for-byte. Supersedes #125 #128 #129 #130 #131. --- .agents/pm/chores/pm-linear-2cy6.toon | 27 ++ .agents/pm/history/pm-linear-2cy6.jsonl | 16 ++ .github/workflows/codeql.yml | 4 +- package-lock.json | 363 ++++++------------------ package.json | 6 +- scripts/prepare-merge-driver.ts | 29 +- 6 files changed, 158 insertions(+), 287 deletions(-) create mode 100644 .agents/pm/chores/pm-linear-2cy6.toon create mode 100644 .agents/pm/history/pm-linear-2cy6.jsonl diff --git a/.agents/pm/chores/pm-linear-2cy6.toon b/.agents/pm/chores/pm-linear-2cy6.toon new file mode 100644 index 0000000..850fb1f --- /dev/null +++ b/.agents/pm/chores/pm-linear-2cy6.toon @@ -0,0 +1,27 @@ +id: pm-linear-2cy6 +title: Certify pm-linear on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates +description: "Raise the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops 2026.10.4 and pm-changelog 2026.9.25; consolidate Dependabot #129 (pm-cli), #130 (@types/node), #128 (pm-ops), #131 (pm-changelog) and #125 (codeql-action pinned SHA group 2892aa5); keep the canonical pm-ops merge-driver launcher byte-identical; certify with the full release gate plus isolated real-tracker dogfooding of the read-only Linear surfaces via npm and Bun." +type: Chore +status: in_progress +priority: 2 +tags[4]: cli,dependencies,release-readiness,sdk +created_at: "2026-10-04T10:29:00.394Z" +updated_at: "2026-10-04T10:40:38.568Z" +author: pi-glm +acceptance_criteria: "npm run release:check passes with the configured 99/96/100 coverage thresholds unchanged; pm health with the repo-pinned 2026.10.4 binary is clean; packed tarball exercises the read-only/dry-run command surface via npx @unbrained/pm-cli@2026.10.4 and bunx with zero hosted-service mutation" +actual_result: "Pins raised: @unbrained/pm-cli 2026.9.23->2026.10.4, pm-ops->2026.10.4, pm-changelog->2026.9.25; @types/node 26.6.4 in range; codeql-action pinned SHA group 2892aa5 carried from Dependabot #125. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. npm audit and npm audit --omit=dev both 0 vulnerabilities. Full npm run release:check PASS: typecheck, build, docstring, coverage at the configured 99/96/100 thresholds (unchanged), audit, pack dry-run, changelog check, changelog-date and publish-attestation gates. npx pm health exit 0 with zero warnings. Offline read-only dogfood on the packed tarball passed via npx and bunx (linear validate, sync/import --dry-run GraphQL plans, export payload render) with zero Linear network calls. pm-github 2026.10.4 managed extension registered with read-only previews only." +comments[3]{created_at,author,text}: + "2026-10-04T10:29:07.291Z",pi-glm,"Starting at cb914b2 (Release pm-linear v2026.10.03). Plan: pm-cli 2026.9.23->2026.10.4, pm-ops->2026.10.4, pm-changelog->2026.9.25, @types/node ->26.6.4 in range, codeql-action pinned SHA b96794f->2892aa5 from #125; recopy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + read-only dogfood + pm-github preview. Linear itself is a hosted service - dogfood stays strictly on read-only/dry-run surfaces; no hosted-service mutation." + "2026-10-04T10:37:53.910Z",pi-glm,"Real-tracker dogfood PASS (strictly offline; zero Linear network calls, zero hosted-service mutation). Packed pm-linear-2026.10.3.tgz installed into a scratch copy of this repo's real .agents/pm and registered via pm package install with CLI 2026.10.4. npm path (npx -y @unbrained/pm-cli@2026.10.4): linear validate (offline) -> correct config report (apiKeyPresent false, readyForWrites false, networkChecked false); linear sync --team ENG --dry-run -> offline GraphQL plan, 'no Linear network call is made'; linear import --team ENG --dry-run -> same offline plan; linear export -> real create payloads rendered from the actual tracker items (team-less preview notice + full JSON). bun path (bunx @unbrained/pm-cli@2026.10.4): linear validate, linear sync --dry-run, linear export, linear import --dry-run all identical and exit 0. Scratch deleted after evidence capture." + "2026-10-04T10:40:23.808Z",pi-glm,"pm-github installed as managed project extension at latest npm 2026.10.4. Read-only previews against unbraind/pm-linear: github validate -> ok (HTTP 200); github export --dry-run -> plan only, writes nothing; github sync --dry-run -> planned 0, no mutation. No issues created/modified, no scheduled sync enabled." +files[4]{path,scope,note}: + .github/workflows/codeql.yml,project,codeql-action pinned SHA group 2892aa5 from #125 + package-lock.json,project,Resolved dependency graph with consolidated Dependabot bumps + package.json,project,Exact CLI/ops/changelog pins raised + scripts/prepare-merge-driver.ts,project,Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte +tests[4]{command,scope,provenance{author,created_at,source_kind,source_ref}}: + "npm run release:check",project,pi-glm,"2026-10-04T10:40:28.470Z",local_mutation,chore/pm-linear-pm-cli-2026-10-4 + npx pm health,project,pi-glm,"2026-10-04T10:40:29.199Z",local_mutation,chore/pm-linear-pm-cli-2026-10-4 + npx -y @unbrained/pm-cli@2026.10.4 linear export,project,pi-glm,"2026-10-04T10:40:30.052Z",local_mutation,chore/pm-linear-pm-cli-2026-10-4 + bunx @unbrained/pm-cli@2026.10.4 linear sync --team ENG --dry-run,project,pi-glm,"2026-10-04T10:40:31.002Z",local_mutation,chore/pm-linear-pm-cli-2026-10-4 +body: "" diff --git a/.agents/pm/history/pm-linear-2cy6.jsonl b/.agents/pm/history/pm-linear-2cy6.jsonl new file mode 100644 index 0000000..0e2eca7 --- /dev/null +++ b/.agents/pm/history/pm-linear-2cy6.jsonl @@ -0,0 +1,16 @@ +{"hash_algorithm":"sha256","ts":"2026-10-04T10:29:00.394Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-linear-2cy6"},{"op":"add","path":"/metadata/title","value":"Certify pm-linear on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates"},{"op":"add","path":"/metadata/description","value":"Raise the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops 2026.10.4 and pm-changelog 2026.9.25; consolidate Dependabot #129 (pm-cli), #130 (@types/node), #128 (pm-ops), #131 (pm-changelog) and #125 (codeql-action pinned SHA group 2892aa5); keep the canonical pm-ops merge-driver launcher byte-identical; certify with the full release gate plus isolated real-tracker dogfooding of the read-only Linear surfaces via npm and Bun."},{"op":"add","path":"/metadata/type","value":"Chore"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["cli","dependencies","release-readiness","sdk"]},{"op":"add","path":"/metadata/created_at","value":"2026-10-04T10:29:00.394Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-04T10:29:00.394Z"},{"op":"add","path":"/metadata/author","value":"pi-glm"},{"op":"add","path":"/metadata/acceptance_criteria","value":"npm run release:check passes with the configured 99/96/100 coverage thresholds unchanged; pm health with the repo-pinned 2026.10.4 binary is clean; packed tarball exercises the read-only/dry-run command surface via npx @unbrained/pm-cli@2026.10.4 and bunx with zero hosted-service