diff --git a/.agents/pm/chores/pm-csv-hzn7.toon b/.agents/pm/chores/pm-csv-hzn7.toon new file mode 100644 index 0000000..b699944 --- /dev/null +++ b/.agents/pm/chores/pm-csv-hzn7.toon @@ -0,0 +1,91 @@ +id: pm-csv-hzn7 +title: Certify pm-csv on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates +description: "Bump the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops and pm-changelog latest, take over the open Dependabot dependency updates (@types/node, jscpd, eslint) and the pinned codeql-action SHA group, keep the canonical pm-ops merge-driver launcher byte-identical, and certify with the full release gate plus isolated real-tracker dogfooding on npm and Bun." +type: Chore +status: in_progress +priority: 2 +tags[4]: cli,dependencies,release-readiness,sdk +created_at: "2026-10-04T08:43:00.128Z" +updated_at: "2026-10-04T11:22:56.589Z" +author: pi-glm +acceptance_criteria: "npm run release:check passes with 100/100/100 coverage and clean npm audit including dev; pm health with the repo-pinned 2026.10.4 binary reports no gate-failing findings; packed tarball passes real-tracker import/export scenarios via npx @unbrained/pm-cli@2026.10.4 and bunx; pm-github managed extension installed with a read-only sync preview only" +actual_result: "Resumed candidate rebased onto main release 7473779. Every devDependency exact; CLI/ops/changelog 2026.10.4, resolved Dependabot versions retained. Canonical launcher unchanged; 3 Greptile regression cases added. Clean npm ci and full release:check PASS: 238/238, zero skipped, 100/100/100 measured lines/branches/functions (2 sources). npm audit and audit --omit=dev: 0. Packed current-version tarball npx/bunx real tracker dogfood passed: 107 original exports, 108 after 1 isolated create; repeated imports update 1 with no duplicate. pm health ok, one prior stale-item advisory; read-only pm-github preview wouldSync 1. Pending reviewer availability is missing evidence; leave open." +comments[11]{created_at,author,text}: + "2026-10-04T08:43:08.758Z",pi-glm,"Starting: worktree chore/pm-csv-pm-cli-2026-10-4 at c135b94. Plan: bump @unbrained/pm-cli 2026.9.28->2026.10.4, pm-ops 2026.9.23->2026.10.4, pm-changelog 2026.9.23->2026.9.25; consolidate Dependabot #137 (eslint 10.11.0), #142 (jscpd 5.4.0), #143 (pm-ops), #144 (@types/node 26.6.3), #145 (pm-changelog), #140 (codeql-action SHA 1c5b6756...); re-copy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + dogfood on npm/bun." + "2026-10-04T09:13:17.909Z",pi-glm,"Real-tracker dogfood PASS. Packed pm-csv-2026.9.26.tgz installed into a scratch copy of this repo's real .agents/pm (107 items). Registered via pm package install ./node_modules/pm-csv with pm-cli 2026.10.4 (capabilities commands/importers/schema). npm path (npx -y @unbrained/pm-cli@2026.10.4): csv export -> 107 items; csv export --status open -> 6; csv validate -> 107 rows clean; csv import -> imported 1; csv import --key title -> updated 1 (upsert verified idempotent, no duplicate). bun path (bunx @unbrained/pm-cli@2026.10.4): csv export -> 109 items; csv validate -> clean; csv import --key title --source bunx-cert -> updated 1. All commands exit 0 with correct real data round-trip. Scratch dir deleted after evidence capture." + "2026-10-04T09:14:03.016Z",pi-glm,"pm-github installed as managed project extension at latest npm 2026.9.26 (.agents/pm/extensions/.managed-extensions.json, capabilities commands/hooks/importers/preflight/schema/search). Read-only preview against unbraind/pm-csv: pm github validate --repo unbraind/pm-csv -> ok (token via gh CLI, repo HTTP 200, quota 4952/5000); pm github export --repo unbraind/pm-csv --dry-run -> plan only, writes nothing (create/update actions listed for real items incl. linked gh:unbraind/pm-csv#72); pm github sync --dry-run --repo unbraind/pm-csv -> wouldSync 1, no mutation. No issues created/modified, no scheduled sync enabled." + "2026-10-04T10:19:39.515Z",pi-glm,"Correction: pm-github 2026.10.4 was published