From cbe9657e5d44ba0ae5bf6f04c969eb91185245fa Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 13:58:38 +0200 Subject: [PATCH 1/2] Certify pm-ts-starter on PM CLI 2026.10.4 and consolidate dependency updates --- .agents/pm/chores/pm-ts-starter-n4ee.toon | 73 +- .../pm/extensions/.managed-extensions.json | 107 ++ .../pm/history/pm-ts-starter-audit104.jsonl | 2 + .agents/pm/history/pm-ts-starter-n4ee.jsonl | 18 + .agents/pm/issues/pm-ts-starter-audit104.toon | 15 + .github/workflows/ci.yml | 13 + .github/workflows/codeql.yml | 4 +- .gitignore | 4 + README.md | 10 +- docs/certification-2026.10.4.md | 68 + manifest.json | 2 +- package-lock.json | 1425 +++-------------- package.json | 23 +- scripts/docstring-gate.ts | 44 +- scripts/main-invocation.ts | 8 +- scripts/prepare-merge-driver.ts | 19 +- test/coverage-gate.test.ts | 16 +- test/docstring-gate.test.ts | 37 +- test/prepare-merge-driver.test.ts | 9 + test/smoke.test.ts | 15 +- 20 files changed, 594 insertions(+), 1318 deletions(-) create mode 100644 .agents/pm/extensions/.managed-extensions.json create mode 100644 .agents/pm/history/pm-ts-starter-audit104.jsonl create mode 100644 .agents/pm/issues/pm-ts-starter-audit104.toon create mode 100644 docs/certification-2026.10.4.md diff --git a/.agents/pm/chores/pm-ts-starter-n4ee.toon b/.agents/pm/chores/pm-ts-starter-n4ee.toon index 6d70dcd..365a2b8 100644 --- a/.agents/pm/chores/pm-ts-starter-n4ee.toon +++ b/.agents/pm/chores/pm-ts-starter-n4ee.toon @@ -1,34 +1,65 @@ id: pm-ts-starter-n4ee -title: Certify CLI SDK 2026.9.29 and fail closed on incomplete merge-driver dependencies -description: "Update exact development pins to published CLI and pm-ops 2026.9.29 and pm-changelog 2026.9.25. Verify the consumer documentation gate rejects TSX omissions alongside TypeScript. Preserve the public runtime compatibility floor. Validate reproducible install, release gates, packed npm and Bun execution in synthetic projects. No publication until mandatory coverage and reviews pass. Rollback is reverting this dependency and regression-test commit." +title: Certify pm-ts-starter on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates +description: "Certify exact PM CLI/SDK, pm-ops and pm-changelog 2026.10.4; consolidate Dependabot CodeQL, CLI, jscpd and Node type updates. Preserve host floor 2026.8.7 and all strict gates. Refresh canonical launcher and cover malformed lookup diagnostics; remove newly detected duplicate logic by sharing fixtures and entry guard. Restore managed pm-github for strict CI health. Record real tracker npx/native-Bun acceptance and the separate unpatched development audit blocker." type: Chore status: blocked priority: 1 tags: [] created_at: "2026-09-29T17:00:46.063Z" -updated_at: "2026-10-02T22:57:17.905Z" +updated_at: "2026-10-04T11:57:25.722Z" author: codex-ts-starter-0929 acceptance_criteria: An undocumented TSX declaration beside valid TypeScript fails the consumer documentation gate; Pinned installation and SDK typecheck pass with CLI 2026.9.29; Packed npm and Bun consumers execute hello and preserve native list output; All authored executable source meets four coverage metrics and required reviews pass before merge; An incomplete pm-ops directory makes prepare fail rather than silently skipping merge-driver installation risk: low -blocked_reason: TSX analyzer fix awaits pm-ops PR 132; four-metric all-source coverage and full declaration documentation remain unmet; exact-head reviews pending. -comments[4]{created_at,author,text}: +blocked_by: pm-ts-starter-audit104 +blocked_reason: Full development npm audit has four high findings rooted in unpatched braces 3.0.3; required current pm-ops duplication gate depends on fast-glob. +actual_result: "2026-10-04: full locked release:check passed 186/186, zero skips; 100% measured lines/branches/functions across five configured source files; 0% duplication across 19 authored sources. Canonical launcher 8/8 and .ts/.tsx docstring rejection passed. Strict health, production audit, Bun CI graph and real tracker npx/native-Bun commands passed (all 75 items; 9 capabilities; 5 search results). Read-only GitHub preview: 0 imports/1 update/0 skips. Full npm audit remains NOT CLEAN: 4 high unpatched braces findings; separate follow-up audit104. CI/reviews pending; orchestrator owns merge/closure." +dependencies[1]{id,kind,created_at,author,source_kind,author_source}: + pm-ts-starter-audit104,blocked_by,"2026-10-04T11:57:23.515Z",codex-sol,"cli:update:blocked_by",detected +comments[9]{created_at,author,text}: "2026-10-02T22:10:38.250Z",codex-sol,"Restart by codex-sol: preserved remote PR #114 and all existing bot replies/reactions were inspected. Branch is already current with origin/main. No new actionable unresolved inline finding is present. Retain documented coverage/health/publication blockers; rerun unchanged full CI gate with the host-wide flock. No merge, publish or item closure." "2026-10-02T22:25:29.247Z",codex-sol,"Restart: locked npm ci and release:check pass 184/184 tests, zero skips; configured coverage reports 100% lines/branches/functions for four TypeScript sources, without a separate statements dimension. PM-linked prepare-merge-driver tests, strict health with merge drivers and tracked dist equality pass. The original incomplete pm-ops fail-closed fix remains intact. Whole-authored-source coverage and declaration documentation remain incomplete, including the existing published pm-ops TSX omission tracked by pm-ops#132. Keep reviewer prerequisites separate; no merge, publish or close. Release claim for orchestrator." "2026-10-02T22:50:32.994Z",codex-sol,"Cubic review round: linked manifest.json (valid tracking omission). Disposable actual-launcher NODE_PATH regular-file reproduction confirms ENOTDIR masks MODULE_NOT_FOUND but install fails closed without skip. Canonical pm-ops template must be repaired/published first; local consumer divergence is refused and a follow-up item is open. Original release:check 184/184, four-source L/B/F 100 remains valid; no runtime code changed. Retain TSX and whole-source coverage blockers." "2026-10-02T22:57:14.567Z",codex-sol,"Valid Cubic/Greptile finding: the session-only diagnostic probe was incorrectly linked as a durable file/test. Removed those current links and preserved all historical receipts. The original portable repository prepare test remains linked; no canonical code changed. Diagnostic is historical evidence only; follow-up pm-ts-starter-rku9 contains portable reproduction steps. No claim that error masking is repaired." + "2026-10-04T11:38:52.723Z",codex-sol,"2026-10-04: certification from isolated origin/main worktree 934da76. Reuse this open Chore. Consolidate Dependabot #113 exact CodeQL SHA, #116 CLI update superseded by 2026.10.4, #117 jscpd 5.4.0 and #118 @types/node superseded by latest; exact all devDependencies, preserve 2026.8.7 host floor, full enforced 100% gate and npm/native-Bun real-tracker dogfood. No open security alerts. Canonical launcher publication follow-up is now consumable through pm-ops 2026.10.4." + "2026-10-04T11:47:35.508Z",codex-sol,"Installed exact pins including Babel parser 8.0.6 (newer than 8.0.5 despite latest dist-tag pointing to 7.x), ESLint 10.12.0 and jscpd 5.4.0. Byte-identity failed before canonical template copy and launcher suite then passed 7/7. New duplication gate failed test-first on three real clone pairs at unchanged 0% threshold; refactor shared logic, preserve assertions and strengthen coverage inventory for shared guard. Full npm audit has four high findings rooted in braces@3.0.3 via fast-glob/micromatch/pm-ops; registry maximum is 3.0.3 and GHSA-vfj7-8cjw-p6xm lists no patched version. Do not conceal or downgrade required latest pm-ops to npm audit proposed 2026.9.13." + "2026-10-04T11:54:44.318Z",codex-sol,"Full release:check passed 185/185 tests, zero skips, 100% measured lines/branches/functions across five configured sources including the shared entry guard; 0% duplication across 19 authored sources. Strict health and production audit passed; full development audit still has four high unpatched braces findings. GitHub read-only atomic preview proposes 0 imports/1 update/0 skips, no writes. Confirmed published docstrings now includes TSX: add a consumer .ts/.tsx rejection matrix before replacing the stale README omission notice. This adds coverage, changes no thresholds, and retains original docstring assertions." + "2026-10-04T11:56:19.849Z",codex-sol,"Real tracker packed acceptance passed under npx -y @unbrained/pm-cli@2026.10.4 and bunx --bun @unbrained/pm-cli@2026.10.4. hello --name Fleet --loud returned HELLO, FLEET!; ts-starter info reported 9 capabilities and unchanged supported floor 2026.8.7 (sdk_target is the peer floor, not the dev pin); list --all --output-budget unbounded --output-limit unbounded returned all 75 real items; context-demo --format json --depth brief succeeded; search-demo certify --limit 5 returned 5 results. All commands exited 0; scratch copy deleted. CI bun install --no-save graph also passed." + "2026-10-04T11:57:24.818Z",codex-sol,"Final complete gate passed 186/186 tests after TSX matrix addition, zero skips, 100% measured line/branch/function coverage and 0% duplication. npm/native-Bun real-tracker dogfood and CI Bun graph passed. Keep certification blocked on pm-ts-starter-audit104; do not treat configured green CI as a clean full development audit. Release claim for orchestrator without closing." notes[4]{created_at,author,text}: "2026-09-29T17:03:03.624Z",codex-ts-starter-0929,The undocumented TSX fixture reproduces a silent pass with both pm-ops 2026.9.23 and published 2026.9.29. Canonical repair remains unmerged in unbraind/pm-ops PR 132. Keep that acceptance criterion unresolved and do not duplicate the analyzer locally. Released tooling does contain the canonical incomplete-package launcher repair. Its new behavioral regression failed before copying the shipped template. "2026-09-29T17:04:42.433Z",codex-ts-starter-0929,"Clean npm ci and release:check passed 184 tests on Node 24.19.0. The documentation analyzer reports 9 files and 20 declarations; this policy denominator omits TSX and some internal declarations. Coverage reports 100 percent lines branches and functions for four source files only and no independent statement metric. This is not full authored-source four-metric certification. Production audit reports zero vulnerabilities. Strict tracker health and validation pass. Public package artifact allowlist contains nine files and excludes tracker scripts fixtures and deployment data. TSX reproduction remains blocked by pm-ops PR 132." "2026-09-29T17:05:17.243Z",codex-ts-starter-0929,Packed artifact 2026.9.26 candidate installed successfully with clean npm and Bun consumers using CLI 2026.9.29. Both runtimes initialized synthetic Git projects and installed the allowlisted packed extension. hello returned the requested Fixture greeting; native list retained an items array and total zero; ts-starter info passed. Command times for hello/list/info were 0.642-0.728 seconds under Node and 0.920-1.104 seconds under Bun. These are single-user smoke timings only. This extension has no standalone bin so npx/bunx package CLI execution is inapplicable. No release or deployment performed. "2026-09-29T17:07:12.493Z",codex-ts-starter-0929,"PM-linked release:check passed after selecting pm_context_mode=tracker. The initial none/source combination was correctly refused by CLI 2026.9.29 before execution; none now requires an isolated or snapshot workspace. Direct and linked release gates both pass, but denominator and review blockers remain. The linked test metadata now uses tracker context." -files[6]{path,scope}: - manifest.json,project - package-lock.json,project - package.json,project - scripts/coverage-gate.ts,project - scripts/prepare-merge-driver.ts,project - test/prepare-merge-driver.test.ts,project -tests[2]: +files[11]: + - path: .github/workflows/ci.yml + scope: project + note: Restore managed pm-github before strict health + - path: .github/workflows/codeql.yml + scope: project + note: Dependabot #113 exact action SHA + - path: manifest.json + scope: project + - path: package-lock.json + scope: project + note: Exact dependency resolution and Dependabot consolidation + - path: package.json + scope: project + - path: scripts/coverage-gate.ts + scope: project + - path: scripts/main-invocation.ts + scope: project + note: Shared entry guard added to strict coverage inventory + - path: scripts/prepare-merge-driver.ts + scope: project + - path: test/coverage-gate.test.ts + scope: project + note: Share emitted-artifact fixture without weakening assertions + - path: test/prepare-merge-driver.test.ts + scope: project + - path: test/smoke.test.ts + scope: project + note: Share silent-failure fixture and preserve both regression assertions +tests[3]: - command: "npm run release:check" scope: project pm_context_mode: tracker @@ -44,6 +75,18 @@ tests[2]: created_at: "2026-10-02T22:10:40.690Z" source_kind: local_mutation source_ref: land-restart/pm-ts-starter-114 -docs[1]{path,scope}: - README.md,project + - command: "flock /tmp/claude-1000/heavy-gate.lock npm run release:check" + scope: project + timeout_seconds: 2400 + provenance: + author: codex-sol + created_at: "2026-10-04T11:39:51.726Z" + source_kind: local_mutation + source_ref: chore/pm-ts-starter-pm-cli-2026-10-4 +docs[2]: + - path: docs/certification-2026.10.4.md + scope: project + note: Exact gates and real tracker packed dogfood receipts + - path: README.md + scope: project body: "" diff --git a/.agents/pm/extensions/.managed-extensions.json b/.agents/pm/extensions/.managed-extensions.json new file mode 100644 index 0000000..8fb79c2 --- /dev/null +++ b/.agents/pm/extensions/.managed-extensions.json @@ -0,0 +1,107 @@ +{ + "version": 1, + "updated_at": "2026-10-04T11:49:39.843Z", + "entries": [ + { + "name": "pm-github", + "directory": "pm-github", + "scope": "project", + "manifest_version": "2026.10.4", + "manifest_entry": "./dist/index.js", + "capabilities": [ + "commands", + "hooks", + "importers", + "preflight", + "schema", + "search" + ], + "contributions": { + "schema_version": 1, + "commands": [ + "gh-issues import", + "github export", + "github import", + "github project fields", + "github project import", + "github project list", + "github project sync", + "github sync", + "github validate" + ], + "command_overrides": [], + "command_handlers": [ + "gh-issues import", + "github export", + "github import", + "github project fields", + "github project import", + "github project list", + "github project sync", + "github sync", + "github validate" + ], + "hooks": [ + "after_command" + ], + "flag_commands": [ + "gh-issues import", + "github export", + "github import", + "github project fields", + "github project import", + "github project list", + "github project sync", + "github sync", + "github validate" + ], + "item_types": [], + "item_fields": [ + "github_author", + "github_created_at", + "github_number", + "github_state", + "github_updated_at", + "github_url" + ], + "migrations": [], + "profiles": [], + "importers": [ + "github" + ], + "exporters": [ + "github" + ], + "search_providers": [ + "github" + ], + "vector_store_adapters": [], + "parser_overrides": [], + "service_overrides": [], + "renderer_overrides": [], + "preflight_overrides": 1, + "preflight_ownership": [ + { + "commands": [ + "github sync", + "github export", + "github import", + "gh-issues import", + "github project import", + "github project sync" + ] + } + ] + }, + "installed_at": "2026-10-04T11:49:39.690Z", + "updated_at": "2026-10-04T11:49:39.690Z", + "source": { + "kind": "npm", + "input": "npm:pm-github@2026.10.4", + "location": "package", + "package": "pm-github", + "version": "2026.10.4" + } + } + ] +} diff --git a/.agents/pm/history/pm-ts-starter-audit104.jsonl b/.agents/pm/history/pm-ts-starter-audit104.jsonl new file mode 100644 index 0000000..3b2f380 --- /dev/null +++ b/.agents/pm/history/pm-ts-starter-audit104.jsonl @@ -0,0 +1,2 @@ +{"hash_algorithm":"sha256","ts":"2026-10-04T11:47:36.405Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-ts-starter-audit104"},{"op":"add","path":"/metadata/title","value":"Full development audit is blocked by unpatched braces through required latest pm-ops"},{"op":"add","path":"/metadata/description","value":"npm audit reports 4 high findings rooted in braces 3.0.3 through fast-glob 3.3.3 / micromatch / pm-ops 2026.10.4. npm maximum braces version is 3.0.3; GHSA-vfj7-8cjw-p6xm lists no patched version. Requires a canonical dependency replacement or a patched braces publication; retain required tool pins and full audit honesty."