mutation"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"6a6ce103d2dfdf8babd75a16b18eb00a3a8ab98ce383c1ab4b9e23bcdacdcff1","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"49eaa01625f7a603a2f087f625770eab6a55ab1150255cfb1be85982d8e27c2e"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:29:01.626Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:29:01.626Z"},{"op":"add","path":"/metadata/assignee","value":"pi-glm"},{"op":"add","path":"/metadata/claim_principal","value":"pi-glm"}],"before_hash":"6a6ce103d2dfdf8babd75a16b18eb00a3a8ab98ce383c1ab4b9e23bcdacdcff1","after_hash":"be5c2f7c8d3339f9432ca3b0664f614e973912359ab3bf27e66809e01ffa8527","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"07e172203ad5ad4f878784caedd5189769c1f11a7ea7c280c0395a7105420a0f"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:29:03.044Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:29:03.044Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"be5c2f7c8d3339f9432ca3b0664f614e973912359ab3bf27e66809e01ffa8527","after_hash":"b973559ab3da5d0579b0d9fa00ba58072d2f483846d4ff8e754ffdce57710500","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"b59e8b43c4de9d2c20833c3c6e1a9b4e70429dbeaeca6be6daf32c545de1da6d"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:29:07.291Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:29:07.291Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-10-04T10:29:07.291Z","author":"pi-glm","text":"Starting at cb914b2 (Release pm-linear v2026.10.03). Plan: pm-cli 2026.9.23->2026.10.4, pm-ops->2026.10.4, pm-changelog->2026.9.25, @types/node ->26.6.4 in range, codeql-action pinned SHA b96794f->2892aa5 from #125; recopy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + read-only dogfood + pm-github preview. Linear itself is a hosted service - dogfood stays strictly on read-only/dry-run surfaces; no hosted-service mutation."}]}],"before_hash":"b973559ab3da5d0579b0d9fa00ba58072d2f483846d4ff8e754ffdce57710500","after_hash":"304dca9599dcdaa18b35bfb7ee6e035cf5e4208b1550a64aaf35f3fccc93302d","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"7902d1a8f16121e995fa0fd8fc326bdf82513b5caef97ab86d13432b9558ffdd"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:37:53.910Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-10-04T10:37:53.910Z","author":"pi-glm","text":"Real-tracker dogfood PASS (strictly offline; zero Linear network calls, zero hosted-service mutation). Packed pm-linear-2026.10.3.tgz installed into a scratch copy of this repo's real .agents/pm and registered via pm package install with CLI 2026.10.4. npm path (npx -y @unbrained/pm-cli@2026.10.4): linear validate (offline) -> correct config report (apiKeyPresent false, readyForWrites false, networkChecked false); linear sync --team ENG --dry-run -> offline GraphQL plan, 'no Linear network call is made'; linear import --team ENG --dry-run -> same offline plan; linear export -> real create payloads rendered from the actual tracker items (team-less preview notice + full JSON). bun path (bunx @unbrained/pm-cli@2026.10.4): linear validate, linear sync --dry-run, linear export, linear import --dry-run all identical and exit 0. Scratch deleted after evidence capture."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:37:53.910Z"}],"before_hash":"304dca9599dcdaa18b35bfb7ee6e035cf5e4208b1550a64aaf35f3fccc93302d","after_hash":"94b427d4409489aa7d6efc75e2145598ade10c8a860eb91e258c9f7d7a9d6afd","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"dfb5f0a51ceb3fdb4dec1aefde4ae946233e96820b23fb07ac968efeb3e612a5"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:23.809Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/2","value":{"created_at":"2026-10-04T10:40:23.808Z","author":"pi-glm","text":"pm-github installed as managed project extension at latest npm 2026.10.4. Read-only previews against unbraind/pm-linear: github validate -> ok (HTTP 200); github export --dry-run -> plan only, writes nothing; github sync --dry-run -> planned 0, no mutation. No issues created/modified, no scheduled sync enabled."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:23.809Z"}],"before_hash":"94b427d4409489aa7d6efc75e2145598ade10c8a860eb91e258c9f7d7a9d6afd","after_hash":"53dd227077225f850b9dc0c08081fad5fd8e29a6f16f8f4f637670939238c48b","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"10b413f3904a42cd11edf1d2f1fcd6d86c6570287fc39d01fe75ac5b46712f04"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:24.590Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:24.590Z"},{"op":"add","path":"/metadata/files","value":[{"path":"package.json","scope":"project","note":"Exact CLI/ops/changelog pins raised"}]}],"before_hash":"53dd227077225f850b9dc0c08081fad5fd8e29a6f16f8f4f637670939238c48b","after_hash":"284bcaf5de9269c4aa7b272c0e0e499b6b3d550e13287736dbe747148fd8a460","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"475d40a23b5c1400ea172cba453fe54137bd0966e38cc0076e52e4d7d9801b6c"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:25.504Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/0/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/0/path","value":"package-lock.json"},{"op":"add","path":"/metadata/files/1","value":{"path":"package.json","scope":"project","note":"Exact CLI/ops/changelog pins raised"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:25.504Z"}],"before_hash":"284bcaf5de9269c4aa7b272c0e0e499b6b3d550e13287736dbe747148fd8a460","after_hash":"0cae5389514bc1abe32fca48340a2135999bb527c0bc8c75f971136e3206ef63","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"c09ed3359032df0eb79541962aaf957f7f2a33853ebff5576f8883b358807478"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:26.424Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/2","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:26.424Z"}],"before_hash":"0cae5389514bc1abe32fca48340a2135999bb527c0bc8c75f971136e3206ef63","after_hash":"ed7846c0f9f651a0b360b11e84f06aad36c045583d63e19609429e32816562c8","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"96ce8b0ba64139261ee5a697ee57cd2360e08b0915ec0efe771334e0250ad9e9"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:27.490Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/2/note","value":"Exact CLI/ops/changelog pins raised"},{"op":"replace","path":"/metadata/files/2/path","value":"package.json"},{"op":"replace","path":"/metadata/files/1/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/1/path","value":"package-lock.json"},{"op":"replace","path":"/metadata/files/0/note","value":"codeql-action pinned SHA group 2892aa5 from #125"},{"op":"replace","path":"/metadata/files/0/path","value":".github/workflows/codeql.yml"},{"op":"add","path":"/metadata/files/3","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:27.490Z"}],"before_hash":"ed7846c0f9f651a0b360b11e84f06aad36c045583d63e19609429e32816562c8","after_hash":"035b08677dfc6bd51617dc390beeb7a26bbd5e8193c5122ad5a9d76594e8c986","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"051508a55ee056b546dfa0084992eac40aaec432aaa57de1adcd61c7af02b482"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:28.500Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:28.500Z"},{"op":"add","path":"/metadata/tests","value":[{"command":"npm run release:check","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T10:40:28.470Z","source_kind":"local_mutation","source_ref":"chore/pm-linear-pm-cli-2026-10-4"}}]}],"before_hash":"035b08677dfc6bd51617dc390beeb7a26bbd5e8193c5122ad5a9d76594e8c986","after_hash":"847773ffd6cf442012196845e8dd4e88dad7f900e79c5daf1db350959a77e9eb","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"2af769f52750aadaf0a4563048fe75a40be021e7251ba7a74a8e52df211b2653"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:29.226Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/1","value":{"command":"npx pm