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":1},{"op":"add","path":"/metadata/tags","value":[]},{"op":"add","path":"/metadata/created_at","value":"2026-10-04T11:47:36.405Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-04T11:47:36.405Z"},{"op":"add","path":"/metadata/author","value":"codex-sol"},{"op":"add","path":"/metadata/expected_result","value":"Both production and full development npm audits pass with genuine patched dependencies."},{"op":"add","path":"/metadata/actual_result","value":"No open Dependabot alerts; full npm audit exits 1 with four high findings; suggested fix downgrades required pm-ops to 2026.9.13 and is refused."}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"4b43e66152cb7189da2a647a8e588470c5cab0ca80db75c3fe6734baf5cbf10b","item_hash_version":3,"message":"","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"d5d2d3752b3de64291fec694e4b5307c0d6822c8925531a6d96060db78b789cd"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:47:37.558Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"docs_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:47:37.558Z"},{"op":"add","path":"/metadata/docs","value":[{"path":"https://github.com/advisories/GHSA-vfj7-8cjw-p6xm","scope":"global","note":"Official unpatched advisory"}]}],"before_hash":"4b43e66152cb7189da2a647a8e588470c5cab0ca80db75c3fe6734baf5cbf10b","after_hash":"eda27144daa255dc26a545b166e4d2e930500b30214be43e2e8bf0a6d114428a","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b759281acd0695aca471bf6e4b43eb2c305f1f556e7ec52358452b95880d2b58"} diff --git a/.agents/pm/history/pm-ts-starter-n4ee.jsonl b/.agents/pm/history/pm-ts-starter-n4ee.jsonl index 55b9f97..b920b0f 100644 --- a/.agents/pm/history/pm-ts-starter-n4ee.jsonl +++ b/.agents/pm/history/pm-ts-starter-n4ee.jsonl @@ -35,3 +35,21 @@ {"hash_algorithm":"sha256","ts":"2026-10-02T22:57:14.567Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b2389d19e26c4d93974a8087","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/3","value":{"created_at":"2026-10-02T22:57:14.567Z","author":"codex-sol","text":"Valid Cubic/Greptile finding: the session-only diagnostic probe was incorrectly linked as a durable file/test. Removed those current links and preserved all historical receipts. The original portable repository prepare test remains linked; no canonical code changed. Diagnostic is historical evidence only; follow-up pm-ts-starter-rku9 contains portable reproduction steps. No claim that error masking is repaired."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-02T22:57:14.567Z"}],"before_hash":"0d1e476f5b350b996a4cd239dcf3af072d208c2960574df5d29ad9cca6897d8f","after_hash":"4f08dd772fa1bbfd56f16eadeeb9f61b7e0b858d83466b6e91ca664a1f1a0582","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"033f361191c307622fa3ebdf9e1cadd03b27a8a42b0f75879f637307ca5a705c"} {"hash_algorithm":"sha256","ts":"2026-10-02T22:57:17.412Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b2389d19e26c4d93974a8087","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-02T22:57:17.412Z"},{"op":"replace","path":"/metadata/status","value":"blocked"}],"before_hash":"4f08dd772fa1bbfd56f16eadeeb9f61b7e0b858d83466b6e91ca664a1f1a0582","after_hash":"f487d853df054efc1debe4e8b638e4b8e590d86c511a2f119918503874575f02","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"66ca15809cb0021eba47d74cb381bd7bf67147f6cbba993444d951767acfd1d0"} {"hash_algorithm":"sha256","ts":"2026-10-02T22:57:17.905Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b2389d19e26c4d93974a8087","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-02T22:57:17.905Z"}],"before_hash":"f487d853df054efc1debe4e8b638e4b8e590d86c511a2f119918503874575f02","after_hash":"9a21d844a83946e48b334a07ddcd765667e9bd97e91e1d8cf6f1b3ad203e63dd","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"bf96c19608aa9d873940d499560e11b961e208acaa46ddfc2a69d0b3dfaf18af"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:38:51.484Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:38:51.484Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"9a21d844a83946e48b334a07ddcd765667e9bd97e91e1d8cf6f1b3ad203e63dd","after_hash":"2ffd215cdf693baa656e48c75bff354782cac006c212ab6c99bf419f4fa586f3","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"cdd688de12295abd2d92dc782b74d18480616985159c71114e8b92c1a450fba6"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:38:52.167Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:38:52.167Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"},{"op":"replace","path":"/metadata/title","value":"Certify pm-ts-starter on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates"}],"before_hash":"2ffd215cdf693baa656e48c75bff354782cac006c212ab6c99bf419f4fa586f3","after_hash":"999133fcc5da471951f744b839f9d0344cdf63ce46c8db62dc64822120a3f28f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"91d26c9edb47dfda48292458d7489a6f141dfee99bd8f0f8ce28f42e7c2eee84"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:38:52.723Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/4","value":{"created_at":"2026-10-04T11:38:52.723Z","author":"codex-sol","text":"2026-10-04: certification from isolated origin/main worktree 934da76. Reuse this open Chore. Consolidate Dependabot #113 exact CodeQL SHA, #116 CLI update superseded by 2026.10.4, #117 jscpd 5.4.0 and #118 @types/node superseded by latest; exact all devDependencies, preserve 2026.8.7 host floor, full enforced 100% gate and npm/native-Bun real-tracker dogfood. No open security alerts. Canonical launcher publication follow-up is now consumable through pm-ops 2026.10.4."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:38:52.723Z"}],"before_hash":"999133fcc5da471951f744b839f9d0344cdf63ce46c8db62dc64822120a3f28f","after_hash":"1855c6fe4cf895d9c15486325aac555f6165611f3f3e72b5f0f39c920fd369ae","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"e894335b102d8cad21d3dc83fb3587cb3869fda6f495b8dbca9fb6f55d9e77e7"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:39:49.519Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/1/note","value":"Exact dependency resolution and Dependabot consolidation"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:39:49.519Z"}],"before_hash":"1855c6fe4cf895d9c15486325aac555f6165611f3f3e72b5f0f39c920fd369ae","after_hash":"8b645cf2cba8a7e1523e6af399d12e1bf3041f05ad770efc5287e923817d9635","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"4477a8cad0930c85fd407fb310e93281ab277f6ab555dd81ebf21d73c0c7fdfa"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:39:50.364Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/5/path","value":"scripts/prepare-merge-driver.ts"},{"op":"replace","path":"/metadata/files/4/path","value":"scripts/coverage-gate.ts"},{"op":"replace","path":"/metadata/files/3/path","value":"package.json"},{"op":"add","path":"/metadata/files/2/note","value":"Exact dependency resolution and Dependabot consolidation"},{"op":"replace","path":"/metadata/files/2/path","value":"package-lock.json"},{"op":"remove","path":"/metadata/files/1/note"},{"op":"replace","path":"/metadata/files/1/path","value":"manifest.json"},{"op":"add","path":"/metadata/files/0/note","value":"Dependabot #113 exact action SHA"},{"op":"replace","path":"/metadata/files/0/path","value":".github/workflows/codeql.yml"},{"op":"add","path":"/metadata/files/6","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:39:50.364Z"}],"before_hash":"8b645cf2cba8a7e1523e6af399d12e1bf3041f05ad770efc5287e923817d9635","after_hash":"852259e55d3883a016bcf44764e6ea75f057afac88544163ff0dadb60b38bb89","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"4500e4e69e661acd71199070e1a7d59d9e45714a0b2de4cf718d29050bba42b9"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:39:51.003Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/6/path","value":"scripts/prepare-merge-driver.ts"},{"op":"replace","path":"/metadata/files/5/path","value":"scripts/coverage-gate.ts"},{"op":"replace","path":"/metadata/files/4/path","value":"package.json"},{"op":"add","path":"/metadata/files/3/note","value":"Exact dependency resolution and Dependabot consolidation"},{"op":"replace","path":"/metadata/files/3/path","value":"package-lock.json"},{"op":"remove","path":"/metadata/files/2/note"},{"op":"replace","path":"/metadata/files/2/path","value":"manifest.json"},{"op":"add","path":"/metadata/files/1/note","value":"Dependabot #113 exact action SHA"},{"op":"replace","path":"/metadata/files/1/path","value":".github/workflows/codeql.yml"},{"op":"replace","path":"/metadata/files/0/note","value":"Restore managed pm-github before strict health"},{"op":"replace","path":"/metadata/files/0/path","value":".github/workflows/ci.yml"},{"op":"add","path":"/metadata/files/7","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:39:51.003Z"}],"before_hash":"852259e55d3883a016bcf44764e6ea75f057afac88544163ff0dadb60b38bb89","after_hash":"d21dc2539396f80fbd358281027d3fd8ce7d93db24d978ad37c220cfa53205ca","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"47d17a014a819c287fd700a1d571c8be97c13a700fc8d360a13307f984949b85"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:39:51.778Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/2","value":{"command":"flock /tmp/claude-1000/heavy-gate.lock npm run release:check","scope":"project","timeout_seconds":2400,"provenance":{"author":"codex-sol","created_at":"2026-10-04T11:39:51.726Z","source_kind":"local_mutation","source_ref":"chore/pm-ts-starter-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:39:51.778Z"}],"before_hash":"d21dc2539396f80fbd358281027d3fd8ce7d93db24d978ad37c220cfa53205ca","after_hash":"821f94470ccbe915e96d9fac26ce9cf5b910cc532d0ee87c511d2b5f1fff9ee5","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"3cb711af6fe266daf2ac5ba61c24b5d60c0f2ed26963dff1839aeb99a412492d"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:39:52.660Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"docs_add","patch":[{"op":"add","path":"/metadata/docs/0/note","value":"Exact gates and real tracker packed dogfood receipts"},{"op":"replace","path":"/metadata/docs/0/path","value":"docs/certification-2026.10.4.md"},{"op":"add","path":"/metadata/docs/1","value":{"path":"README.md","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:39:52.660Z"}],"before_hash":"821f94470ccbe915e96d9fac26ce9cf5b910cc532d0ee87c511d2b5f1fff9ee5","after_hash":"82046b855b28681d475ba2b80fba57629399952e0f1d71cb39f2d4cddf0ca825","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"854f9e5f9874ac674c388feb2d2e4a0f74944b87f09a2923528a78fbe38e1f32"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:47:35.508Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/5","value":{"created_at":"2026-10-04T11:47:35.508Z","author":"codex-sol","text":"Installed exact pins including Babel parser 8.0.6 (newer than 8.0.5 despite latest dist-tag pointing to 7.x), ESLint 10.12.0 and jscpd 5.4.0. Byte-identity failed before canonical template copy and launcher suite then passed 7/7. New duplication gate failed test-first on three real clone pairs at unchanged 0% threshold; refactor shared logic, preserve assertions and strengthen coverage inventory for shared guard. Full npm audit has four high findings rooted in braces@3.0.3 via fast-glob/micromatch/pm-ops; registry maximum is 3.0.3 and GHSA-vfj7-8cjw-p6xm lists no patched version. Do not conceal or downgrade required latest pm-ops to npm audit proposed 2026.9.13."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:47:35.508Z"}],"before_hash":"82046b855b28681d475ba2b80fba57629399952e0f1d71cb39f2d4cddf0ca825","after_hash":"e2681c703e81acfdcb2e20d5cb0928e40f00494a27b929b209a2fd589005d175","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"ce611bfc5fa683695a3050e48b381a15b28ba591189b1a11612c6328662bc6d8"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:50:04.354Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/7/path","value":"scripts/prepare-merge-driver.ts"},{"op":"add","path":"/metadata/files/6/note","value":"Shared entry guard added to strict coverage inventory"},{"op":"replace","path":"/metadata/files/6/path","value":"scripts/main-invocation.ts"},{"op":"add","path":"/metadata/files/8","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:50:04.354Z"}],"before_hash":"e2681c703e81acfdcb2e20d5cb0928e40f00494a27b929b209a2fd589005d175","after_hash":"55ba97352330ea3ab63ba349e619ac6a645d6ca6d6ecec201e236f53680e5a0e","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b32e3e7a44c4a684c3dc382b1acd646705759e9046f54976eaff8906124fcb3a"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:50:07.065Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/9","value":{"path":"test/smoke.test.ts","scope":"project","note":"Share silent-failure fixture and preserve both regression assertions"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:50:07.065Z"}],"before_hash":"55ba97352330ea3ab63ba349e619ac6a645d6ca6d6ecec201e236f53680e5a0e","after_hash":"024c3be903bfd234b54ed185a263934ee49f19733534ac1e384852ebffe8b08c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"ee89fa21a0a83d93bfa07bd38796f68e6948abb2f702028ac69561416a0e5ed6"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:50:09.366Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"remove","path":"/metadata/files/9/note"},{"op":"replace","path":"/metadata/files/9/path","value":"test/prepare-merge-driver.test.ts"},{"op":"add","path":"/metadata/files/8/note","value":"Share emitted-artifact fixture without weakening assertions"},{"op":"replace","path":"/metadata/files/8/path","value":"test/coverage-gate.test.ts"},{"op":"add","path":"/metadata/files/10","value":{"path":"test/smoke.test.ts","scope":"project","note":"Share silent-failure fixture and preserve both regression assertions"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:50:09.366Z"}],"before_hash":"024c3be903bfd234b54ed185a263934ee49f19733534ac1e384852ebffe8b08c","after_hash":"0b09d22779262c304a7b5a0be0cd2b08d7534fdd7bb541dbcc83852be5f259cf","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b311851c1c2a696585e63592b40957e36bbbbdae96cd067d916688df4129ac1e"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:50:12.186Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:50:12.186Z"},{"op":"replace","path":"/metadata/description","value":"Certify exact PM CLI/SDK, pm-ops and pm-changelog 2026.10.4; consolidate Dependabot CodeQL, CLI, jscpd and Node type updates. Preserve host floor 2026.8.7 and all strict gates. Refresh canonical launcher and cover malformed lookup diagnostics; remove newly detected duplicate logic by sharing fixtures and entry guard. Restore managed pm-github for strict CI health. Record real tracker npx/native-Bun acceptance and the separate unpatched development audit blocker."}],"before_hash":"0b09d22779262c304a7b5a0be0cd2b08d7534fdd7bb541dbcc83852be5f259cf","after_hash":"ce710ce903c06102ac056fb2d4a5ca9c7f32fbbb1501e01c5d676438e05c94ef","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"9535094cd4b1a6bd16d03631a1c71b35aa0c5b347b4c5db6ffd3fcd970a272a7"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:54:44.318Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/6","value":{"created_at":"2026-10-04T11:54:44.318Z","author":"codex-sol","text":"Full release:check passed 185/185 tests, zero skips, 100% measured lines/branches/functions across five configured sources including the shared entry guard; 0% duplication across 19 authored sources. Strict health and production audit passed; full development audit still has four high unpatched braces findings. GitHub read-only atomic preview proposes 0 imports/1 update/0 skips, no writes. Confirmed published docstrings now includes TSX: add a consumer .ts/.tsx rejection matrix before replacing the stale README omission notice. This adds coverage, changes no thresholds, and retains original docstring assertions."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:54:44.318Z"}],"before_hash":"ce710ce903c06102ac056fb2d4a5ca9c7f32fbbb1501e01c5d676438e05c94ef","after_hash":"52b1323dfc2875d52b60d51e388c9f7099f3f92bc0db7a5ccfcfc7b4b0771d8a","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"a8b84f3d76f6bc0eed92a367ccab175a7eedc6a680d50651063b3c8faa6648c5"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:56:19.849Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/7","value":{"created_at":"2026-10-04T11:56:19.849Z","author":"codex-sol","text":"Real tracker packed acceptance passed under npx -y @unbrained/pm-cli@2026.10.4 and bunx --bun @unbrained/pm-cli@2026.10.4. hello --name Fleet --loud returned HELLO, FLEET!; ts-starter info reported 9 capabilities and unchanged supported floor 2026.8.7 (sdk_target is the peer floor, not the dev pin); list --all --output-budget unbounded --output-limit unbounded returned all 75 real items; context-demo --format json --depth brief succeeded; search-demo certify --limit 5 returned 5 results. All commands exited 0; scratch copy deleted. CI bun install --no-save graph also passed."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:56:19.849Z"}],"before_hash":"52b1323dfc2875d52b60d51e388c9f7099f3f92bc0db7a5ccfcfc7b4b0771d8a","after_hash":"d5951e59aea685f65765d5b08df7be63b4dd925b7b52faead98782aa33cf9f00","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"bcc27429549b3443417587691fc222d63e39fb5b582276cc42a060da50d40cbd"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:57:23.566Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/blocked_reason","value":"Full development npm audit has four high findings rooted in unpatched braces 3.0.3; required current pm-ops duplication gate depends on fast-glob."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:57:23.566Z"},{"op":"replace","path":"/metadata/status","value":"blocked"},{"op":"add","path":"/metadata/blocked_by","value":"pm-ts-starter-audit104"},{"op":"add","path":"/metadata/actual_result","value":"2026-10-04: full locked release:check passed 186/186, zero skips; 100% measured lines/branches/functions across five configured source files; 0% duplication across 19 authored sources. Canonical launcher 8/8 and .ts/.tsx docstring rejection passed. Strict health, production audit, Bun CI graph and real tracker npx/native-Bun commands passed (all 75 items; 9 capabilities; 5 search results). Read-only GitHub preview: 0 imports/1 update/0 skips. Full npm audit remains NOT CLEAN: 4 high unpatched braces findings; separate follow-up audit104. CI/reviews pending; orchestrator owns merge/closure."},{"op":"add","path":"/metadata/dependencies","value":[{"id":"pm-ts-starter-audit104","kind":"blocked_by","created_at":"2026-10-04T11:57:23.515Z","author":"codex-sol","source_kind":"cli:update:blocked_by","author_source":"detected"}]}],"before_hash":"d5951e59aea685f65765d5b08df7be63b4dd925b7b52faead98782aa33cf9f00","after_hash":"7c4bb4a095e8c9f4db2ea32d5a3ba7dd8e16e45d9747845fc1d9d94a0cdbe8f3","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"4bcc7f477ac8518325fca7eef59b65d265820277327706913772b5a2a993217f"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:57:24.818Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/8","value":{"created_at":"2026-10-04T11:57:24.818Z","author":"codex-sol","text":"Final complete gate passed 186/186 tests after TSX matrix addition, zero skips, 100% measured line/branch/function coverage and 0% duplication. npm/native-Bun real-tracker dogfood and CI Bun graph passed. Keep certification blocked on pm-ts-starter-audit104; do not treat configured green CI as a clean full development audit. Release claim for orchestrator without closing."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:57:24.818Z"}],"before_hash":"7c4bb4a095e8c9f4db2ea32d5a3ba7dd8e16e45d9747845fc1d9d94a0cdbe8f3","after_hash":"e40d1c54162508e426892d4a6fd2f1035987802b1d96c0566ffc8296f205c81c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"7691a5b9908a441f53db89c9cf990370d74a6fe59d641b160918300194abdb0f"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:57:25.722Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:57:25.722Z"}],"before_hash":"e40d1c54162508e426892d4a6fd2f1035987802b1d96c0566ffc8296f205c81c","after_hash":"3f512f1f1d3cbe0ddba7e8d00d05d34dfb68cac9a333bc5b0d888dc5c489d250","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"4631fb29313ae195efd02faac91bd5345a0e55c68e8a8ed45ea111847b2d0420"} diff --git a/.agents/pm/issues/pm-ts-starter-audit104.toon b/.agents/pm/issues/pm-ts-starter-audit104.toon new file mode 100644 index 0000000..6083402 --- /dev/null +++ b/.agents/pm/issues/pm-ts-starter-audit104.toon @@ -0,0 +1,15 @@ +id: pm-ts-starter-audit104 +title: Full development audit is blocked by unpatched braces through required latest pm-ops +description: npm audit reports 4 high findings rooted in braces 3.0.3 through fast-glob 3.3.3 / micromatch / pm-ops 2026.10.4. npm maximum braces version is 3.0.3; GHSA-vfj7-8cjw-p6xm lists no patched version. Requires a canonical dependency replacement or a patched braces publication; retain required tool pins and full audit honesty. +type: Issue +status: open +priority: 1 +tags: [] +created_at: "2026-10-04T11:47:36.405Z" +updated_at: "2026-10-04T11:47:37.558Z" +author: codex-sol +expected_result: Both production and full development npm audits pass with genuine patched dependencies. +actual_result: No open Dependabot alerts; full npm audit exits 1 with four high findings; suggested fix downgrades required pm-ops to 2026.9.13 and is refused. +docs[1]{path,scope,note}: + "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm",global,Official unpatched advisory +body: "" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a676379..e0265ec 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,6 +37,19 @@ jobs: - name: Install dependencies run: npm ci + - name: Install project pm-github extension + shell: bash + run: | + set -euo pipefail + ./node_modules/.bin/pm package install npm:pm-github@2026.10.4 --project + node -e 'if (require("./.agents/pm/extensions/pm-github/package.json").version !== "2026.10.4") process.exit(1)' + managed_registry=".agents/pm/extensions/.managed-extensions.json" + if git ls-files --error-unmatch "${managed_registry}" > /dev/null 2>&1; then + git restore -- "${managed_registry}" + else + rm -f "${managed_registry}" + fi + - name: Verify tracked pm project health shell: bash run: | diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2502f5a..6011eaf 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,13 +28,13 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: languages: javascript-typescript # This package is analyzed from source without a compiled build. build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: category: "/language:javascript-typescript" diff --git a/.gitignore b/.gitignore index d114b4e..cdfe7cc 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,7 @@ coverage/ # one turns the health gate red; the journal has no value once the transaction # has landed. Deliberately outside any `pm-cli:` fence, which the CLI rewrites. .agents/pm/transactions/ + +# Restore managed artifacts locally and in CI; track only the registry. +.agents/pm/extensions/* +!.agents/pm/extensions/.managed-extensions.json diff --git a/README.md b/README.md index e0f5c71..cef2f9c 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,12 @@ # pm-ts-starter -TypeScript reference extension for [pm-cli](https://github.com/unbraind/pm-cli) covering **all 9 SDK capability types** in one fully-typed `index.ts`, checked against the **pm-cli 2026.9.29 SDK**. The declared runtime compatibility floor remains 2026.8.7. +TypeScript reference extension for [pm-cli](https://github.com/unbraind/pm-cli) covering **all 9 SDK capability types** in one fully-typed `index.ts`, checked against the **pm-cli 2026.10.4 SDK**. The declared runtime compatibility floor remains 2026.8.7. -Development dependencies pin CLI/SDK and `pm-ops` to 2026.9.29 and -`pm-changelog` to 2026.9.25. The prepare hook rejects incomplete `pm-ops` +Development dependencies pin CLI/SDK and `pm-ops` to 2026.10.4 and +`pm-changelog` to 2026.10.4. The prepare hook rejects incomplete `pm-ops` installations so missing merge drivers cannot silently pass installation. -The published documentation analyzer still omits TSX; adopting TSX requires -the canonical repair tracked in [pm-ops #132](https://github.com/unbraind/pm-ops/pull/132). +The pinned documentation analyzer covers TypeScript and TSX. A consumer +regression verifies that undocumented declarations in either file type fail. Each capability is a small, SAFE, inert demo with teaching comments. Copy the ones you need into your own extension and delete the rest. The reference also diff --git a/docs/certification-2026.10.4.md b/docs/certification-2026.10.4.md new file mode 100644 index 0000000..a6739da --- /dev/null +++ b/docs/certification-2026.10.4.md @@ -0,0 +1,68 @@ +# PM CLI/SDK 2026.10.4 certification + +Tracker: [pm-ts-starter-n4ee](https://github.com/unbraind/pm-ts-starter/blob/main/.agents/pm/chores/pm-ts-starter-n4ee.toon). + +Exact development pins: CLI/SDK, pm-ops and pm-changelog 2026.10.4; +Babel ESLint parser 8.0.6; TypeScript syntax plugin 8.0.3; @types/node 26.6.4; +ESLint 10.12.0; fast-glob 3.3.3; jscpd 5.4.0; TypeScript 7.0.2. The runtime +host floor stays 2026.8.7. The parser's npm `latest` tag points to an older major; +8.0.6 is the newer published release within the existing Babel 8 line. + +Dependabot #113's exact CodeQL init/analyze pin is +`2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2` (`# v4`). Updates from #116 (CLI), +#117 (jscpd) and #118 (Node types) are included or superseded by newer pins. +The merge-driver launcher is byte-identical to the installed pm-ops template. +A malformed lookup-path regression checks that the original resolution failure +is preserved instead of being replaced by ENOTDIR or treated as omit-dev. + +jscpd 5 detected three existing clone pairs at the unchanged 0% threshold. +Sharing the entry guard and test fixtures removed them while preserving behavior +and assertions. The shared guard is also added to the strict coverage inventory. +The docstring consumer now checks undocumented TypeScript and TSX declarations; +the README reflects the pinned analyzer's support for both. + +`flock /tmp/claude-1000/heavy-gate.lock npm run release:check` initially passed +185/185 tests with zero skips, 100% measured lines/branches/functions across +five configured sources, and 0% duplication across 19 authored sources. Statement +coverage is not independently reported. The final run passed 186/186 tests including the TSX consumer regression, +with zero skips and the same complete configured 100% coverage. It ran through +`npx pm test pm-ts-starter-n4ee --run --only-index 3 --progress --pm-context +tracker --override-linked-pm-context`. `npx pm health +--strict-exit --require-merge-drivers`, `npm audit --omit=dev`, and CI's +`flock /tmp/claude-1000/heavy-gate.lock bun install --no-save` passed. Committed +dist output remains identical to the fresh build. + +pm-github 2026.10.4 was installed as a managed extension, with CI restoring the +same exact package before strict health. `npx pm github import +unbraind/pm-ts-starter --state all --atomic --dry-run` proposed 0 imports / 1 +tracker update / 0 skips. No GitHub or tracker sync writes occurred. + +Real-data dogfood copied this repository's `.agents/pm` into disposable +`pm-ts-starter-dogfood/.agents/pm`, packed with `npm pack --pack-destination +/pack`, installed with `npm install --ignore-scripts +@unbrained/pm-cli@2026.10.4 ` and `npx -y @unbrained/pm-cli@2026.10.4 +package install --project`. Both `npx -y +@unbrained/pm-cli@2026.10.4` and `bunx --bun @unbrained/pm-cli@2026.10.4` ran: + +```sh +--version +--json hello --name Fleet --loud +--json ts-starter info +--json list --all --output-budget unbounded --output-limit unbounded +--json ts-starter context-demo --format json --depth brief +--json ts-starter search-demo certify --limit 5 +``` + +Each host reported 2026.10.4, greeted `HELLO, FLEET!`, exposed 9 capabilities, +reported its peer floor as sdk_target 2026.8.7, read all 75 real items, returned +brief context and 5 search results. All commands exited 0. Scratch was deleted. + +Full development audit remains **blocked**: 4 high findings rooted in +`braces@3.0.3` through fast-glob/micromatch and pm-ops. npm lists 3.0.3 as the +maximum braces release and [GHSA-vfj7-8cjw-p6xm](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) +lists no patched version. fast-glob is required by the canonical duplication +analyzer; its removal would break that gate. The suggested audit fix downgrades +required pm-ops to 2026.9.13 and was refused. No open Dependabot security alerts +were present. [pm-ts-starter-audit104](https://github.com/unbraind/pm-ts-starter/blob/main/.agents/pm/issues/pm-ts-starter-audit104.toon) +tracks the required canonical dependency replacement or upstream patch. A green +configured release gate does not make the full development audit clean. diff --git a/manifest.json b/manifest.json index ea66a41..e133dd3 100644 --- a/manifest.json +++ b/manifest.json @@ -1,7 +1,7 @@ { "name": "pm-ts-starter", "version": "2026.10.3", - "description": "TypeScript reference extension covering all 9 SDK capability types: commands, renderers, hooks, schema, importers, search, parser, preflight, services. Checked against the pm-cli 2026.9.29 SDK: demonstrates defineExtension plus registerCommand/registerFlags (with failure_hints + typed positional arguments), registerItemFields/registerItemTypes/registerMigration, the five api.hooks.