health","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T10:40:29.199Z","source_kind":"local_mutation","source_ref":"chore/pm-linear-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:29.226Z"}],"before_hash":"847773ffd6cf442012196845e8dd4e88dad7f900e79c5daf1db350959a77e9eb","after_hash":"d1963938691066c43a3d07aaab2f0cc9aafa3dc8e108abd060d8d1fbefc8344c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"c2bb90fc49493166c485920031edd2f365435b8e1710d67e26899a53cabfa4a3"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:30.085Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/2","value":{"command":"npx -y @unbrained/pm-cli@2026.10.4 linear export","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T10:40:30.052Z","source_kind":"local_mutation","source_ref":"chore/pm-linear-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:30.085Z"}],"before_hash":"d1963938691066c43a3d07aaab2f0cc9aafa3dc8e108abd060d8d1fbefc8344c","after_hash":"e1fb6e1fffe0b7d8006706dbfaa9a0c4d4948c2bb2ecaba8b48e0dd68e91a2e7","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"c3f6601749a8ae129d3542ceafabb46d3fb030e1f6e34ab965b311a8c4673ed4"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:31.040Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/3","value":{"command":"bunx @unbrained/pm-cli@2026.10.4 linear sync --team ENG --dry-run","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T10:40:31.002Z","source_kind":"local_mutation","source_ref":"chore/pm-linear-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:31.040Z"}],"before_hash":"e1fb6e1fffe0b7d8006706dbfaa9a0c4d4948c2bb2ecaba8b48e0dd68e91a2e7","after_hash":"272ab1acc35a1e2cd2108afa45a5dcad3f7bd3f57d4c7b57d4bd92a1d74474aa","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"ec06c5940fa0f52214dfdb8bfb3e0b54cb3268410d72e9292902be0b8c604e86"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:37.754Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:37.754Z"},{"op":"add","path":"/metadata/actual_result","value":"Pins raised: @unbrained/pm-cli 2026.9.23->2026.10.4, pm-ops->2026.10.4, pm-changelog->2026.9.25; @types/node 26.6.4 in range; codeql-action pinned SHA group 2892aa5 carried from Dependabot #125. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. npm audit and npm audit --omit=dev both 0 vulnerabilities. Full npm run release:check PASS: typecheck, build, docstring, coverage at the configured 99/96/100 thresholds (unchanged), audit, pack dry-run, changelog check, changelog-date and publish-attestation gates. npx pm health exit 0 with zero warnings. Offline read-only dogfood on the packed tarball passed via npx and bunx (linear validate, sync/import --dry-run GraphQL plans, export payload render) with zero Linear network calls. pm-github 2026.10.4 managed extension registered with read-only previews only."}],"before_hash":"272ab1acc35a1e2cd2108afa45a5dcad3f7bd3f57d4c7b57d4bd92a1d74474aa","after_hash":"6f7f1a92164df0137f45706189edfa3f8db4dfaced7942a670a1d7d7fe39acf9","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"d85200bf6aeb3ba95634f1a7fa9066527bc60c3c0262ed772fdda31b302d211e"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:40:38.568Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:38.568Z"}],"before_hash":"6f7f1a92164df0137f45706189edfa3f8db4dfaced7942a670a1d7d7fe39acf9","after_hash":"5dd1f22ec509d28f99baf8ac09135cd08210703ce69e0eb2e15eb7206417d610","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"402d02d254f978d50f48f30080d96df639e0eefbbbb5d432dc3eaffe70b2e0a7"} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 69756de..b23ae91 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,13 +28,13 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: languages: javascript-typescript # This package is analyzed from source without a compiled build. build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: category: "/language:javascript-typescript" diff --git a/package-lock.json b/package-lock.json index 838506a..02f511c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,9 +10,9 @@ "license": "MIT", "devDependencies": { "@types/node": "^26.1.1", - "@unbrained/pm-cli": "2026.9.23", - "pm-changelog": "2026.9.23", - "pm-ops": "2026.9.23", + "@unbrained/pm-cli": "2026.10.4", + "pm-changelog": "2026.9.25", + "pm-ops": "2026.10.4", "typescript": "^7.0.2" }, "engines": { @@ -35,44 +35,6 @@ "node": ">=18.0.0" } }, - "node_modules/@nodelib/fs.scandir": { - "version": "2.1.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz", - "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "2.0.5", - "run-parallel": "^1.1.9" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.stat": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz", - "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.walk": { - "version": "1.2.8", - "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz", - "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.scandir": "2.1.5", - "fastq": "^1.6.0" - }, - "engines": { - "node": ">= 8" - } - }, "node_modules/@opentelemetry/api": { "version": "1.9.1", "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz", @@ -205,9 +167,9 @@ } }, "node_modules/@sentry/core": { - "version": "10.75.0", - "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.0.tgz", - "integrity": "sha512-5wDQpQqjJ6RHdPR+z6Q+47XlwoxRKBv0yyB0LKHqL/1azPOQbR+nllyLmmQDcoJpaksuLSmLA1q6hFX7gjDT2w==", + "version": "10.75.1", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.1.tgz", + "integrity": "sha512-+/+UanewqPK+oJvDQIHWKLUqnsa0iymEThOPCaFBA8ulbQh9k8lsz8V+NtJwP4G3ncclfzp15tzqVwn6iugV4Q==", "dev": true, "license": "MIT", "dependencies": { @@ -218,9 +180,9 @@ } }, "node_modules/@sentry/node": { - "version": "10.75.0", - "resolved": "https://registry.npmjs.org/@sentry/node/-/node-10.75.0.tgz", - "integrity": "sha512-XdYW+SEiscQnuugh1hMldfnHurmleKSTSDqgfro6Y1yd7s0r2csnZ5/SEYxIeL4lSl1QXg1lIA1pBmAXjcdnKA==", + "version": "10.75.1", + "resolved": "https://registry.npmjs.org/@sentry/node/-/node-10.75.1.tgz", + "integrity": "sha512-qiWGwh0KiBoq4vEl0FbxFKw0xnOKxuKCaEVdtwMZLAGw1ef77NOCdie7e/Fmcsk9c++Ck4D8NmIjQm6BidRVSQ==", "dev": true, "license": "MIT", "dependencies": { @@ -228,10 +190,10 @@ "@opentelemetry/instrumentation": "^0.220.0", "@opentelemetry/sdk-trace-base": "^2.9.0", "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.75.0", - "@sentry/node-core": "10.75.0", - "@sentry/opentelemetry": "10.75.0", - "@sentry/server-utils": "10.75.0", + "@sentry/core": "10.75.1", + "@sentry/node-core": "10.75.1", + "@sentry/opentelemetry": "10.75.1", + "@sentry/server-utils": "10.75.1", "import-in-the-middle": "^3.0.0" }, "engines": { @@ -239,15 +201,15 @@ } }, "node_modules/@sentry/node-core": { - "version": "10.75.0", - "resolved": "https://registry.npmjs.org/@sentry/node-core/-/node-core-10.75.0.tgz", - "integrity": "sha512-+E3KSX1oMqhpWQ23hj6NblIVUzLy3T2oceU7DfMX1s1ar+npaQZxR5K0/cMGcQgS1LLm8Jqwqo/lrZlKTCDm5A==", + "version": "10.75.1", + "resolved": "https://registry.npmjs.org/@sentry/node-core/-/node-core-10.75.1.tgz", + "integrity": "sha512-HR0Iy7oNFOP26cwaRi33ZZnvlUSMFzXbZoRgYtBAkqUHDNQA6LWG1N1OoIdKNRJzDkGu/zefbM50Amqgyy1u1Q==", "dev": true, "license": "MIT", "dependencies": { "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.75.0", - "@sentry/opentelemetry": "10.75.0", + "@sentry/core": "10.75.1", + "@sentry/opentelemetry": "10.75.1", "import-in-the-middle": "^3.0.0" }, "engines": { @@ -279,14 +241,14 @@ } }, "node_modules/@sentry/opentelemetry": { - "version": "10.75.0", - "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-10.75.0.tgz", - "integrity": "sha512-reJoMtuHMuaiztoDVoaeitc22eHlTAvz2qpFhibWyzukJlF8oXB+o8EvDN9mmDDMedU89c//cXRcnPBlJvUxcw==", + "version": "10.75.1", + "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-10.75.1.tgz", + "integrity": "sha512-leRKyFkEgV47Qo2wKCMEIYxPgnp67C+wYFg0GPreX5owRde0l18F5BEmsYUU57WAjBKBDo2idrrEEQaU15uH8g==", "dev": true, "license": "MIT", "dependencies": { "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.75.0" + "@sentry/core": "10.75.1" }, "engines": { "node": ">=18" @@ -298,14 +260,14 @@ } }, "node_modules/@sentry/server-utils": { - "version": "10.75.0", - "resolved": "https://registry.npmjs.org/@sentry/server-utils/-/server-utils-10.75.0.tgz", - "integrity": "sha512-7fIa9vFGNzB13hmxl8Sip3xImSkqpc4wETzuQ7CLzVOwPvwI6y/gVEm0pxRhtJSq8SzfOp26eJWl80u8v78Osg==", + "version": "10.75.1", + "resolved": "https://registry.npmjs.org/@sentry/server-utils/-/server-utils-10.75.1.tgz", + "integrity": "sha512-HuA/bCtthA5x/AjYD5WUbG6CBcYJb0WAWKNgrgNkUWtll6eMqG3+7LO4PBcGRbZtlg1OFgClJm4iQFgRN7+ZZg==", "dev": true, "license": "MIT", "dependencies": { "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.75.0" + "@sentry/core": "10.75.1" }, "engines": { "node": ">=18" @@ -319,9 +281,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz", - "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==", + "version": "26.6.4", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.4.tgz", + "integrity": "sha512-ldVPDCzj7fsaGZrLB0NuHuTvJcsNasysBAqMolr/cgxrLd1xbqxIr3XJiPnHHJUCxj5sNF1vnRj9aWnrVh5Jcg==", "dev": true, "license": "MIT", "dependencies": { @@ -669,20 +631,20 @@ } }, "node_modules/@unbrained/pm-cli": { - "version": "2026.9.23", - "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.9.23.tgz", - "integrity": "sha512-tL1u+NDa6UkJyJaJR3j7noqi6byFlQdgWSZsFDG/k6k31LTBCQJNfX42EhgBE8kR100O61DleJSaMCtPq+LT9g==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.10.4.tgz", + "integrity": "sha512-NZLdiUSUKIRcFiMj9lG0L5UubA9G33fq5WzB1JzJjTTlYxYCVjrFFOCV2rtxYTaYTCzX9o/6V/A4fDx6N3mm/w==", "dev": true, "license": "MIT", "dependencies": { - "@sentry/node": "10.75.0", + "@sentry/node": "10.75.1", "@toon-format/toon": "^4.1.1", "@types/node": ">=22", "commander": "^15.0.0", - "fast-glob": "^3.3.3", "fast-json-patch": "^3.1.1", "npm-package-arg": "^13.0.2", "tar": "7.5.22", + "tinyglobby": "^0.2.17", "yaml": "^2.9.1" }, "bin": { @@ -695,19 +657,6 @@ "node": ">=22.18.0" } }, - "node_modules/braces": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", - "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==", - "dev": true, - "license": "MIT", - "dependencies": { - "fill-range": "^7.1.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/chownr": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz", @@ -760,23 +709,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fast-glob": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz", - "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "^2.0.2", - "@nodelib/fs.walk": "^1.2.3", - "glob-parent": "^5.1.2", - "merge2": "^1.3.0", - "micromatch": "^4.0.8" - }, - "engines": { - "node": ">=8.6.0" - } - }, "node_modules/fast-json-patch": { "version": "3.1.1", "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz", @@ -784,42 +716,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fastq": { - "version": "1.20.1", - "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz", - "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==", - "dev": true, - "license": "ISC", - "dependencies": { - "reusify": "^1.0.4" - } - }, - "node_modules/fill-range": { - "version": "7.1.1", - "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz", - "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==", - "dev": true, - "license": "MIT", - "dependencies": { - "to-regex-range": "^5.0.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/glob-parent": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", - "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", - "dev": true, - "license": "ISC", - "dependencies": { - "is-glob": "^4.0.1" - }, - "engines": { - "node": ">= 6" - } - }, "node_modules/hosted-git-info": { "version": "9.0.3", "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.3.tgz", @@ -834,9 +730,9 @@ } }, "node_modules/import-in-the-middle": { - "version": "3.5.1", - "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.5.1.tgz", - "integrity": "sha512-mPKuL8bPQzecui2KK6Gb+M8JvJoHnhS1FeYGa22QopBmlevF5F0FE6ued/B5EgHDeIoMTONIpDWWFKUPOG0DBQ==", + "version": "3.5.2", + "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.5.2.tgz", + "integrity": "sha512-WseIA/4o56+GYO3RmlOPvejYi771OFeJEeK/ejROsr9bdjW+E5NXTOD1Di8TL40Qgg3JJX9aa97Hf8iiSVIKZw==", "dev": true, "license": "Apache-2.0", "dependencies": { @@ -848,39 +744,6 @@ "node": ">=18" } }, - "node_modules/is-extglob": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz", - "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-glob": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz", - "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==", - "dev": true, - "license": "MIT", - "dependencies": { - "is-extglob": "^2.1.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-number": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz", - "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.12.0" - } - }, "node_modules/lru-cache": { "version": "11.5.2", "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz", @@ -891,30 +754,6 @@ "node": "20 || >=22" } }, - "node_modules/merge2": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz", - "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/micromatch": { - "version": "4.0.8", - "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz", - "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==", - "dev": true, - "license": "MIT", - "dependencies": { - "braces": "^3.0.3", - "picomatch": "^2.3.1" - }, - "engines": { - "node": ">=8.6" - } - }, "node_modules/minipass": { "version": "7.1.3", "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz", @@ -968,23 +807,10 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/picomatch": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", - "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8.6" - }, - "funding": { - "url": "https://github.com/sponsors/jonschlinkert" - } - }, "node_modules/pm-changelog": { - "version": "2026.9.23", - "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.23.tgz", - "integrity": "sha512-hrHFbRgz/LyiCBN9ic0I1C//SRL/zjU5fxcyCeCAnM2qTrz14A7f9ayMXeiu/ChDkVFMxfz8Ps2j3TuUG6K1QA==", + "version": "2026.9.25", + "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.25.tgz", + "integrity": "sha512-j2l97jlJIfuMiB7KDi7oIr9MWxdQvqnDx/JwE3pxC31fDw3MywnSmaTcE9/gV6sVlZbQkOSxnxooHzDwRo+1+g==", "dev": true, "license": "MIT", "bin": { @@ -998,9 +824,9 @@ } }, "node_modules/pm-ops": { - "version": "2026.9.23", - "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.9.23.tgz", - "integrity": "sha512-FglZHOXjsuG8WWf9Ca90/IX1u4ZCxVTvHpwMaiA0TAWBx/lLalM2Ic12gtWZvm3OAJsMMuXvfRBHWxwYLzESsg==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.10.4.tgz", + "integrity": "sha512-/6ehQBNwKquIol3EUW1r4pZSXKaohHc1gXJUSk7cqQwkVJOSlP8cCcHzNFH76/6O9hG04Eb5KAH90vFkhTxfMQ==", "dev": true, "license": "MIT", "dependencies": { @@ -1046,27 +872,6 