* lifecycle hooks, registerImporter/registerExporter (with ImportExportRegistrationOptions), registerRenderer, registerSearchProvider/registerVectorStoreAdapter, registerParser, registerPreflight, registerService, PmCliExpectedError-shaped errors, demo commands for the plan/context/search/history-compact pm surfaces, and a guided `ts-starter setup --interactive` onboarding - all fully typed.", + "description": "TypeScript reference extension covering all 9 SDK capability types: commands, renderers, hooks, schema, importers, search, parser, preflight, services. Checked against the pm-cli 2026.10.4 SDK: demonstrates defineExtension plus registerCommand/registerFlags (with failure_hints + typed positional arguments), registerItemFields/registerItemTypes/registerMigration, the five api.hooks.* lifecycle hooks, registerImporter/registerExporter (with ImportExportRegistrationOptions), registerRenderer, registerSearchProvider/registerVectorStoreAdapter, registerParser, registerPreflight, registerService, PmCliExpectedError-shaped errors, demo commands for the plan/context/search/history-compact pm surfaces, and a guided `ts-starter setup --interactive` onboarding - all fully typed.", "author": "@unbraind", "entry": "./dist/index.js", "pm_min_version": "2026.8.7", diff --git a/package-lock.json b/package-lock.json index 8844c63..6360f09 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,16 +9,16 @@ "version": "2026.10.3", "license": "MIT", "devDependencies": { - "@babel/eslint-parser": "^8.0.5", - "@babel/plugin-syntax-typescript": "^8.0.3", - "@types/node": "^26.2.0", - "@unbrained/pm-cli": "2026.9.29", - "eslint": "^10.10.0", - "fast-glob": "^3.3.3", - "jscpd": "^4.3.0", - "pm-changelog": "2026.9.25", - "pm-ops": "2026.9.29", - "typescript": "^7.0.2" + "@babel/eslint-parser": "8.0.6", + "@babel/plugin-syntax-typescript": "8.0.3", + "@types/node": "26.6.4", + "@unbrained/pm-cli": "2026.10.4", + "eslint": "10.12.0", + "fast-glob": "3.3.3", + "jscpd": "5.4.0", + "pm-changelog": "2026.10.4", + "pm-ops": "2026.10.4", + "typescript": "7.0.2" }, "engines": { "node": ">=22.18.0" @@ -322,17 +322,6 @@ "keyv": "^5.6.0" } }, - "node_modules/@colors/colors": { - "version": "1.5.0", - "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz", - "integrity": "sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==", - "dev": true, - "license": "MIT", - "optional": true, - "engines": { - "node": ">=0.1.90" - } - }, "node_modules/@eslint-community/eslint-utils": { "version": "4.10.1", "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz", @@ -562,70 +551,6 @@ "@jridgewell/sourcemap-codec": "^1.4.14" } }, - "node_modules/@jscpd/badge-reporter": { - "version": "4.2.5", - "resolved": "https://registry.npmjs.org/@jscpd/badge-reporter/-/badge-reporter-4.2.5.tgz", - "integrity": "sha512-ktXrjPeRaRyUDktxTroSA2/w5sshXpQplWkUuq/e6XqEpKBSbGEnwZLIaegSijOrMwIcCXPQ9k4feXIz5eVJNA==", - "dev": true, - "license": "MIT", - "dependencies": { - "badgen": "^3.2.3", - "colors": "^1.4.0", - "fs-extra": "^11.2.0" - } - }, - "node_modules/@jscpd/core": { - "version": "4.2.5", - "resolved": "https://registry.npmjs.org/@jscpd/core/-/core-4.2.5.tgz", - "integrity": "sha512-Esf2deHxaoNEjePwf2jqP6Urzj+BAOsJVPFLbnnSsV+q7rLNMcn0UEEoKBXIOOt4qMkrkhl9DfwpMyPPOr6GkQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "eventemitter3": "^5.0.1" - } - }, - "node_modules/@jscpd/finder": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/@jscpd/finder/-/finder-4.3.0.tgz", - "integrity": "sha512-MnEUyier0D6P9zRIhAlBoyJUV8BYT6d5FDZuhR7X23FdZAgdMV8yaRRO1Q1EveK9/ReA6WVHT1HE8F15rij71A==", - "dev": true, - "license": "MIT", - "dependencies": { - "@jscpd/core": "4.2.5", - "@jscpd/tokenizer": "4.2.6", - "blamer": "^1.0.6", - "bytes": "^3.1.2", - "cli-table3": "^0.6.5", - "colors": "^1.4.0", - "fast-glob": "^3.3.2", - "fs-extra": "^11.3.6", - "markdown-table": "^2.0.0", - "pug": "^3.0.4" - } - }, - "node_modules/@jscpd/html-reporter": { - "version": "4.2.5", - "resolved": "https://registry.npmjs.org/@jscpd/html-reporter/-/html-reporter-4.2.5.tgz", - "integrity": "sha512-zMMIKbvi43dMgeNeHXlHQy1ovf+KJrzNlUubaBvCAVatqP23ksW8d3fmsevIQG9mMMTH0D1xOz+SxUn1FREOPg==", - "dev": true, - "license": "MIT", - "dependencies": { - "colors": "1.4.0", - "fs-extra": "^11.2.0", - "pug": "^3.0.4" - } - }, - "node_modules/@jscpd/tokenizer": { - "version": "4.2.6", - "resolved": "https://registry.npmjs.org/@jscpd/tokenizer/-/tokenizer-4.2.6.tgz", - "integrity": "sha512-/eyFjINWLs2mrBTU4H681bs855r5oRyl1O3mZxcd7TpL1JIG85a7pps0RkRPAe9c/2KcjVCc82HbhOz86M0n5g==", - "dev": true, - "license": "MIT", - "dependencies": { - "@jscpd/core": "4.2.5", - "spark-md5": "^3.0.2" - } - }, "node_modules/@keyv/bigmap": { "version": "1.3.1", "resolved": "https://registry.npmjs.org/@keyv/bigmap/-/bigmap-1.3.1.tgz", @@ -971,22 +896,15 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz", - "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==", + "version": "26.6.4", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.4.tgz", + "integrity": "sha512-ldVPDCzj7fsaGZrLB0NuHuTvJcsNasysBAqMolr/cgxrLd1xbqxIr3XJiPnHHJUCxj5sNF1vnRj9aWnrVh5Jcg==", "dev": true, "license": "MIT", "dependencies": { "undici-types": "~8.9.0" } }, - "node_modules/@types/sarif": { - "version": "2.1.7", - "resolved": "https://registry.npmjs.org/@types/sarif/-/sarif-2.1.7.tgz", - "integrity": "sha512-kRz0VEkJqWLf1LLVN4pT1cg1Z9wAuvI6L97V3m2f5B76Tg8d413ddvLBPTEHAZJlnn4XSvu0FkZtViCQGVyrXQ==", - "dev": true, - "license": "MIT" - }, "node_modules/@typescript/typescript-aix-ppc64": { "version": "7.0.2", "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz", @@ -1328,9 +1246,9 @@ } }, "node_modules/@unbrained/pm-cli": { - "version": "2026.9.29", - "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.9.29.tgz", - "integrity": "sha512-dkWT7u42PhKVbignagfdvwiLkIIo1pzsX4zetaKuwIXK68yyv6JqnYJ0fndRNNqTCEFUZOx7ArW3USE7f1tg1A==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.10.4.tgz", + "integrity": "sha512-NZLdiUSUKIRcFiMj9lG0L5UubA9G33fq5WzB1JzJjTTlYxYCVjrFFOCV2rtxYTaYTCzX9o/6V/A4fDx6N3mm/w==", "dev": true, "license": "MIT", "dependencies": { @@ -1338,10 +1256,10 @@ "@toon-format/toon": "^4.1.1", "@types/node": ">=22", "commander": "^15.0.0", - "fast-glob": "^3.3.3", "fast-json-patch": "^3.1.1", "npm-package-arg": "^13.0.2", "tar": "7.5.22", + "tinyglobby": "^0.2.17", "yaml": "^2.9.1" }, "bin": { @@ -1394,84 +1312,6 @@ "url": "https://github.com/sponsors/epoberezkin" } }, - "node_modules/ansi-regex": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz", - "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - } - }, - "node_modules/asap": { - "version": "2.0.6", - "resolved": "https://registry.npmjs.org/asap/-/asap-2.0.6.tgz", - "integrity": "sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==", - "dev": true, - "license": "MIT" - }, - "node_modules/assert-never": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/assert-never/-/assert-never-1.4.0.tgz", - "integrity": "sha512-5oJg84os6NMQNl27T9LnZkvvqzvAnHu03ShCnoj6bsJwS7L8AO4lf+C/XjK/nvzEqQB744moC6V128RucQd1jA==", - "dev": true, - "license": "MIT" - }, - "node_modules/babel-walk": { - "version": "3.0.0-canary-5", - "resolved": "https://registry.npmjs.org/babel-walk/-/babel-walk-3.0.0-canary-5.tgz", - "integrity": "sha512-GAwkz0AihzY5bkwIY5QDR+LvsRQgB/B+1foMPvi0FZPMl5fjD7ICiznUiBdLYMH1QYe6vqu4gWYytZOccLouFw==", - "dev": true, - "license": "MIT", - "dependencies": { - "@babel/types": "^7.9.6" - }, - "engines": { - "node": ">= 10.0.0" - } - }, - "node_modules/babel-walk/node_modules/@babel/helper-string-parser": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz", - "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/babel-walk/node_modules/@babel/helper-validator-identifier": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz", - "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/babel-walk/node_modules/@babel/types": { - "version": "7.29.8", - "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz", - "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@babel/helper-string-parser": "^7.29.7", - "@babel/helper-validator-identifier": "^7.29.7" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/badgen": { - "version": "3.3.2", - "resolved": "https://registry.npmjs.org/badgen/-/badgen-3.3.2.tgz", - "integrity": "sha512-fbQwK9norfdzbdsoPwbLIAmgBXDGEme3jeIyqPAH7o6vp9lmuLHS7uXULvOiQ6XnMLkYNG4gDjILf74hgtTAug==", - "dev": true, - "license": "MIT" - }, "node_modules/balanced-match": { "version": "4.0.4", "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", @@ -1496,20 +1336,6 @@ "node": ">=6.0.0" } }, - "node_modules/blamer": { - "version": "1.0.7", - "resolved": "https://registry.npmjs.org/blamer/-/blamer-1.0.7.tgz", - "integrity": "sha512-GbBStl/EVlSWkiJQBZps3H1iARBrC7vt++Jb/TTmCNu/jZ04VW7tSN1nScbFXBUy1AN+jzeL7Zep9sbQxLhXKA==", - "dev": true, - "license": "MIT", - "dependencies": { - "execa": "^4.0.0", - "which": "^2.0.2" - }, - "engines": { - "node": ">=8.9" - } - }, "node_modules/brace-expansion": { "version": "5.0.12", "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", @@ -1571,16 +1397,6 @@ "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" } }, - "node_modules/bytes": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", - "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 0.8" - } - }, "node_modules/cacheable": { "version": "2.5.0", "resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.5.0.tgz", @@ -1595,37 +1411,6 @@ "qified": "^0.10.1" } }, - "node_modules/call-bind-apply-helpers": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz", - "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "es-errors": "^1.3.0", - "function-bind": "^1.1.2" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/call-bound": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz", - "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==", - "dev": true, - "license": "MIT", - "dependencies": { - "call-bind-apply-helpers": "^1.0.2", - "get-intrinsic": "^1.3.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, "node_modules/caniuse-lite": { "version": "1.0.30001810", "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz", @@ -1648,16 +1433,6 @@ "license": "CC-BY-4.0", "peer": true }, - "node_modules/character-parser": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/character-parser/-/character-parser-2.2.0.tgz", - "integrity": "sha512-+UqJQjFEFaTAs3bNsF2j2kEN1baG/zghZbdqoYEDxGZtJo9LBzl1A+m0D4n3qKx8N2FNv8/Xp6yV9mQmBuptaw==", - "dev": true, - "license": "MIT", - "dependencies": { - "is-regex": "^1.0.3" - } - }, "node_modules/chownr": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz", @@ -1675,32 +1450,6 @@ "dev": true, "license": "MIT" }, - "node_modules/cli-table3": { - "version": "0.6.5", - "resolved": "https://registry.npmjs.org/cli-table3/-/cli-table3-0.6.5.tgz", - "integrity": "sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "string-width": "^4.2.0" - }, - "engines": { - "node": "10.* || >= 12.*" - }, - "optionalDependencies": { - "@colors/colors": "1.5.0" - } - }, - "node_modules/colors": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/colors/-/colors-1.4.0.tgz", - "integrity": "sha512-a+UqTh4kgZg/SlGvfbzDHpgRu7AAQOmmqRHJnxhRZICKFUT91brVhNNt58CMWU9PsBbv3PDCZUHbVxuDiH2mtA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.1.90" - } - }, "node_modules/commander": { "version": "15.0.0", "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz", @@ -1711,67 +1460,6 @@ "node": ">=22.12.0" } }, - "node_modules/constantinople": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/constantinople/-/constantinople-4.0.1.tgz", - "integrity": "sha512-vCrqcSIq4//Gx74TXXCGnHpulY1dskqLTFGDmhrGxzeXL8lF8kvXv6mpNWlJj1uD4DW23D4ljAqbY4RRaaUZIw==", - "dev": true, - "license": "MIT", - "dependencies": { - "@babel/parser": "^7.6.0", - "@babel/types": "^7.6.1" - } - }, - "node_modules/constantinople/node_modules/@babel/helper-string-parser": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz", - "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/constantinople/node_modules/@babel/helper-validator-identifier": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz", - "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/constantinople/node_modules/@babel/parser": { - "version": "7.29.9", - "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.9.tgz", - "integrity": "sha512-CjXrNHTnvqBVqHgdBysY3vk2T8tpJHb5/RMeHJBTyVa9xgugCB0CJTx/3oO8RV2QRQP391RWpB7D6hLjm8V9uA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@babel/types": "^7.29.8" - }, - "bin": { - "parser": "bin/babel-parser.js" - }, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/constantinople/node_modules/@babel/types": { - "version": "7.29.8", - "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz", - "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@babel/helper-string-parser": "^7.29.7", - "@babel/helper-validator-identifier": "^7.29.7" - }, - "engines": { - "node": ">=6.9.0" - } - }, "node_modules/convert-source-map": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz", @@ -1820,28 +1508,6 @@ "dev": true, "license": "MIT" }, - "node_modules/doctypes": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/doctypes/-/doctypes-1.1.0.tgz", - "integrity": "sha512-LLBi6pEqS6Do3EKQ3J0NqHWV5hhb78Pi8vvESYwyOy2c31ZEZVdtitdzsQsKb7878PEERhzUk0ftqGhG6Mz+pQ==", - "dev": true, - "license": "MIT" - }, - "node_modules/dunder-proto": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", - "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", - "dev": true, - "license": "MIT", - "dependencies": { - "call-bind-apply-helpers": "^1.0.1", - "es-errors": "^1.3.0", - "gopd": "^1.2.0" - }, - "engines": { - "node": ">= 0.4" - } - }, "node_modules/electron-to-chromium": { "version": "1.5.434", "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.434.tgz", @@ -1850,13 +1516,6 @@ "license": "ISC", "peer": true }, - "node_modules/emoji-regex": { - "version": "8.0.0", - "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz", - "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==", - "dev": true, - "license": "MIT" - }, "node_modules/empathic": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.1.0.tgz", @@ -1868,36 +1527,6 @@ "node": ">=14" } }, - "node_modules/end-of-stream": { - "version": "1.4.5", - "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz", - "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==", - "dev": true, - "license": "MIT", - "dependencies": { - "once": "^1.4.0" - } - }, - "node_modules/es-define-property": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz", - "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/es-errors": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", - "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 0.4" - } - }, "node_modules/es-module-lexer": { "version": "3.0.2", "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-3.0.2.tgz", @@ -1905,19 +1534,6 @@ "dev": true, "license": "MIT" }, - "node_modules/es-object-atoms": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz", - "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==", - "dev": true, - "license": "MIT", - "dependencies": { - "es-errors": "^1.3.0" - }, - "engines": { - "node": ">= 0.4" - } - }, "node_modules/escalade": { "version": "3.2.0", "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz", @@ -1943,9 +1559,9 @@ } }, "node_modules/eslint": { - "version": "10.11.0", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.11.0.tgz", - "integrity": "sha512-P7a6UEEqb9G95MYAtqkmsTbVXIYyzIfl6NGOIJk162PaahFxFyeGcrlXYFSiagECg4sEm8IseJdZBKR3rx6MsQ==", + "version": "10.12.0", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.12.0.tgz", + "integrity": "sha512-npHjrHb2o4ehH3mE+YuxABR+0gyb0aVWCIolgJDArwCiHEIsonBm3ZKjel5b0U5+a+MbEvIyRCGCzD3eKKK2NA==", "dev": true, "license": "MIT", "workspaces": [ @@ -2110,37 +1726,6 @@ "node": ">=0.10.0" } }, - "node_modules/eventemitter3": { - "version": "5.0.4", - "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz", - "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==", - "dev": true, - "license": "MIT" - }, - "node_modules/execa": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/execa/-/execa-4.1.0.tgz", - "integrity": "sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==", - "dev": true, - "license": "MIT", - "dependencies": { - "cross-spawn": "^7.0.0", - "get-stream": "^5.0.0", - "human-signals": "^1.1.1", - "is-stream": "^2.0.0", - "merge-stream": "^2.0.0", - "npm-run-path": "^4.0.0", - "onetime": "^5.1.0", - "signal-exit": "^3.0.2", - "strip-final-newline": "^2.