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/queue-microtask": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz", - "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT" - }, "node_modules/require-in-the-middle": { "version": "8.0.1", "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz", @@ -1081,41 +886,6 @@ "node": ">=9.3.0 || >=8.10.0 <9.0.0" } }, - "node_modules/reusify": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz", - "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==", - "dev": true, - "license": "MIT", - "engines": { - "iojs": ">=1.0.0", - "node": ">=0.10.0" - } - }, - "node_modules/run-parallel": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz", - "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT", - "dependencies": { - "queue-microtask": "^1.2.2" - } - }, "node_modules/semver": { "version": "7.8.5", "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", @@ -1146,17 +916,52 @@ "node": ">=18" } }, - "node_modules/to-regex-range": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", - "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==", + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", "dev": true, "license": "MIT", "dependencies": { - "is-number": "^7.0.0" + "fdir": "^6.5.0", + "picomatch": "^4.0.4" }, "engines": { - "node": ">=8.0" + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" + } + }, + "node_modules/tinyglobby/node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, + "node_modules/tinyglobby/node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" } }, "node_modules/typescript": { diff --git a/package.json b/package.json index 7915451..b629c2f 100644 --- a/package.json +++ b/package.json @@ -60,9 +60,9 @@ }, "devDependencies": { "@types/node": "^26.1.1", - "@unbrained/pm-cli": "2026.9.23", - "pm-changelog": "2026.9.23", - "pm-ops": "2026.9.23", + "@unbrained/pm-cli": "2026.10.4", + "pm-changelog": "2026.9.25", + "pm-ops": "2026.10.4", "typescript": "^7.0.2" }, "engines": { diff --git a/scripts/prepare-merge-driver.ts b/scripts/prepare-merge-driver.ts index 66e512e..f6f49f0 100644 --- a/scripts/prepare-merge-driver.ts +++ b/scripts/prepare-merge-driver.ts @@ -7,13 +7,15 @@ * therefore imports nothing from pm-ops: it resolves the installer entry from * the package root and runs it in a child process. Only a missing pm-ops package skips, with one * notice; any other resolution failure (for example a pm-ops too old to export - * the entry) and any installer failure fail the install. + * the entry, or a `pm-ops` directory whose package.json is gone) and any + * installer failure fail the install. * * Canonical copy: `pm-ops/templates/prepare-merge-driver.ts`. Copy it * unchanged to `scripts/prepare-merge-driver.ts`. */ import { spawnSync } from "node:child_process"; +import { lstatSync } from "node:fs"; import { createRequire } from "node:module"; import { join } from "node:path"; @@ -26,12 +28,33 @@ try { // Only an absent pm-ops package may skip. Probing its package.json tells that // apart from an installed pm-ops that cannot serve the entry (exports without // it, no exports map, a missing file): those resolve or fail differently, and - // the original error is rethrown. + // the original error is rethrown. A probe that finds no package.json is not + // yet proof of absence: a broken install can leave `node_modules/pm-ops` (a + // directory or a dangling link) with no package.json in any ancestor Node + // searches. Such an entry also counts as present. Keep Node's global paths + // too: the installer resolution above can use them, so an absent local + // package alone cannot prove absence. An unreadable or malformed lookup path + // leaves presence uncertain and must fail closed with the original error. + // Node returns null paths only for built-in modules; pm-ops/package.json is + // a package specifier. let packagePresent = true; try { resolver.resolve("pm-ops/package.json"); } catch (probe) { - packagePresent = !(probe instanceof Error && "code" in probe && probe.code === "MODULE_NOT_FOUND"); + packagePresent = + !(probe instanceof Error && "code" in probe && probe.code === "MODULE_NOT_FOUND") || + resolver.resolve.paths("pm-ops/package.json")!.some( + (directory) => { + try { + return lstatSync(join(directory, "pm-ops"), { throwIfNoEntry: false }) !== undefined; + } catch { + // throwIfNoEntry:false only suppresses ENOENT, not EACCES, EPERM, + // ENOTDIR, or ELOOP. Do not replace the installer diagnostic or + // treat an inconclusive presence check as an omit-dev install. + return true; + } + }, + ); } if (packagePresent) throw error; } From 1c0efe259cd7c1146421981ae4f969db2987a530 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 13:44:15 +0200 Subject: [PATCH 2/2] test: cover broken installs and finish exact offline certification --- .agents/pm/chores/pm-linear-2cy6.toon | 70 ++++++++++++++++++++----- .agents/pm/history/pm-linear-2cy6.jsonl | 7 +++ .agents/pm/history/pm-linear-jloc.jsonl | 1 + .agents/pm/issues/pm-linear-jloc.toon | 12 +++++ package-lock.json | 12 ++--- package.json | 6 +-- test/prepare-merge-driver.test.ts | 38 +++++++++++++- 7 files changed, 123 insertions(+), 23 deletions(-) create mode 100644 .agents/pm/history/pm-linear-jloc.jsonl create mode 100644 .agents/pm/issues/pm-linear-jloc.toon diff --git a/.agents/pm/chores/pm-linear-2cy6.toon b/.agents/pm/chores/pm-linear-2cy6.toon index 850fb1f..4ad06a8 100644 --- a/.agents/pm/chores/pm-linear-2cy6.toon +++ b/.agents/pm/chores/pm-linear-2cy6.toon @@ -6,22 +6,66 @@ status: in_progress priority: 2 tags[4]: cli,dependencies,release-readiness,sdk created_at: "2026-10-04T10:29:00.394Z" -updated_at: "2026-10-04T10:40:38.568Z" +updated_at: "2026-10-04T11:44:07.534Z" author: pi-glm acceptance_criteria: "npm run release:check passes with the configured 99/96/100 coverage thresholds unchanged; pm health with the repo-pinned 2026.10.4 binary is clean; packed tarball exercises the read-only/dry-run command surface via npx @unbrained/pm-cli@2026.10.4 and bunx with zero hosted-service mutation" -actual_result: "Pins raised: @unbrained/pm-cli 2026.9.23->2026.10.4, pm-ops->2026.10.4, pm-changelog->2026.9.25; @types/node 26.6.4 in range; codeql-action pinned SHA group 2892aa5 carried from Dependabot #125. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. npm audit and npm audit --omit=dev both 0 vulnerabilities. Full npm run release:check PASS: typecheck, build, docstring, coverage at the configured 99/96/100 thresholds (unchanged), audit, pack dry-run, changelog check, changelog-date and publish-attestation gates. npx pm health exit 0 with zero warnings. Offline read-only dogfood on the packed tarball passed via npx and bunx (linear validate, sync/import --dry-run GraphQL plans, export payload render) with zero Linear network calls. pm-github 2026.10.4 managed extension registered with read-only previews only." -comments[3]{created_at,author,text}: +actual_result: "Exact development pins: CLI/ops/changelog 2026.10.4, Node types 26.6.4, TypeScript 7.0.2. Canonical launcher unchanged; requested incomplete/dangling and lookup error fixtures, portable junctions and isolated NODE_PATH all pass 9/9, no new skips. Clean npm ci and serialized release:check PASS: 222/222 tests, zero skips, unchanged 99/96/100 coverage thresholds. Both audits clean; no open Dependabot alerts. Packed real tracker npx/bunx offline validate/sync preview/import preview/export preview all pass; no Linear