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sindresorhus/execa?sponsor=1" - } - }, "node_modules/fast-deep-equal": { "version": "3.1.3", "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", @@ -2266,31 +1851,6 @@ "node": ">=6" } }, - "node_modules/fs-extra": { - "version": "11.4.0", - "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.0.tgz", - "integrity": "sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA==", - "dev": true, - "license": "MIT", - "dependencies": { - "graceful-fs": "^4.2.0", - "jsonfile": "^6.0.1", - "universalify": "^2.0.0" - }, - "engines": { - "node": ">=14.14" - } - }, - "node_modules/function-bind": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", - "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", - "dev": true, - "license": "MIT", - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, "node_modules/gensync": { "version": "1.0.0-beta.2", "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz", @@ -2302,147 +1862,30 @@ "node": ">=6.9.0" } }, - "node_modules/get-intrinsic": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz", - "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==", + "node_modules/glob-parent": { + "version": "5.1.2", + "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", + "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", "dev": true, - "license": "MIT", + "license": "ISC", "dependencies": { - "call-bind-apply-helpers": "^1.0.2", - "es-define-property": "^1.0.1", - "es-errors": "^1.3.0", - "es-object-atoms": "^1.1.1", - "function-bind": "^1.1.2", - "get-proto": "^1.0.1", - "gopd": "^1.2.0", - "has-symbols": "^1.1.0", - "hasown": "^2.0.2", - "math-intrinsics": "^1.1.0" + "is-glob": "^4.0.1" }, "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" + "node": ">= 6" } }, - "node_modules/get-proto": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz", - "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==", + "node_modules/hashery": { + "version": "1.5.1", + "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz", + "integrity": "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==", "dev": true, "license": "MIT", "dependencies": { - "dunder-proto": "^1.0.1", - "es-object-atoms": "^1.0.0" + "hookified": "^1.15.0" }, "engines": { - "node": ">= 0.4" - } - }, - "node_modules/get-stream": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-5.2.0.tgz", - "integrity": "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==", - "dev": true, - "license": "MIT", - "dependencies": { - "pump": "^3.0.0" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/glob-parent": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", - "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", - "dev": true, - "license": "ISC", - "dependencies": { - "is-glob": "^4.0.1" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/gopd": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz", - "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/graceful-fs": { - "version": "4.2.11", - "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz", - "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==", - "dev": true, - "license": "ISC" - }, - "node_modules/has-symbols": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz", - "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-tostringtag": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz", - "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==", - "dev": true, - "license": "MIT", - "dependencies": { - "has-symbols": "^1.0.3" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/hashery": { - "version": "1.5.1", - "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz", - "integrity": "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "hookified": "^1.15.0" - }, - "engines": { - "node": ">=20" - } - }, - "node_modules/hasown": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz", - "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==", - "dev": true, - "license": "MIT", - "dependencies": { - "function-bind": "^1.1.2" - }, - "engines": { - "node": ">= 0.4" + "node": ">=20" } }, "node_modules/hookified": { @@ -2465,16 +1908,6 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/human-signals": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-1.1.1.tgz", - "integrity": "sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==", - "dev": true, - "license": "Apache-2.0", - "engines": { - "node": ">=8.12.0" - } - }, "node_modules/ignore": { "version": "5.3.2", "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz", @@ -2522,46 +1955,6 @@ "node": ">=0.8.19" } }, - "node_modules/is-core-module": { - "version": "2.17.0", - "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.17.0.tgz", - "integrity": "sha512-J/vG0zBCbIKOQFfufSwyXdMrsohyJIUNkrnmo6WZGzoM7tr/lsbfW5b2BvisL6zsyMzK9UxV9L6c7AoFbyXHOA==", - "dev": true, - "license": "MIT", - "dependencies": { - "hasown": "^2.0.4" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-expression": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/is-expression/-/is-expression-4.0.0.tgz", - "integrity": "sha512-zMIXX63sxzG3XrkHkrAPvm/OVZVSCPNkwMHU8oTX7/U3AL78I0QXCEICXUM13BIa8TYGZ68PiTKfQz3yaTNr4A==", - "dev": true, - "license": "MIT", - "dependencies": { - "acorn": "^7.1.1", - "object-assign": "^4.1.1" - } - }, - "node_modules/is-expression/node_modules/acorn": { - "version": "7.4.1", - "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz", - "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==", - "dev": true, - "license": "MIT", - "bin": { - "acorn": "bin/acorn" - }, - "engines": { - "node": ">=0.4.0" - } - }, "node_modules/is-extglob": { "version": "2.1.1", "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz", @@ -2572,16 +1965,6 @@ "node": ">=0.10.0" } }, - "node_modules/is-fullwidth-code-point": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz", - "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - } - }, "node_modules/is-glob": { "version": "4.0.3", "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz", @@ -2605,99 +1988,170 @@ "node": ">=0.12.0" } }, - "node_modules/is-promise": { - "version": "2.2.2", - "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-2.2.2.tgz", - "integrity": "sha512-+lP4/6lKUBfQjZ2pdxThZvLUAafmZb8OAxFb8XXtiQmS35INgr85hdOGoEs124ez1FCnZJt6jau/T+alh58QFQ==", + "node_modules/isexe": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz", + "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==", "dev": true, - "license": "MIT" + "license": "ISC" }, - "node_modules/is-regex": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.2.1.tgz", - "integrity": "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==", + "node_modules/js-tokens": { + "version": "10.0.0", + "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz", + "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==", "dev": true, "license": "MIT", - "dependencies": { - "call-bound": "^1.0.2", - "gopd": "^1.2.0", - "has-tostringtag": "^1.0.2", - "hasown": "^2.0.2" + "peer": true + }, + "node_modules/jscpd": { + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd/-/jscpd-5.4.0.tgz", + "integrity": "sha512-6mU8OHff4rPJ3D5lIsQns82/aQhDas22gMsGurHx1wcrfXWOZDNaobi6rKhLevo+77ntWKUXOwtM6lcrkJeL7w==", + "dev": true, + "license": "MIT", + "bin": { + "jscpd": "run-jscpd.js" }, "engines": { - "node": ">= 0.4" + "node": ">=18" }, "funding": { - "url": "https://github.com/sponsors/ljharb" - } + "url": "https://opencollective.com/jscpd" + }, + "optionalDependencies": { + "jscpd-darwin-arm64": "5.4.0", + "jscpd-darwin-x64": "5.4.0", + "jscpd-linux-arm64-gnu": "5.4.0", + "jscpd-linux-arm64-musl": "5.4.0", + "jscpd-linux-x64-gnu": "5.4.0", + "jscpd-linux-x64-musl": "5.4.0", + "jscpd-windows-arm64-msvc": "5.4.0", + "jscpd-windows-x64-msvc": "5.4.0" + } + }, + "node_modules/jscpd-darwin-arm64": { + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-darwin-arm64/-/jscpd-darwin-arm64-5.4.0.tgz", + "integrity": "sha512-fNIDtNn9WE4YXoFoqf+3tkHb1+GaKKOeKzh77Wx61Gfa9iDxlCv5rO0Fjy7oWmGehUUKqslDaeXXtn/RoDprCg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ] }, - "node_modules/is-stream": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz", - "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==", + "node_modules/jscpd-darwin-x64": { + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-darwin-x64/-/jscpd-darwin-x64-5.4.0.tgz", + "integrity": "sha512-bxlnCVEb69SGIsas1+PaqZyFY8iYVTVjCBxfjVD74UafX115Ysw+oO9LAlsJaGsKUnK8Zsq5bhM33kBHux6bTA==", + "cpu": [ + "x64" + ], "dev": true, "license": "MIT", - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } + "optional": true, + "os": [ + "darwin" + ] }, - "node_modules/isexe": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz", - "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==", + "node_modules/jscpd-linux-arm64-gnu": { + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-gnu/-/jscpd-linux-arm64-gnu-5.4.0.tgz", + "integrity": "sha512-c4hX5QjuRyzLFJ+A+jNGHRpGlDvxcx+zzs4RJmZHpl23istuTMIkelwTOWliF4gXOm0RWXDlX/ywWKr9+Lre7w==", + "cpu": [ + "arm64" + ], "dev": true, - "license": "ISC" + "libc": [ + "glibc" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ] }, - "node_modules/js-stringify": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/js-stringify/-/js-stringify-1.0.2.tgz", - "integrity": "sha512-rtS5ATOo2Q5k1G+DADISilDA6lv79zIiwFd6CcjuIxGKLFm5C+RLImRscVap9k55i+MOZwgliw+NejvkLuGD5g==", + "node_modules/jscpd-linux-arm64-musl": { + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-musl/-/jscpd-linux-arm64-musl-5.4.0.tgz", + "integrity": "sha512-p4FUCNyL8WPTlizdZqfjontFwJ/+jnERYM2+YX2miYvm0NxzsIi23MhfzPl/eUHxkiT5wethV0NRYEAkJr999Q==", + "cpu": [ + "arm64" + ], "dev": true, - "license": "MIT" + "libc": [ + "musl" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ] }, - "node_modules/js-tokens": { - "version": "10.0.0", - "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz", - "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==", + "node_modules/jscpd-linux-x64-gnu": { + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-x64-gnu/-/jscpd-linux-x64-gnu-5.4.0.tgz", + "integrity": "sha512-44NXS0gtYbjBCc53Gwilgj7PPwnWv9YTF/rGc0ZfnFcpzSoOKKU11yH+qHfCVie1hHte1wHyZ1f9Kjc8nGe2/g==", + "cpu": [ + "x64" + ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", - "peer": true + "optional": true, + "os": [ + "linux" + ] }, - "node_modules/jscpd": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/jscpd/-/jscpd-4.3.0.tgz", - "integrity": "sha512-yUqcHy/USHvzFamS6Loo49MCSW0Dc+4RL6ELH+Un9o2/jRSQbs9+a5hjfFceV2d3Zgv1opv5PXJ0eZ3fEQdjkg==", + "node_modules/jscpd-linux-x64-musl": { + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-x64-musl/-/jscpd-linux-x64-musl-5.4.0.tgz", + "integrity": "sha512-m9XHj14Zwia9RjWDkHDrl6VJ3W/b7m8qjFqjhcJ668Vkxoj4Ri/qeo0bo6is+fSw+bYxYexV6xxqIKRDolc8Lg==", + "cpu": [ + "x64" + ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", - "dependencies": { - "@jscpd/badge-reporter": "4.2.5", - "@jscpd/core": "4.2.5", - "@jscpd/finder": "4.3.0", - "@jscpd/html-reporter": "4.2.5", - "@jscpd/tokenizer": "4.2.6", - "colors": "^1.4.0", - "commander": "^15.0.0", - "fs-extra": "^11.3.6", - "jscpd-sarif-reporter": "4.2.5" - }, - "bin": { - "jscpd": "bin/jscpd" - } + "optional": true, + "os": [ + "linux" + ] }, - "node_modules/jscpd-sarif-reporter": { - "version": "4.2.5", - "resolved": "https://registry.npmjs.org/jscpd-sarif-reporter/-/jscpd-sarif-reporter-4.2.5.tgz", - "integrity": "sha512-O8LcM9grAS5yO5x1Q0yegYaYcUX//IEBEyvzGFSYCeo1YzHbMnAI6EK7oTrwD+7Csjvfg9m8B8G7OOxzcSlr9w==", + "node_modules/jscpd-windows-arm64-msvc": { + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-windows-arm64-msvc/-/jscpd-windows-arm64-msvc-5.4.0.tgz", + "integrity": "sha512-AoP5RXyb9gIf8xmFwAc+Rgh4XJNyX1upcD+R1A6u4XjsDo2/oF+KKB4dtKnG2DbFQ+0fyFg/ClOcw+asQZJfPg==", + "cpu": [ + "arm64" + ], "dev": true, "license": "MIT", - "dependencies": { - "colors": "^1.4.0", - "fs-extra": "^11.2.0", - "node-sarif-builder": "^4.1.0" - } + "optional": true, + "os": [ + "win32" + ] + }, + "node_modules/jscpd-windows-x64-msvc": { + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-windows-x64-msvc/-/jscpd-windows-x64-msvc-5.4.0.tgz", + "integrity": "sha512-dYkb5mAo5i7fjrtf2Ft6z9a/I38RJMd4JirEgJiW2BIv5pAGmfMVPDy1xEXL3hJqraXzeMIfnzqJFanefCyC6g==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "win32" + ] }, "node_modules/jsesc": { "version": "3.1.0", @@ -2741,30 +2195,6 @@ "node": ">=6" } }, - "node_modules/jsonfile": { - "version": "6.2.1", - "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz", - "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==", - "dev": true, - "license": "MIT", - "dependencies": { - "universalify": "^2.0.0" - }, - "optionalDependencies": { - "graceful-fs": "^4.1.6" - } - }, - "node_modules/jstransformer": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/jstransformer/-/jstransformer-1.0.0.tgz", - "integrity": "sha512-C9YK3Rf8q6VAPDCCU9fnqo3mAfOH6vUGnMcP4AQAYIEpWtfGLpwOTmZ+igtdK5y+VvI2n3CyYSzy4Qh34eq24A==", - "dev": true, - "license": "MIT", - "dependencies": { - "is-promise": "^2.0.0", - "promise": "^7.0.1" - } - }, "node_modules/keyv": { "version": "5.6.0", "resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz", @@ -2815,37 +2245,6 @@ "node": "20 || >=22" } }, - "node_modules/markdown-table": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/markdown-table/-/markdown-table-2.0.0.tgz", - "integrity": "sha512-Ezda85ToJUBhM6WGaG6veasyym+Tbs3cMAw/ZhOPqXiYsr0jgocBV3j3nx+4lk47plLlIqjwuTm/ywVI+zjJ/A==", - "dev": true, - "license": "MIT", - "dependencies": { - "repeat-string": "^1.0.0" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/math-intrinsics": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", - "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/merge-stream": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz", - "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==", - "dev": true, - "license": "MIT" - }, "node_modules/merge2": { "version": "1.4.1", "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz", @@ -2870,16 +2269,6 @@ "node": ">=8.6" } }, - "node_modules/mimic-fn": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz", - "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6" - } - }, "node_modules/minimatch": { "version": "10.2.6", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", @@ -2951,20 +2340,6 @@ "node": ">=18" } }, - "node_modules/node-sarif-builder": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/node-sarif-builder/-/node-sarif-builder-4.1.0.tgz", - "integrity": "sha512-IWqZF6u0EI/07HTBm+zZ+MgXgWl09dnSJRGaDCPBSlOqilDcx6pj3Mpb3HvPN8V2Gr+ISw7ZrMsL7STWs1F++w==", - "dev": true, - "license": "MIT", - "dependencies": { - "@types/sarif": "^2.1.7", - "fs-extra": "^11.1.1" - }, - "engines": { - "node": ">=20" - } - }, "node_modules/npm-package-arg": { "version": "13.0.2", "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-13.0.2.tgz", @@ -2981,29 +2356,6 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/npm-run-path": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz", - "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==", - "dev": true, - "license": "MIT", - "dependencies": { - "path-key": "^3.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/object-assign": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz", - "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/obug": { "version": "2.2.1", "resolved": "https://registry.npmjs.org/obug/-/obug-2.2.1.tgz", @@ -3019,32 +2371,6 @@ "node": ">=12.20.0" } }, - "node_modules/once": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz", - "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==", - "dev": true, - "license": "ISC", - "dependencies": { - "wrappy": "1" - } - }, - "node_modules/onetime": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz", - "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==", - "dev": true, - "license": "MIT", - "dependencies": { - "mimic-fn": "^2.1.0" - }, - "engines": { - "node": ">=6" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, "node_modules/optionator": { "version": "0.9.4", "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz", @@ -3115,13 +2441,6 @@ "node": ">=8" } }, - "node_modules/path-parse": { - "version": "1.0.7", - "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz", - "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==", - "dev": true, - "license": "MIT" - }, "node_modules/picocolors": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", @@ -3144,9 +2463,9 @@ } }, "node_modules/pm-changelog": { - "version": "2026.9.25", - "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.25.tgz", - "integrity": "sha512-j2l97jlJIfuMiB7KDi7oIr9MWxdQvqnDx/JwE3pxC31fDw3MywnSmaTcE9/gV6sVlZbQkOSxnxooHzDwRo+1+g==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.10.4.tgz", + "integrity": "sha512-YJJHJYv2i+olzGVF+qdab3wWG6auiRVIvf7TZD4ZdUhE/8lIawf3aYOOZZVJHogN8xP8rNUlVV9Lc1OXKLlQ7w==", "dev": true, "license": "MIT", "bin": { @@ -3160,9 +2479,9 @@ } }, "node_modules/pm-ops": { - "version": "2026.9.29", - "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.9.29.tgz", - "integrity": "sha512-lJYQY505S2DtfureWYDtd7z4yzgH9a7b8boDidG3Q0J3W0L5gb5mBXHP/yXotPEVKsysQk7cgktDwP/ODOQTUA==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.10.4.tgz", + "integrity": "sha512-/6ehQBNwKquIol3EUW1r4pZSXKaohHc1gXJUSk7cqQwkVJOSlP8cCcHzNFH76/6O9hG04Eb5KAH90vFkhTxfMQ==", "dev": true, "license": "MIT", "dependencies": { @@ -3218,163 +2537,6 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/promise": { - "version": "7.3.1", - "resolved": "https://registry.npmjs.org/promise/-/promise-7.3.1.tgz", - "integrity": "sha512-nolQXZ/4L+bP/UGlkfaIujX9BKxGwmQ9OT4mOt5yvy8iK1h3wqTEJCijzGANTCCl9nWjY41juyAn2K3Q1hLLTg==", - "dev": true, - "license": "MIT", - "dependencies": { - "asap": "~2.0.3" - } - }, - "node_modules/pug": { - "version": "3.0.4", - "resolved": "https://registry.npmjs.org/pug/-/pug-3.0.4.tgz", - "integrity": "sha512-kFfq5mMzrS7+wrl5pLJzZEzemx34OQ0w4SARfhy/3yxTlhbstsudDwJzhf1hP02yHzbjoVMSXUj/Sz6RNfMyXg==", - "dev": true, - "license": "MIT", - "dependencies": { - "pug-code-gen": "^3.0.4", - "pug-filters": "^4.0.0", - "pug-lexer": "^5.0.1", - "pug-linker": "^4.0.0", - "pug-load": "^3.0.0", - "pug-parser": "^6.0.0", - "pug-runtime": "^3.0.1", - "pug-strip-comments": "^2.0.0" - } - }, - "node_modules/pug-attrs": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/pug-attrs/-/pug-attrs-3.0.0.tgz", - "integrity": "sha512-azINV9dUtzPMFQktvTXciNAfAuVh/L/JCl0vtPCwvOA21uZrC08K/UnmrL+SXGEVc1FwzjW62+xw5S/uaLj6cA==", - "dev": true, - "license": "MIT", - "dependencies": { - "constantinople": "^4.0.1", - "js-stringify": "^1.0.2", - "pug-runtime": "^3.0.0" - } - }, - "node_modules/pug-code-gen": { - "version": "3.0.4", - "resolved": "https://registry.npmjs.org/pug-code-gen/-/pug-code-gen-3.0.4.tgz", - "integrity": "sha512-6okWYIKdasTyXICyEtvobmTZAVX57JkzgzIi4iRJlin8kmhG+Xry2dsus+Mun/nGCn6F2U49haHI5mkELXB14g==", - "dev": true, - "license": "MIT", - "dependencies": { - "constantinople": "^4.0.1", - "doctypes": "^1.1.0", - "js-stringify": "^1.0.2", - "pug-attrs": "^3.0.0", - "pug-error": "^2.1.0", - "pug-runtime": "^3.0.1", - "void-elements": "^3.1.0", - "with": "^7.0.0" - } - }, - "node_modules/pug-error": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/pug-error/-/pug-error-2.1.0.tgz", - "integrity": "sha512-lv7sU9e5Jk8IeUheHata6/UThZ7RK2jnaaNztxfPYUY+VxZyk/ePVaNZ/vwmH8WqGvDz3LrNYt/+gA55NDg6Pg==", - "dev": true, - "license": "MIT" - }, - "node_modules/pug-filters": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/pug-filters/-/pug-filters-4.0.0.tgz", - "integrity": "sha512-yeNFtq5Yxmfz0f9z2rMXGw/8/4i1cCFecw/Q7+D0V2DdtII5UvqE12VaZ2AY7ri6o5RNXiweGH79OCq+2RQU4A==", - "dev": true, - "license": "MIT", - "dependencies": { - "constantinople": "^4.0.1", - "jstransformer": "1.0.0", - "pug-error": "^2.0.0", - "pug-walk": "^2.0.0", - "resolve": "^1.15.1" - } - }, - "node_modules/pug-lexer": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/pug-lexer/-/pug-lexer-5.0.1.tgz", - "integrity": "sha512-0I6C62+keXlZPZkOJeVam9aBLVP2EnbeDw3An+k0/QlqdwH6rv8284nko14Na7c0TtqtogfWXcRoFE4O4Ff20w==", - "dev": true, - "license": "MIT", - "dependencies": { - "character-parser": "^2.2.0", - "is-expression": "^4.0.0", - "pug-error": "^2.0.0" - } - }, - "node_modules/pug-linker": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/pug-linker/-/pug-linker-4.0.0.tgz", - "integrity": "sha512-gjD1yzp0yxbQqnzBAdlhbgoJL5qIFJw78juN1NpTLt/mfPJ5VgC4BvkoD3G23qKzJtIIXBbcCt6FioLSFLOHdw==", - "dev": true, - "license": "MIT", - "dependencies": { - "pug-error": "^2.0.0", - "pug-walk": "^2.0.0" - } - }, - "node_modules/pug-load": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/pug-load/-/pug-load-3.0.0.tgz", - "integrity": "sha512-OCjTEnhLWZBvS4zni/WUMjH2YSUosnsmjGBB1An7CsKQarYSWQ0GCVyd4eQPMFJqZ8w9xgs01QdiZXKVjk92EQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "object-assign": "^4.1.1", - "pug-walk": "^2.0.0" - } - }, - "node_modules/pug-parser": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/pug-parser/-/pug-parser-6.0.0.tgz", - "integrity": "sha512-ukiYM/9cH6Cml+AOl5kETtM9NR3WulyVP2y4HOU45DyMim1IeP/OOiyEWRr6qk5I5klpsBnbuHpwKmTx6WURnw==", - "dev": true, - "license": "MIT", - "dependencies": { - "pug-error": "^2.0.0", - "token-stream": "1.0.0" - } - }, - "node_modules/pug-runtime": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/pug-runtime/-/pug-runtime-3.0.1.tgz", - "integrity": "sha512-L50zbvrQ35TkpHwv0G6aLSuueDRwc/97XdY8kL3tOT0FmhgG7UypU3VztfV/LATAvmUfYi4wNxSajhSAeNN+Kg==", - "dev": true, - "license": "MIT" - }, - "node_modules/pug-strip-comments": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/pug-strip-comments/-/pug-strip-comments-2.0.0.tgz", - "integrity": "sha512-zo8DsDpH7eTkPHCXFeAk1xZXJbyoTfdPlNR0bK7rpOMuhBYb0f5qUVCO1xlsitYd3w5FQTK7zpNVKb3rZoUrrQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "pug-error": "^2.0.0" - } - }, - "node_modules/pug-walk": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/pug-walk/-/pug-walk-2.0.0.tgz", - "integrity": "sha512-yYELe9Q5q9IQhuvqsZNwA5hfPkMJ8u92bQLIMcsMxf/VADjNtEYptU+inlufAFYcWdHlwNfZOEnOOQrZrcyJCQ==", - "dev": true, - "license": "MIT" - }, - "node_modules/pump": { - "version": "3.0.4", - "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz", - "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==", - "dev": true, - "license": "MIT", - "dependencies": { - "end-of-stream": "^1.1.0", - "once": "^1.3.1" - } - }, "node_modules/punycode": { "version": "2.3.1", "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz", @@ -3426,16 +2588,6 @@ ], "license": "MIT" }, - "node_modules/repeat-string": { - "version": "1.6.1", - "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz", - "integrity": "sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10" - } - }, "node_modules/require-in-the-middle": { "version": "8.0.1", "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz", @@ -3450,28 +2602,6 @@ "node": ">=9.3.0 || >=8.10.0 <9.0.0" } }, - "node_modules/resolve": { - "version": "1.22.12", - "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz", - "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==", - "dev": true, - "license": "MIT", - "dependencies": { - "es-errors": "^1.3.0", - "is-core-module": "^2.16.1", - "path-parse": "^1.0.7", - "supports-preserve-symlinks-flag": "^1.0.0" - }, - "bin": { - "resolve": "bin/resolve" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, "node_modules/reusify": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz", @@ -3543,86 +2673,69 @@ "node": ">=8" } }, - "node_modules/signal-exit": { - "version": "3.0.7", - "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz", - "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==", - "dev": true, - "license": "ISC" - }, - "node_modules/spark-md5": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/spark-md5/-/spark-md5-3.0.2.tgz", - "integrity": "sha512-wcFzz9cDfbuqe0FZzfi2or1sgyIrsDwmPwfZC4hiNidPdPINjeUwNfv5kldczoEAcjl9Y1L3SM7Uz2PUEQzxQw==", - "dev": true, - "license": "(WTFPL OR MIT)" - }, - "node_modules/string-width": { - "version": "4.2.3", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", - "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", + "node_modules/tar": { + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "dev": true, - "license": "MIT", + "license": "BlueOak-1.0.0", "dependencies": { - "emoji-regex": "^8.0.0", - "is-fullwidth-code-point": "^3.0.0", - "strip-ansi": "^6.0.1" + "@isaacs/fs-minipass": "^4.0.0", + "chownr": "^3.0.0", + "minipass": "^7.1.2", + "minizlib": "^3.1.0", + "yallist": "^5.0.0" }, "engines": { - "node": ">=8" + "node": ">=18" } }, - "node_modules/strip-ansi": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz", - "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==", + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", "dev": true, "license": "MIT", "dependencies": { - "ansi-regex": "^5.0.1" + "fdir": "^6.5.0", + "picomatch": "^4.0.4" }, "engines": { - "node": ">=8" + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" } }, - "node_modules/strip-final-newline": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz", - "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==", + "node_modules/tinyglobby/node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", "dev": true, "license": "MIT", "engines": { - "node": ">=6" + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } } }, - "node_modules/supports-preserve-symlinks-flag": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz", - "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==", + "node_modules/tinyglobby/node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", "dev": true, "license": "MIT", "engines": { - "node": ">= 0.4" + "node": ">=12" }, "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/tar": { - "version": "7.5.22", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", - "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", - "dev": true, - "license": "BlueOak-1.0.0", - "dependencies": { - "@isaacs/fs-minipass": "^4.0.0", - "chownr": "^3.0.0", - "minipass": "^7.1.2", - "minizlib": "^3.1.0", - "yallist": "^5.0.0" - }, - "engines": { - "node": ">=18" + "url": "https://github.com/sponsors/jonschlinkert" } }, "node_modules/to-regex-range": { @@ -3638,13 +2751,6 @@ "node": ">=8.0" } }, - "node_modules/token-stream": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/token-stream/-/token-stream-1.0.0.tgz", - "integrity": "sha512-VSsyNPPW74RpHwR8Fc21uubwHY7wMDeJLys2IX5zJNih+OnAnaifKHo+1LHT7DAdloQ7apeaaWg8l7qnf/TnEg==", - "dev": true, - "license": "MIT" - }, "node_modules/type-check": { "version": "0.4.0", "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz", @@ -3700,16 +2806,6 @@ "dev": true, "license": "MIT" }, - "node_modules/universalify": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz", - "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 10.0.0" - } - }, "node_modules/update-browserslist-db": { "version": "1.3.3", "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.3.tgz", @@ -3775,16 +2871,6 @@ "url": "https://github.com/sponsors/sxzz" } }, - "node_modules/void-elements": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/void-elements/-/void-elements-3.1.0.tgz", - "integrity": "sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/which": { "version": "2.0.2", "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz", @@ -3801,72 +2887,6 @@ "node": ">= 8" } }, - "node_modules/with": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/with/-/with-7.0.2.tgz", - "integrity": "sha512-RNGKj82nUPg3g5ygxkQl0R937xLyho1J24ItRCBTr/m1YnZkzJy1hUiHUJrc/VlsDQzsCnInEGSg3bci0Lmd4w==", - "dev": true, - "license": "MIT", - "dependencies": { - "@babel/parser": "^7.9.6", - "@babel/types": "^7.9.6", - "assert-never": "^1.2.1", - "babel-walk": "3.0.0-canary-5" - }, - "engines": { - "node": ">= 10.0.0" - } - }, - "node_modules/with/node_modules/@babel/helper-string-parser": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz", - "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/with/node_modules/@babel/helper-validator-identifier": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz", - "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/with/node_modules/@babel/parser": { - "version": "7.29.9", - "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.9.tgz", - "integrity": "sha512-CjXrNHTnvqBVqHgdBysY3vk2T8tpJHb5/RMeHJBTyVa9xgugCB0CJTx/3oO8RV2QRQP391RWpB7D6hLjm8V9uA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@babel/types": "^7.29.8" - }, - "bin": { - "parser": "bin/babel-parser.js" - }, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/with/node_modules/@babel/types": { - "version": "7.29.8", - "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz", - "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@babel/helper-string-parser": "^7.29.7", - "@babel/helper-validator-identifier": "^7.29.7" - }, - "engines": { - "node": ">=6.9.0" - } - }, "node_modules/word-wrap": { "version": "1.2.5", "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz", @@ -3877,13 +2897,6 @@ "node": ">=0.10.0" } }, - "node_modules/wrappy": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz", - "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==", - "dev": true, - "license": "ISC" - }, "node_modules/yallist": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz", diff --git a/package.json b/package.json index 417c7a8..44389be 100644 --- a/package.json +++ b/package.json @@ -47,16 +47,16 @@ "@unbrained/pm-cli": ">=2026.8.7" }, "devDependencies": { - "@babel/eslint-parser": "^8.0.5", - "@babel/plugin-syntax-typescript": "^8.0.3", - "@types/node": "^26.2.0", - "@unbrained/pm-cli": "2026.9.29", - "eslint": "^10.10.0", - "fast-glob": "^3.3.3", - "jscpd": "^4.3.0", - "pm-changelog": "2026.9.25", - "pm-ops": "2026.9.29", - "typescript": "^7.0.2" + "@babel/eslint-parser": "8.0.6", + "@babel/plugin-syntax-typescript": "8.0.3", + "@types/node": "26.6.4", + "@unbrained/pm-cli": "2026.10.4", + "eslint": "10.12.0", + "fast-glob": "3.3.3", + "jscpd": "5.4.0", + "pm-changelog": "2026.10.4", + "pm-ops": "2026.10.4", + "typescript": "7.0.2" }, "keywords": [ "extension", @@ -112,7 +112,8 @@ ".", "scripts/coverage-gate.ts", "scripts/prepare-merge-driver.ts", - "scripts/docstring-gate.ts" + "scripts/docstring-gate.ts", + "scripts/main-invocation.ts" ], "tests": [ "test/*.test.ts" diff --git a/scripts/docstring-gate.ts b/scripts/docstring-gate.ts index b0c73b0..9e8dab4 100644 --- a/scripts/docstring-gate.ts +++ b/scripts/docstring-gate.ts @@ -22,9 +22,9 @@ * ``` */ -import { realpathSync } from "node:fs"; import { resolve } from "node:path"; -import { fileURLToPath } from "node:url"; +import { isMainInvocation } from "./main-invocation.ts"; +export { isMainInvocation } from "./main-invocation.ts"; import { analyzeDocstringCoverage } from "pm-ops/docstrings"; @@ -110,45 +110,7 @@ export function main(args: readonly string[]): void { process.exitCode = result.exitCode; } -/** - * Whether this module is the process entry point rather than a test import. - * - * Both sides are canonicalised through `realpathSync` before comparison. A - * launcher reaching this file through a symlink (an npm bin shim, a linked - * workspace) would otherwise compare unequal and skip the gate silently. - * - * Resolving only `argv[1]` would be enough under Node's defaults, where the - * ESM loader realpaths a module before recording `import.meta.url`. It is not - * enough under `--preserve-symlinks`/`--preserve-symlinks-main`, which leave - * `moduleUrl` holding the symlink while `realpathSync(entry)` resolves it. - * The two would then compare unequal on a direct invocation and the gate would - * exit 0 without scanning — the exact silent skip this function exists to - * prevent, reintroduced by a runtime flag. Canonicalising both sides adds a - * second `realpathSync` and removes the dependence on how Node was launched. - * - * An unresolvable `argv[1]` **propagates** rather than returning false. The two - * outcomes are not equally safe: returning false means `npm run docstring` - * exits 0 having scanned nothing, which is a required release check reporting - * success without doing its job — the one failure this gate exists to prevent. - * Letting `realpathSync` throw turns that into a loud non-zero exit. The case - * requires `argv[1]` to stop resolving after Node has already loaded this file, - * so in practice it means the environment is broken, and a broken environment - * must not silently satisfy a gate. - * - * A genuinely different entry path still returns false, which is how a test - * importing this module declines to run the gate. - * - * @param argv - The process argv to inspect. - * @param moduleUrl - The `import.meta.url` of the module that might be main. - * @returns True when `argv[1]` and `moduleUrl` canonicalise to the same path, - * false when they canonicalise to different ones. - * @throws Whatever `realpathSync` throws when either path cannot be resolved. - */ -export function isMainInvocation(argv: readonly string[], moduleUrl: string): boolean { - const entry = argv[1]; - if (entry === undefined) return false; - return realpathSync(entry) === realpathSync(fileURLToPath(moduleUrl)); -} + // Run only when invoked directly, not when imported by the test suite. An // indexed call rather than an `if` block: V8 reports an `if` body as a branch, diff --git a/scripts/main-invocation.ts b/scripts/main-invocation.ts index ad890b6..f7a45f3 100644 --- a/scripts/main-invocation.ts +++ b/scripts/main-invocation.ts @@ -1,10 +1,8 @@ /** - * Shared entry-point guard for the executable scripts in this package. + * Entry-point guard used by the docstring launcher and its behavioral tests. * - * All three shipped scripts (the coverage gate, the docstring gate and the - * merge-driver preparer) must behave identically when imported by their suites - * versus executed as `main`, so the comparison lives in exactly one measured - * module and can never drift between copies. + * Canonical path comparison keeps directly invoked symlinks from silently + * skipping a required gate. This module is included in strict source coverage. */ import { realpathSync } from "node:fs"; diff --git a/scripts/prepare-merge-driver.ts b/scripts/prepare-merge-driver.ts index 728ece4..f6f49f0 100644 --- a/scripts/prepare-merge-driver.ts +++ b/scripts/prepare-merge-driver.ts @@ -31,8 +31,12 @@ try { // the original error is rethrown. A probe that finds no package.json is not // yet proof of absence: a broken install can leave `node_modules/pm-ops` (a // directory or a dangling link) with no package.json in any ancestor Node - // searches. Such an entry also counts as present. Node returns null paths - // only for built-in modules; pm-ops/package.json is a package specifier. + // searches. Such an entry also counts as present. Keep Node's global paths + // too: the installer resolution above can use them, so an absent local + // package alone cannot prove absence. An unreadable or malformed lookup path + // leaves presence uncertain and must fail closed with the original error. + // Node returns null paths only for built-in modules; pm-ops/package.json is + // a package specifier. let packagePresent = true; try { resolver.resolve("pm-ops/package.json"); @@ -40,7 +44,16 @@ try { packagePresent = !(probe instanceof Error && "code" in probe && probe.code === "MODULE_NOT_FOUND") || resolver.resolve.paths("pm-ops/package.json")!.some( - (directory) => lstatSync(join(directory, "pm-ops"), { throwIfNoEntry: false }) !== undefined, + (directory) => { + try { + return lstatSync(join(directory, "pm-ops"), { throwIfNoEntry: false }) !== undefined; + } catch { + // throwIfNoEntry:false only suppresses ENOENT, not EACCES, EPERM, + // ENOTDIR, or ELOOP. Do not replace the installer diagnostic or + // treat an inconclusive presence check as an omit-dev install. + return true; + } + }, ); } if (packagePresent) throw error; diff --git a/test/coverage-gate.test.ts b/test/coverage-gate.test.ts index edb6a10..1571546 100644 --- a/test/coverage-gate.test.ts +++ b/test/coverage-gate.test.ts @@ -97,6 +97,13 @@ function writePackageJson(dir: string, gate: Record): void { writeFileSync(join(dir, "package.json"), JSON.stringify({ coverageGate: gate })); } +/** Write a fixture compiler artifact without repeating output-directory setup. */ +function writeCompiledFile(dir: string, name: string, contents: string): void { + const output = join(dir, "dist"); + mkdirSync(output, { recursive: true }); + writeFileSync(join(output, `${name}.js`), contents); +} + /** * Writes a tiny TypeScript source file that exports a single constant. * @@ -381,8 +388,7 @@ test("coverage gate fails when an ignored file emits runtime code", async (t) => }); writeSource(dir, "runtime"); // Manually create the compiled output with runtime code. - mkdirSync(join(dir, "dist"), { recursive: true }); - writeFileSync(join(dir, "dist", "runtime.js"), "export const value = 42;\n"); + writeCompiledFile(dir, "runtime", "export const value = 42;\n"); await assertGateFails(dir, /emits runtime code/); }); @@ -398,8 +404,7 @@ test("coverage gate passes when an ignored file is genuinely type-only", async ( }); writeFileSync(join(dir, "types.ts"), "export type Point = { x: number; y: number };\n"); // Manually create the compiled output with only `export {};`. - mkdirSync(join(dir, "dist"), { recursive: true }); - writeFileSync(join(dir, "dist", "types.js"), "export {};\n"); + writeCompiledFile(dir, "types", "export {};\n"); const { code, stderr } = await runGate(dir); assert.strictEqual(code, 0, `a type-only ignore entry should pass; stderr: ${stderr}`); @@ -608,8 +613,7 @@ test("coverage gate uses default emit paths when tsc output has no compilerOptio gate: { thresholds: ZERO_THRESHOLDS, ignore: ["types.ts"] }, }); writeFileSync(join(dir, "types.ts"), "export type Point = { x: number; y: number };\n"); - mkdirSync(join(dir, "dist"), { recursive: true }); - writeFileSync(join(dir, "dist", "types.js"), "export {};\n"); + writeCompiledFile(dir, "types", "export {};\n"); // Fake `tsc` that outputs `{}` — no compilerOptions, so defaults are used. const fakeTsc = writeNodeCommand(dir, "fake-tsc", 'console.log("{}");\n'); diff --git a/test/docstring-gate.test.ts b/test/docstring-gate.test.ts index 5c06e03..fd8e983 100644 --- a/test/docstring-gate.test.ts +++ b/test/docstring-gate.test.ts @@ -31,23 +31,26 @@ test("docstring gate runGate reports this package as fully documented", () => { assert.match(result.stdout, /^docstring-gate: \d+ file\(s\), \d+ declaration\(s\) documented\.$/); }); -test("docstring gate runGate reports an undocumented declaration and exits non-zero", () => { - const root = mkdtempSync(join(tmpdir(), "pm-ts-starter-docgate-")); - try { - mkdirSync(join(root, "src"), { recursive: true }); - writeFileSync(join(root, "src", "sample.ts"), "export function undocumented(value: string): string {\n return value;\n}\n"); - const result = runGate(root); - assert.equal(result.exitCode, 1); - assert.equal(result.stdout, "", "a failing run writes nothing to stdout"); - assert.match(result.stderr, /1 violation\(s\)/); - // Assert the LAYOUT runGate formats, not the reason wording, which pm-ops - // owns: re-asserting the analyzer's strings here would re-couple this suite - // to rules the header says live with the analyzer. - assert.match(result.stderr, /sample\.ts:1\s+undocumented\s+-\s+\S/); - } finally { - rmSync(root, { recursive: true, force: true }); - } -}); +for (const extension of ["ts", "tsx"]) { + test(`docstring gate rejects an undocumented ${extension} declaration`, () => { + const root = mkdtempSync(join(tmpdir(), "pm-ts-starter-docgate-")); + try { + mkdirSync(join(root, "src"), { recursive: true }); + writeFileSync(join(root, "src", `sample.${extension}`), "export function undocumented(value: string): string {\n return value;\n}\n"); + const result = runGate(root); + assert.equal(result.exitCode, 1); + assert.equal(result.stdout, "", "a failing run writes nothing to stdout"); + assert.match(result.stderr, /1 violation\(s\)/); + // Assert the LAYOUT runGate formats, not the reason wording, which pm-ops + // owns: re-asserting the analyzer's strings here would re-couple this suite + // to rules the header says live with the analyzer. + assert.match(result.stderr, /sample\.tsx?:1\s+undocumented\s+-\s+\S/); + } finally { + rmSync(root, { recursive: true, force: true }); + } + }); + +} test("docstring gate runGate passes a root whose every declaration is documented", () => { const root = mkdtempSync(join(tmpdir(), "pm-ts-starter-docgate-clean-")); diff --git a/test/prepare-merge-driver.test.ts b/test/prepare-merge-driver.test.ts index 2bc94f4..788e310 100644 --- a/test/prepare-merge-driver.test.ts +++ b/test/prepare-merge-driver.test.ts @@ -128,3 +128,12 @@ test("an installer killed by a signal fails the install instead of reporting suc const result = prepare(checkout("killed", "pinned"), stubPm("killed", 0, "kill -9 $PPID")); assert.equal(result.status, 1, result.stderr); }); + +test("a malformed lookup path preserves the original installer failure", () => { + const directory = checkout("malformed-lookup", "absent"); + writeFileSync(join(directory, "node_modules"), "not a directory\n"); + const result = prepare(directory, hostPath); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /MODULE_NOT_FOUND/); + assert.doesNotMatch(result.stderr, /ENOTDIR|skipping merge-driver install/); +}); diff --git a/test/smoke.test.ts b/test/smoke.test.ts index 5b06d43..0d92f4e 100644 --- a/test/smoke.test.ts +++ b/test/smoke.test.ts @@ -1185,13 +1185,18 @@ test("context-demo defaults to json format when --format is omitted", async (t) assert.ok(result.result, "context-demo with default json format must return a truthy result"); }); -test("pmJson failure with empty stderr uses the period fallback in the message", async (t) => { - const dir = mkdtempSync(join(tmpdir(), "pm-ts-starter-silent-fail-")); +/** Exercise a silent failing CLI in a disposable command fixture. */ +async function withSilentFailingPm(t: TestContext, body: () => Promise): Promise { + const dir = mkdtempSync(join(tmpdir(), "pm-ts-starter-silent-")); t.after(() => rmSync(dir, { recursive: true, force: true })); + await withFakePmOnPath(dir, "#!/bin/sh\nexit 1\n", body); +} + +test("pmJson failure with empty stderr uses the period fallback in the message", async (t) => { // A fake `pm` that exits 1 with no output — exercises the empty-detail // arms of the pmJson failure message and cause construction. - await withFakePmOnPath(dir, "#!/bin/sh\nexit 1\n", async () => { + await withSilentFailingPm(t, async () => { await assert.rejects( () => harness.runCommand({ command: "ts-starter search-demo", options: { query: "test" }, args: [], pmRoot: "/tmp" }), (err: unknown) => { @@ -1205,10 +1210,8 @@ test("pmJson failure with empty stderr uses the period fallback in the message", }); test("context-demo non-json failure with empty stderr yields undefined why", async (t) => { - const dir = mkdtempSync(join(tmpdir(), "pm-ts-starter-ctx-silent-")); - t.after(() => rmSync(dir, { recursive: true, force: true })); - await withFakePmOnPath(dir, "#!