API calls or writes; scratch removed. Managed pm-github read-only preview planned 0. Health exits 0 with 2 inherited advisory categories (stale item and historical role normalization receipts), no gate-failing findings; follow-up assesses provenance reporting without rewriting history. Review receipts pending; leave item and PR open." +comments[5]{created_at,author,text}: "2026-10-04T10:29:07.291Z",pi-glm,"Starting at cb914b2 (Release pm-linear v2026.10.03). Plan: pm-cli 2026.9.23->2026.10.4, pm-ops->2026.10.4, pm-changelog->2026.9.25, @types/node ->26.6.4 in range, codeql-action pinned SHA b96794f->2892aa5 from #125; recopy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + read-only dogfood + pm-github preview. Linear itself is a hosted service - dogfood stays strictly on read-only/dry-run surfaces; no hosted-service mutation." "2026-10-04T10:37:53.910Z",pi-glm,"Real-tracker dogfood PASS (strictly offline; zero Linear network calls, zero hosted-service mutation). Packed pm-linear-2026.10.3.tgz installed into a scratch copy of this repo's real .agents/pm and registered via pm package install with CLI 2026.10.4. npm path (npx -y @unbrained/pm-cli@2026.10.4): linear validate (offline) -> correct config report (apiKeyPresent false, readyForWrites false, networkChecked false); linear sync --team ENG --dry-run -> offline GraphQL plan, 'no Linear network call is made'; linear import --team ENG --dry-run -> same offline plan; linear export -> real create payloads rendered from the actual tracker items (team-less preview notice + full JSON). bun path (bunx @unbrained/pm-cli@2026.10.4): linear validate, linear sync --dry-run, linear export, linear import --dry-run all identical and exit 0. Scratch deleted after evidence capture." "2026-10-04T10:40:23.808Z",pi-glm,"pm-github installed as managed project extension at latest npm 2026.10.4. Read-only previews against unbraind/pm-linear: github validate -> ok (HTTP 200); github export --dry-run -> plan only, writes nothing; github sync --dry-run -> planned 0, no mutation. No issues created/modified, no scheduled sync enabled." -files[4]{path,scope,note}: - .github/workflows/codeql.yml,project,codeql-action pinned SHA group 2892aa5 from #125 - package-lock.json,project,Resolved dependency graph with consolidated Dependabot bumps - package.json,project,Exact CLI/ops/changelog pins raised - scripts/prepare-merge-driver.ts,project,Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte -tests[4]{command,scope,provenance{author,created_at,source_kind,source_ref}}: - "npm run release:check",project,pi-glm,"2026-10-04T10:40:28.470Z",local_mutation,chore/pm-linear-pm-cli-2026-10-4 - npx pm health,project,pi-glm,"2026-10-04T10:40:29.199Z",local_mutation,chore/pm-linear-pm-cli-2026-10-4 - npx -y @unbrained/pm-cli@2026.10.4 linear export,project,pi-glm,"2026-10-04T10:40:30.052Z",local_mutation,chore/pm-linear-pm-cli-2026-10-4 - bunx @unbrained/pm-cli@2026.10.4 linear sync --team ENG --dry-run,project,pi-glm,"2026-10-04T10:40:31.002Z",local_mutation,chore/pm-linear-pm-cli-2026-10-4 + "2026-10-04T11:32:02.914Z",codex-sol,"Resumed PR #132 after reading current comments/reviews. Address Greptile missing incomplete-directory and dangling-link fixtures, plus the verified lookup-loop, Windows junction and inherited NODE_PATH isolation findings from this same certification. Keep the canonical launcher unchanged and run all new fixtures without new skips. Finish exact development pins and latest pm-changelog 2026.10.4; clean install, full locked gate and packed real-tracker npm/bun offline checks. No Linear API calls or hosted writes." + "2026-10-04T11:44:05.826Z",codex-sol,"Resumption validation PASS: all development pins exact, CLI/ops/changelog 2026.10.4; clean npm ci; flock-serialized npm run release:check passed with unchanged 99/96/100 thresholds, zero skipped tests, both audit scopes 0. Launcher fixtures and linked hostile NODE_PATH run pass 9/9, no new skips; canonical launcher unchanged. Packed real tracker offline npm/bun dogfood: npx -y @unbrained/pm-cli@2026.10.4 linear validate; linear sync --team ENG --dry-run; linear import --team ENG --dry-run; linear export --dry-run; equivalent bunx commands all exit 0, readyForWrites false and networkChecked false, real create payloads rendered, no Linear API calls/writes. Scratch removed. Managed pm-github sync --dry-run --repo unbraind/pm-linear plans 0. Pinned npx pm health exits 0 with stale_in_progress_items:1 and historical provenance_value_domain_invalid:claude-code:role:single_digit:26 advisories, no gate-failing findings. This corrects the earlier zero-warning receipt; matching August normalization audit records already exist on origin/main. A separate follow-up assesses that advisory without rewriting audited history." +files[5]: + - path: .github/workflows/codeql.yml + scope: project + note: codeql-action pinned SHA group 2892aa5 from #125 + - path: package-lock.json + scope: project + note: Resolved dependency graph with consolidated Dependabot bumps + - path: package.json + scope: project + note: Exact CLI/ops/changelog pins raised + - path: scripts/prepare-merge-driver.ts + scope: project + note: Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte + - path: test/prepare-merge-driver.test.ts + scope: project +tests[5]: + - command: "npm run release:check" + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T10:40:28.470Z" + source_kind: local_mutation + source_ref: chore/pm-linear-pm-cli-2026-10-4 + - command: npx pm health + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T10:40:29.199Z" + source_kind: local_mutation + source_ref: chore/pm-linear-pm-cli-2026-10-4 + - command: npx -y @unbrained/pm-cli@2026.10.4 linear export + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T10:40:30.052Z" + source_kind: local_mutation + source_ref: chore/pm-linear-pm-cli-2026-10-4 + - command: bunx @unbrained/pm-cli@2026.10.4 linear sync --team ENG --dry-run + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T10:40:31.002Z" + source_kind: local_mutation + source_ref: chore/pm-linear-pm-cli-2026-10-4 + - command: "env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts" + scope: project + pm_context_mode: tracker + provenance: + author: codex-sol + created_at: "2026-10-04T11:32:06.890Z" + source_kind: local_mutation + source_ref: chore/pm-linear-pm-cli-2026-10-4 body: "" diff --git a/.agents/pm/history/pm-linear-2cy6.jsonl b/.agents/pm/history/pm-linear-2cy6.jsonl index 0e2eca7..51fab32 100644 --- a/.agents/pm/history/pm-linear-2cy6.jsonl +++ b/.agents/pm/history/pm-linear-2cy6.jsonl @@ -14,3 +14,10 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T10:40:31.040Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/3","value":{"command":"bunx @unbrained/pm-cli@2026.10.4 linear sync --team ENG --dry-run","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T10:40:31.002Z","source_kind":"local_mutation","source_ref":"chore/pm-linear-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:31.040Z"}],"before_hash":"e1fb6e1fffe0b7d8006706dbfaa9a0c4d4948c2bb2ecaba8b48e0dd68e91a2e7","after_hash":"272ab1acc35a1e2cd2108afa45a5dcad3f7bd3f57d4c7b57d4bd92a1d74474aa","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"ec06c5940fa0f52214dfdb8bfb3e0b54cb3268410d72e9292902be0b8c604e86"} {"hash_algorithm":"sha256","ts":"2026-10-04T10:40:37.754Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:37.754Z"},{"op":"add","path":"/metadata/actual_result","value":"Pins raised: @unbrained/pm-cli 2026.9.23->2026.10.4, pm-ops->2026.10.4, pm-changelog->2026.9.25; @types/node 26.6.4 in range; codeql-action pinned SHA group 2892aa5 carried from Dependabot #125. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. npm audit and npm audit --omit=dev both 0 vulnerabilities. Full npm run release:check PASS: typecheck, build, docstring, coverage at the configured 99/96/100 thresholds (unchanged), audit, pack dry-run, changelog check, changelog-date and publish-attestation gates. npx pm health exit 0 with zero warnings. Offline read-only dogfood on the packed tarball passed via npx and bunx (linear validate, sync/import --dry-run GraphQL plans, export payload render) with zero Linear network calls. pm-github 2026.10.4 managed extension registered with read-only previews only."}],"before_hash":"272ab1acc35a1e2cd2108afa45a5dcad3f7bd3f57d4c7b57d4bd92a1d74474aa","after_hash":"6f7f1a92164df0137f45706189edfa3f8db4dfaced7942a670a1d7d7fe39acf9","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"d85200bf6aeb3ba95634f1a7fa9066527bc60c3c0262ed772fdda31b302d211e"} {"hash_algorithm":"sha256","ts":"2026-10-04T10:40:38.568Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:40:38.568Z"}],"before_hash":"6f7f1a92164df0137f45706189edfa3f8db4dfaced7942a670a1d7d7fe39acf9","after_hash":"5dd1f22ec509d28f99baf8ac09135cd08210703ce69e0eb2e15eb7206417d610","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"402d02d254f978d50f48f30080d96df639e0eefbbbb5d432dc3eaffe70b2e0a7"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:32:01.654Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:32:01.654Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"5dd1f22ec509d28f99baf8ac09135cd08210703ce69e0eb2e15eb7206417d610","after_hash":"a54541942278e617a3e0e1178e788bb55fa0ffa9cef2d5aa152418ac30c6afbb","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"338bc5878b5d5f24e27599411ec02ed164ff47379ef95e359e98622417e572f9"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:32:02.915Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/3","value":{"created_at":"2026-10-04T11:32:02.914Z","author":"codex-sol","text":"Resumed PR #132 after reading current comments/reviews. Address Greptile missing incomplete-directory and dangling-link fixtures, plus the verified lookup-loop, Windows junction and inherited NODE_PATH isolation findings from this same certification. Keep the canonical launcher unchanged and run all new fixtures without new skips. Finish exact development pins and latest pm-changelog 2026.10.4; clean install, full locked gate and packed real-tracker npm/bun offline checks. No Linear API calls or hosted writes."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:32:02.915Z"}],"before_hash":"a54541942278e617a3e0e1178e788bb55fa0ffa9cef2d5aa152418ac30c6afbb","after_hash":"cd42393891bb33aa6397333ae864803bae3ae538a2e194b45f9e0406824121ab","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"681d7b8b49e6cc4e0dbd20284e80a2d66caecec531f935e8447287062b6755ad"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:32:06.206Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/4","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:32:06.206Z"}],"before_hash":"cd42393891bb33aa6397333ae864803bae3ae538a2e194b45f9e0406824121ab","after_hash":"284dbef416dd971acb0e0adffb44d8ee81d6585a29f5c01b4833adaa27159463","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"e20499b2e39e9c38a2cdcb23f6235c19fb849e4cdbf8bad1a2dbda045080ee11"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:32:06.987Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/4","value":{"command":"env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts","scope":"project","pm_context_mode":"tracker","provenance":{"author":"codex-sol","created_at":"2026-10-04T11:32:06.890Z","source_kind":"local_mutation","source_ref":"chore/pm-linear-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:32:06.987Z"}],"before_hash":"284dbef416dd971acb0e0adffb44d8ee81d6585a29f5c01b4833adaa27159463","after_hash":"da4cb078e65420b0e09f35443b11bcb4c0d1cc3a1012ed7b2d6cf9cebccaf36d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"ebf3fa41a2df0e5ed5f4eda43a3ed0a9885629734a5b0ed133037cb90a07e69e"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:44:05.826Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/4","value":{"created_at":"2026-10-04T11:44:05.826Z","author":"codex-sol","text":"Resumption validation PASS: all development pins exact, CLI/ops/changelog 2026.10.4; clean npm ci; flock-serialized npm run release:check passed with unchanged 99/96/100 thresholds, zero skipped tests, both audit scopes 0. Launcher fixtures and linked hostile NODE_PATH run pass 9/9, no new skips; canonical launcher unchanged. Packed real tracker offline npm/bun dogfood: npx -y @unbrained/pm-cli@2026.10.4 linear validate; linear sync --team ENG --dry-run; linear import --team ENG --dry-run; linear export --dry-run; equivalent bunx commands all exit 0, readyForWrites false and networkChecked false, real create payloads rendered, no Linear API calls/writes. Scratch removed. Managed pm-github sync --dry-run --repo unbraind/pm-linear plans 0. Pinned npx pm health exits 0 with stale_in_progress_items:1 and historical provenance_value_domain_invalid:claude-code:role:single_digit:26 advisories, no gate-failing findings. This corrects the earlier zero-warning receipt; matching August normalization audit records already exist on origin/main. A separate follow-up assesses that advisory without rewriting audited history."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:44:05.826Z"}],"before_hash":"da4cb078e65420b0e09f35443b11bcb4c0d1cc3a1012ed7b2d6cf9cebccaf36d","after_hash":"45ba416560c7e2e75a90a773601845370c7bbe40585bea10f4463a58473da7dd","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"a9b81df5cdf14ecc8faaedb3739dd751ce78c89468fa214be16c3ccafd48d4db"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:44:06.706Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"Exact development pins: CLI/ops/changelog 2026.10.4, Node types 26.6.4, TypeScript 7.0.2. Canonical launcher unchanged; requested incomplete/dangling and lookup error fixtures, portable junctions and isolated NODE_PATH all pass 9/9, no new skips. Clean npm ci and serialized release:check PASS: 222/222 tests, zero skips, unchanged 99/96/100 coverage thresholds. Both audits clean; no open Dependabot alerts. Packed real tracker npx/bunx offline validate/sync preview/import preview/export preview all pass; no Linear API calls or writes; scratch removed. Managed pm-github read-only preview planned 0. Health exits 0 with 2 inherited advisory categories (stale item and historical role normalization receipts), no gate-failing findings; follow-up assesses provenance reporting without rewriting history. Review receipts pending; leave item and PR open."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:44:06.706Z"}],"before_hash":"45ba416560c7e2e75a90a773601845370c7bbe40585bea10f4463a58473da7dd","after_hash":"f173b50e3055959df7b5df397c233e16a1f7c7ad91bda66b7867625f429b5d3f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"2fbc9efef15934c5a4dd6731f4644da8ca4fcb0bec1c57327302f7cf4717c34e"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:44:07.534Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:44:07.534Z"}],"before_hash":"f173b50e3055959df7b5df397c233e16a1f7c7ad91bda66b7867625f429b5d3f","after_hash":"18d24895d9a1f1b645b7758b98e1e87e1edf1969f91314217cd4b62df5a5e9d7","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"fa84b482c581d4ddd6039c243b133976d1c699b29af89af5d0bdfa2c5e262898"} diff --git a/.agents/pm/history/pm-linear-jloc.jsonl b/.agents/pm/history/pm-linear-jloc.jsonl new file mode 100644 index 0000000..436e4ba --- /dev/null +++ b/.agents/pm/history/pm-linear-jloc.jsonl @@ -0,0 +1 @@ +{"hash_algorithm":"sha256","ts":"2026-10-04T11:44:05.071Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-linear-jloc"},{"op":"add","path":"/metadata/title","value":"Assess the inherited historical-provenance warning reported by PM health"},{"op":"add","path":"/metadata/description","value":"Pinned PM CLI 2026.10.4 health exits 0 with advisory provenance_value_domain_invalid:claude-code:role:single_digit:26. The single_digit audit records already exist in origin/main history_repair context.provenance_normalization.invalid_values receipts from August, which say observations were removed. Do not rewrite those audit records. Determine whether reporting these historical audit values is intentional or a reproducible CLI defect before changing history or filing upstream. The certification also has one unrelated stale-item advisory and no gate-failing health findings."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["health","provenance"]},{"op":"add","path":"/metadata/created_at","value":"2026-10-04T11:44:05.071Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-04T11:44:05.071Z"},{"op":"add","path":"/metadata/author","value":"codex-sol"},{"op":"add","path":"/metadata/acceptance_criteria","value":"Classify the historical warning with a disposable synthetic reproduction; preserve normalization audit receipts and verified history chains; file upstream only for a confirmed defect after duplicate search"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"f5fe7151b42a2551aae7942ddef6846bfb9e68176dd6cc6095591a5f610c07c5","item_hash_version":3,"message":"","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"074042f293e9f01f592673fe7ea4c73e8ec8826b43acb2b7b68cc4efd2a13b0f"} diff --git a/.agents/pm/issues/pm-linear-jloc.toon b/.agents/pm/issues/pm-linear-jloc.toon new file mode 100644 index 0000000..ead7f6d --- /dev/null +++ b/.agents/pm/issues/pm-linear-jloc.toon @@ -0,0 +1,12 @@ +id: pm-linear-jloc +title: Assess the inherited historical-provenance warning reported by PM health +description: "Pinned PM CLI 2026.10.4 health exits 0 with advisory provenance_value_domain_invalid:claude-code:role:single_digit:26. The single_digit audit records already exist in origin/main history_repair context.provenance_normalization.invalid_values receipts from August, which say observations were removed. Do not rewrite those audit records. Determine whether reporting these historical audit values is intentional or a reproducible CLI defect before changing history or filing upstream. The certification also has one unrelated stale-item advisory and no gate-failing health findings." +type: Issue +status: open +priority: 2 +tags[2]: health,provenance +created_at: "2026-10-04T11:44:05.071Z" +updated_at: "2026-10-04T11:44:05.071Z" +author: codex-sol +acceptance_criteria: Classify the historical warning with a disposable synthetic reproduction; preserve normalization audit receipts and verified history chains; file upstream only for a confirmed defect after duplicate search +body: "" diff --git a/package-lock.json b/package-lock.json index 02f511c..b154ce1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,11 +9,11 @@ "version": "2026.10.3", "license": "MIT", "devDependencies": { - "@types/node": "^26.1.1", + "@types/node": "26.6.4", "@unbrained/pm-cli": "2026.10.4", - "pm-changelog": "2026.9.25", + "pm-changelog": "2026.10.4", "pm-ops": "2026.10.4", - "typescript": "^7.0.2" + "typescript": "7.0.2" }, "engines": { "node": ">=22.18.0" @@ -808,9 +808,9 @@ } }, "node_modules/pm-changelog": { - "version": "2026.9.25", - "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.25.tgz", - "integrity": "sha512-j2l97jlJIfuMiB7KDi7oIr9MWxdQvqnDx/JwE3pxC31fDw3MywnSmaTcE9/gV6sVlZbQkOSxnxooHzDwRo+1+g==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.10.4.tgz", + "integrity": "sha512-YJJHJYv2i+olzGVF+qdab3wWG6auiRVIvf7TZD4ZdUhE/8lIawf3aYOOZZVJHogN8xP8rNUlVV9Lc1OXKLlQ7w==", "dev": true, "license": "MIT", "bin": { diff --git a/package.json b/package.json index b629c2f..35708b7 100644 --- a/package.json +++ b/package.json @@ -59,11 +59,11 @@ "@unbrained/pm-cli": ">=2026.8.15" }, "devDependencies": { - "@types/node": "^26.1.1", + "@types/node": "26.6.4", "@unbrained/pm-cli": "2026.10.4", - "pm-changelog": "2026.9.25", + "pm-changelog": "2026.10.4", "pm-ops": "2026.10.4", - "typescript": "^7.0.2" + "typescript": "7.0.2" }, "engines": { "node": ">=22.18.0" diff --git a/test/prepare-merge-driver.test.ts b/test/prepare-merge-driver.test.ts index c3bb230..7ab978c 100644 --- a/test/prepare-merge-driver.test.ts +++ b/test/prepare-merge-driver.test.ts @@ -67,7 +67,7 @@ function stubPm(name: string, status: number, body = ""): string { /** Run the launcher as npm's `prepare` hook would: as the entry point, from `cwd`, with `path` as PATH. */ function prepare(cwd: string, path: string): SpawnSyncReturns { - return spawnSync(process.execPath, [launcher], { cwd, encoding: "utf8", env: { ...process.env, PATH: path } }); + return spawnSync(process.execPath, [launcher], { cwd, encoding: "utf8", env: { ...process.env, PATH: path, NODE_PATH: "" } }); } /** The merge drivers registered in a checkout's LOCAL Git config, by name. */ @@ -109,6 +109,42 @@ test("a pm-ops too old to export the launcher entry fails the install", posixOnl assert.match(result.stderr, /ERR_PACKAGE_PATH_NOT_EXPORTED/); }); +test("an incomplete pm-ops directory fails instead of reporting an omit-dev install", () => { + const directory = checkout("incomplete", "absent"); + mkdirSync(join(directory, "node_modules", "pm-ops"), { recursive: true }); + const result = prepare(directory, hostPath); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install/); + assert.deepEqual(registeredDrivers(directory), []); +}); + +test("a dangling pm-ops link fails instead of reporting an omit-dev install", () => { + const directory = checkout("dangling", "absent"); + mkdirSync(join(directory, "node_modules")); + symlinkSync(join(directory, "missing-pm-ops"), join(directory, "node_modules", "pm-ops"), "junction"); + const result = prepare(directory, hostPath); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install/); + assert.deepEqual(registeredDrivers(directory), []); +}); + +test("a looping lookup path preserves the original installer error", () => { + const directory = checkout("lookup-loop", "absent"); + const lookup = join(directory, "lookup"); + symlinkSync(lookup, lookup, "junction"); + const result = spawnSync(process.execPath, [launcher], { + cwd: directory, + encoding: "utf8", + env: { ...process.env, PATH: hostPath, NODE_PATH: lookup }, + }); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install|ELOOP|lstat/); + assert.deepEqual(registeredDrivers(directory), []); +}); + test("a failing pm merge install fails the install with the same status", posixOnly, () => { const result = prepare(checkout("failing-pm", "pinned"), stubPm("failing-pm", 7)); assert.equal(result.status, 7, result.stderr);