/bin/sh\nexit 1\n", async () => { + await withSilentFailingPm(t, async () => { await assert.rejects( () => harness.runCommand({ command: "ts-starter context-demo", options: { format: "markdown" }, args: [], pmRoot: "/tmp" }), (err: unknown) => isPmCliExpectedError(err) && /context demo failed/.test((err as Error).message), From 053cf31b6a7124867c74f6eb94b14fa9ce21b61f Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 14:30:52 +0200 Subject: [PATCH 2/2] Align certification criteria and create the required linked-gate lock directory --- .agents/pm/chores/pm-ts-starter-n4ee.toon | 12 +++++++----- .agents/pm/history/pm-ts-starter-n4ee.jsonl | 6 ++++++ docs/certification-2026.10.4.md | 9 +++++++++ 3 files changed, 22 insertions(+), 5 deletions(-) diff --git a/.agents/pm/chores/pm-ts-starter-n4ee.toon b/.agents/pm/chores/pm-ts-starter-n4ee.toon index 365a2b8..47b2db9 100644 --- a/.agents/pm/chores/pm-ts-starter-n4ee.toon +++ b/.agents/pm/chores/pm-ts-starter-n4ee.toon @@ -6,16 +6,16 @@ status: blocked priority: 1 tags: [] created_at: "2026-09-29T17:00:46.063Z" -updated_at: "2026-10-04T11:57:25.722Z" +updated_at: "2026-10-04T12:30:44.698Z" author: codex-ts-starter-0929 -acceptance_criteria: An undocumented TSX declaration beside valid TypeScript fails the consumer documentation gate; Pinned installation and SDK typecheck pass with CLI 2026.9.29; Packed npm and Bun consumers execute hello and preserve native list output; All authored executable source meets four coverage metrics and required reviews pass before merge; An incomplete pm-ops directory makes prepare fail rather than silently skipping merge-driver installation +acceptance_criteria: An undocumented TSX declaration beside valid TypeScript fails the consumer documentation gate; Packed npm and Bun consumers execute hello and preserve native list output; All authored executable source meets four coverage metrics and required reviews pass before merge; An incomplete pm-ops directory makes prepare fail rather than silently skipping merge-driver installation; Pinned installation and SDK typecheck pass with CLI 2026.10.4 risk: low blocked_by: pm-ts-starter-audit104 blocked_reason: Full development npm audit has four high findings rooted in unpatched braces 3.0.3; required current pm-ops duplication gate depends on fast-glob. actual_result: "2026-10-04: full locked release:check passed 186/186, zero skips; 100% measured lines/branches/functions across five configured source files; 0% duplication across 19 authored sources. Canonical launcher 8/8 and .ts/.tsx docstring rejection passed. Strict health, production audit, Bun CI graph and real tracker npx/native-Bun commands passed (all 75 items; 9 capabilities; 5 search results). Read-only GitHub preview: 0 imports/1 update/0 skips. Full npm audit remains NOT CLEAN: 4 high unpatched braces findings; separate follow-up audit104. CI/reviews pending; orchestrator owns merge/closure." dependencies[1]{id,kind,created_at,author,source_kind,author_source}: pm-ts-starter-audit104,blocked_by,"2026-10-04T11:57:23.515Z",codex-sol,"cli:update:blocked_by",detected -comments[9]{created_at,author,text}: +comments[10]{created_at,author,text}: "2026-10-02T22:10:38.250Z",codex-sol,"Restart by codex-sol: preserved remote PR #114 and all existing bot replies/reactions were inspected. Branch is already current with origin/main. No new actionable unresolved inline finding is present. Retain documented coverage/health/publication blockers; rerun unchanged full CI gate with the host-wide flock. No merge, publish or item closure." "2026-10-02T22:25:29.247Z",codex-sol,"Restart: locked npm ci and release:check pass 184/184 tests, zero skips; configured coverage reports 100% lines/branches/functions for four TypeScript sources, without a separate statements dimension. PM-linked prepare-merge-driver tests, strict health with merge drivers and tracked dist equality pass. The original incomplete pm-ops fail-closed fix remains intact. Whole-authored-source coverage and declaration documentation remain incomplete, including the existing published pm-ops TSX omission tracked by pm-ops#132. Keep reviewer prerequisites separate; no merge, publish or close. Release claim for orchestrator." "2026-10-02T22:50:32.994Z",codex-sol,"Cubic review round: linked manifest.json (valid tracking omission). Disposable actual-launcher NODE_PATH regular-file reproduction confirms ENOTDIR masks MODULE_NOT_FOUND but install fails closed without skip. Canonical pm-ops template must be repaired/published first; local consumer divergence is refused and a follow-up item is open. Original release:check 184/184, four-source L/B/F 100 remains valid; no runtime code changed. Retain TSX and whole-source coverage blockers." @@ -25,6 +25,7 @@ comments[9]{created_at,author,text}: "2026-10-04T11:54:44.318Z",codex-sol,"Full release:check passed 185/185 tests, zero skips, 100% measured lines/branches/functions across five configured sources including the shared entry guard; 0% duplication across 19 authored sources. Strict health and production audit passed; full development audit still has four high unpatched braces findings. GitHub read-only atomic preview proposes 0 imports/1 update/0 skips, no writes. Confirmed published docstrings now includes TSX: add a consumer .ts/.tsx rejection matrix before replacing the stale README omission notice. This adds coverage, changes no thresholds, and retains original docstring assertions." "2026-10-04T11:56:19.849Z",codex-sol,"Real tracker packed acceptance passed under npx -y @unbrained/pm-cli@2026.10.4 and bunx --bun @unbrained/pm-cli@2026.10.4. hello --name Fleet --loud returned HELLO, FLEET!; ts-starter info reported 9 capabilities and unchanged supported floor 2026.8.7 (sdk_target is the peer floor, not the dev pin); list --all --output-budget unbounded --output-limit unbounded returned all 75 real items; context-demo --format json --depth brief succeeded; search-demo certify --limit 5 returned 5 results. All commands exited 0; scratch copy deleted. CI bun install --no-save graph also passed." "2026-10-04T11:57:24.818Z",codex-sol,"Final complete gate passed 186/186 tests after TSX matrix addition, zero skips, 100% measured line/branch/function coverage and 0% duplication. npm/native-Bun real-tracker dogfood and CI Bun graph passed. Keep certification blocked on pm-ts-starter-audit104; do not treat configured green CI as a clean full development audit. Release claim for orchestrator without closing." + "2026-10-04T12:30:43.836Z",codex-sol,"CodeRabbit #119 valid tracker findings: replace stale 2026.9.29 acceptance pin with 2026.10.4 while retaining the whole-authored-source four-metric and review criterion. The linked gate now creates /tmp/claude-1000 before taking the mandatory heavy-gate.lock; a disposable missing-parent probe fails before directory creation and succeeds after. CLI pin, full gate, lock path, thresholds and audit blocker are unchanged. Initial exact-head Node 22/26 and CodeQL passed. Sourcery weekly and Cubic monthly quotas are missing substantive reviews; Gemini/Copilot have not replied." notes[4]{created_at,author,text}: "2026-09-29T17:03:03.624Z",codex-ts-starter-0929,The undocumented TSX fixture reproduces a silent pass with both pm-ops 2026.9.23 and published 2026.9.29. Canonical repair remains unmerged in unbraind/pm-ops PR 132. Keep that acceptance criterion unresolved and do not duplicate the analyzer locally. Released tooling does contain the canonical incomplete-package launcher repair. Its new behavioral regression failed before copying the shipped template. "2026-09-29T17:04:42.433Z",codex-ts-starter-0929,"Clean npm ci and release:check passed 184 tests on Node 24.19.0. The documentation analyzer reports 9 files and 20 declarations; this policy denominator omits TSX and some internal declarations. Coverage reports 100 percent lines branches and functions for four source files only and no independent statement metric. This is not full authored-source four-metric certification. Production audit reports zero vulnerabilities. Strict tracker health and validation pass. Public package artifact allowlist contains nine files and excludes tracker scripts fixtures and deployment data. TSX reproduction remains blocked by pm-ops PR 132." @@ -75,12 +76,13 @@ tests[3]: created_at: "2026-10-02T22:10:40.690Z" source_kind: local_mutation source_ref: land-restart/pm-ts-starter-114 - - command: "flock /tmp/claude-1000/heavy-gate.lock npm run release:check" + - command: "mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run release:check" scope: project timeout_seconds: 2400 + pm_context_mode: tracker provenance: author: codex-sol - created_at: "2026-10-04T11:39:51.726Z" + created_at: "2026-10-04T12:30:42.921Z" source_kind: local_mutation source_ref: chore/pm-ts-starter-pm-cli-2026-10-4 docs[2]: diff --git a/.agents/pm/history/pm-ts-starter-n4ee.jsonl b/.agents/pm/history/pm-ts-starter-n4ee.jsonl index b920b0f..a4a46a0 100644 --- a/.agents/pm/history/pm-ts-starter-n4ee.jsonl +++ b/.agents/pm/history/pm-ts-starter-n4ee.jsonl @@ -53,3 +53,9 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T11:57:23.566Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/blocked_reason","value":"Full development npm audit has four high findings rooted in unpatched braces 3.0.3; required current pm-ops duplication gate depends on fast-glob."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:57:23.566Z"},{"op":"replace","path":"/metadata/status","value":"blocked"},{"op":"add","path":"/metadata/blocked_by","value":"pm-ts-starter-audit104"},{"op":"add","path":"/metadata/actual_result","value":"2026-10-04: full locked release:check passed 186/186, zero skips; 100% measured lines/branches/functions across five configured source files; 0% duplication across 19 authored sources. Canonical launcher 8/8 and .ts/.tsx docstring rejection passed. Strict health, production audit, Bun CI graph and real tracker npx/native-Bun commands passed (all 75 items; 9 capabilities; 5 search results). Read-only GitHub preview: 0 imports/1 update/0 skips. Full npm audit remains NOT CLEAN: 4 high unpatched braces findings; separate follow-up audit104. CI/reviews pending; orchestrator owns merge/closure."},{"op":"add","path":"/metadata/dependencies","value":[{"id":"pm-ts-starter-audit104","kind":"blocked_by","created_at":"2026-10-04T11:57:23.515Z","author":"codex-sol","source_kind":"cli:update:blocked_by","author_source":"detected"}]}],"before_hash":"d5951e59aea685f65765d5b08df7be63b4dd925b7b52faead98782aa33cf9f00","after_hash":"7c4bb4a095e8c9f4db2ea32d5a3ba7dd8e16e45d9747845fc1d9d94a0cdbe8f3","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"4bcc7f477ac8518325fca7eef59b65d265820277327706913772b5a2a993217f"} {"hash_algorithm":"sha256","ts":"2026-10-04T11:57:24.818Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/8","value":{"created_at":"2026-10-04T11:57:24.818Z","author":"codex-sol","text":"Final complete gate passed 186/186 tests after TSX matrix addition, zero skips, 100% measured line/branch/function coverage and 0% duplication. npm/native-Bun real-tracker dogfood and CI Bun graph passed. Keep certification blocked on pm-ts-starter-audit104; do not treat configured green CI as a clean full development audit. Release claim for orchestrator without closing."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:57:24.818Z"}],"before_hash":"7c4bb4a095e8c9f4db2ea32d5a3ba7dd8e16e45d9747845fc1d9d94a0cdbe8f3","after_hash":"e40d1c54162508e426892d4a6fd2f1035987802b1d96c0566ffc8296f205c81c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"7691a5b9908a441f53db89c9cf990370d74a6fe59d641b160918300194abdb0f"} {"hash_algorithm":"sha256","ts":"2026-10-04T11:57:25.722Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:57:25.722Z"}],"before_hash":"e40d1c54162508e426892d4a6fd2f1035987802b1d96c0566ffc8296f205c81c","after_hash":"3f512f1f1d3cbe0ddba7e8d00d05d34dfb68cac9a333bc5b0d888dc5c489d250","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"4631fb29313ae195efd02faac91bd5345a0e55c68e8a8ed45ea111847b2d0420"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:30:40.219Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:30:40.219Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"3f512f1f1d3cbe0ddba7e8d00d05d34dfb68cac9a333bc5b0d888dc5c489d250","after_hash":"f7ae859ee001d8add096f0b4cc046038417e792e78a3353c15e51b859341e6bc","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"ae385eec188332b63a7708608c2b88321e72ce1dbefc2e719b65723bd9218e30"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:30:41.118Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/acceptance_criteria","value":"An undocumented TSX declaration beside valid TypeScript fails the consumer documentation gate; Packed npm and Bun consumers execute hello and preserve native list output; All authored executable source meets four coverage metrics and required reviews pass before merge; An incomplete pm-ops directory makes prepare fail rather than silently skipping merge-driver installation; Pinned installation and SDK typecheck pass with CLI 2026.10.4"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:30:41.118Z"}],"before_hash":"f7ae859ee001d8add096f0b4cc046038417e792e78a3353c15e51b859341e6bc","after_hash":"be9345e8151ff93b2ce696bf9572a59680ed548d8647710e0b512659e2ed1a6a","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"3e6115e16f8fe4777122cbcf356256a87284a8d1b3ce2b460a5dafa2f093e79b"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:30:42.032Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_remove","patch":[{"op":"remove","path":"/metadata/tests/2"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:30:42.032Z"}],"before_hash":"be9345e8151ff93b2ce696bf9572a59680ed548d8647710e0b512659e2ed1a6a","after_hash":"593a39d8c08878ebabd659649effa25b202f120dee378d8868a0b372653b8c9b","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b8bf1ff8ed113c2071016d75a44815cda63591b5b8d8b39112ab8bd0c2f05b59"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:30:42.948Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/2","value":{"command":"mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run release:check","scope":"project","timeout_seconds":2400,"pm_context_mode":"tracker","provenance":{"author":"codex-sol","created_at":"2026-10-04T12:30:42.921Z","source_kind":"local_mutation","source_ref":"chore/pm-ts-starter-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:30:42.948Z"}],"before_hash":"593a39d8c08878ebabd659649effa25b202f120dee378d8868a0b372653b8c9b","after_hash":"8ff5686d4e560ffc4413a18caa63705d6de8c4bfcbd808f47c0acc8e44c9f810","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"a2424fa61b428b0488b4a37024f026d47c02de4d042b05a89b444e18e2d772b8"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:30:43.836Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/9","value":{"created_at":"2026-10-04T12:30:43.836Z","author":"codex-sol","text":"CodeRabbit #119 valid tracker findings: replace stale 2026.9.29 acceptance pin with 2026.10.4 while retaining the whole-authored-source four-metric and review criterion. The linked gate now creates /tmp/claude-1000 before taking the mandatory heavy-gate.lock; a disposable missing-parent probe fails before directory creation and succeeds after. CLI pin, full gate, lock path, thresholds and audit blocker are unchanged. Initial exact-head Node 22/26 and CodeQL passed. Sourcery weekly and Cubic monthly quotas are missing substantive reviews; Gemini/Copilot have not replied."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:30:43.836Z"}],"before_hash":"8ff5686d4e560ffc4413a18caa63705d6de8c4bfcbd808f47c0acc8e44c9f810","after_hash":"d4f6489c6799f1e5f2414c017409bbd901d772a672c7d0fa9a6e3b0479b7d2a8","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"9131b078ce6141946158201f1a6a2b07c4fa11ec78b1995d27b68065612c8f3f"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:30:44.698Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:30:44.698Z"}],"before_hash":"d4f6489c6799f1e5f2414c017409bbd901d772a672c7d0fa9a6e3b0479b7d2a8","after_hash":"4a28f5e341800cc87d00d5bfd5a985acfa708ac9d32249017bceb7420fa01f2b","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"9ab9f8369c2e61d005f97d1964c67c326f048ae43bad2f0d92e19b1a69c7840f"} diff --git a/docs/certification-2026.10.4.md b/docs/certification-2026.10.4.md index a6739da..482a1fa 100644 --- a/docs/certification-2026.10.4.md +++ b/docs/certification-2026.10.4.md @@ -66,3 +66,12 @@ required pm-ops to 2026.9.13 and was refused. No open Dependabot security alerts were present. [pm-ts-starter-audit104](https://github.com/unbraind/pm-ts-starter/blob/main/.agents/pm/issues/pm-ts-starter-audit104.toon) tracks the required canonical dependency replacement or upstream patch. A green configured release gate does not make the full development audit clean. + +CodeRabbit review corrections: the certification acceptance criterion now names +CLI 2026.10.4; the separate whole-authored-source four-metric criterion remains +explicit and unmet. The linked release command creates `/tmp/claude-1000` before +`flock /tmp/claude-1000/heavy-gate.lock npm run release:check`; a disposable +missing-parent probe fails before creation and passes afterwards. This preserves +the mandatory shared lock and the verified release command. Initial Node 22/26 +and CodeQL CI passed. Sourcery weekly and Cubic monthly quota notices are missing +substantive review evidence; Gemini/Copilot have not replied.