mid-certification; the managed project extension was upgraded from 2026.9.26 to 2026.10.4 (latest npm). Re-ran read-only previews against unbraind/pm-csv: validate ok (HTTP 200, quota 4871/5000), sync --dry-run -> wouldSync 1, no mutation. Still no issues created/modified, no scheduled sync." + "2026-10-04T10:48:42.360Z",codex-sol,"Resumed after provider quota exhaustion. Re-read PR #146, existing author comments/reactions and Greptile thread. Rebased onto origin/main 7473779; addressing missing broken-install/lookup regression fixtures, exact devDependency pins, and newly published pm-changelog 2026.10.4 before rerunning the locked full gate." + "2026-10-04T10:50:43.600Z",codex-sol,"Greptile regression request verified: 9/9 launcher tests pass, zero skips, including incomplete package directory, dangling pm-ops symlink, and looping NODE_PATH. All assert a nonzero result and preserve the original installer diagnostic; canonical launcher is unchanged." + "2026-10-04T10:52:58.812Z",codex-sol,All devDependencies now use exact installed versions; pm-changelog upgraded to latest published 2026.10.4. The linked launcher run passed 9/9 using explicit tracker context (none requires an isolated/snapshot source mode; reserved PM_PATH env clearing was correctly rejected). No gate changes. + "2026-10-04T10:57:36.785Z",codex-sol,"Resumption validation PASS after rebase and exact pins: clean npm ci; flock-serialized npm run release:check passed 238/238 tests, 0 skipped, measured lines/branches/functions 100/100/100 across the existing two-source gate. Audits all/prod each 0. Packed pm-csv-2026.10.4.tgz installed into a fresh copy of this real tracker; npx -y @unbrained/pm-cli@2026.10.4 csv export --output real.csv exported 107; csv validate real.csv clean; csv import input.csv --key title created 1 then updated 1. bunx @unbrained/pm-cli@2026.10.4 csv export --output real-bun.csv exported 108; validate clean; import --key title updated 1. Scratch deleted. npx pm health ok with one prior-item stale advisory. Managed pm-github 2026.10.4 sync --dry-run --repo unbraind/pm-csv: wouldSync 1, no writes. Review availability remains separate from green gates." + "2026-10-04T10:59:48.449Z",codex-sol,"The three new regression fixtures run unconditionally; no new platform skips were added. Rechecked 9/9 launcher tests, zero skips. Linux full-gate behavior and the validated canonical launcher remain unchanged." + "2026-10-04T11:10:15.475Z",codex-sol,"Review round 2: Greptile found Windows symbolic-link privilege requirements in the new unconditional fixtures. Use symlinkSync type junction with absolute targets, which Node applies only on Windows (ignored on POSIX), retaining all scenarios without new skips. Linux launcher suite still passes 9/9; a Windows runner is unavailable. Canonical launcher remains unchanged; rerun the full locked release gate before push." + "2026-10-04T11:22:55.937Z",codex-sol,"Review correction validation PASS: full flock-serialized npm run release:check re-run after portable junction and ambient NODE_PATH isolation changes: 238/238 tests, zero skips, measured 100/100/100 thresholds met, audits/packed current npm/Bun/minimum-host acceptance/changelog/attestation/date gates green. Linked hostile run env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts also passes 9/9. Windows execution is not available; junction fixture API follows https://nodejs.org/api/fs.html#fssymlinksynctarget-path-type. Production package unchanged; real-tracker dogfood from this certification remains applicable." +files[7]: + - path: .agents/pm/extensions/.managed-extensions.json + scope: project + note: pm-github 2026.9.26 managed extension registration + - path: .github/workflows/codeql.yml + scope: project + note: codeql-action pinned SHA group 1c5b6756 + - path: package-lock.json + scope: project + note: Resolved dependency graph with consolidated Dependabot bumps + - path: package.json + scope: project + note: Exact CLI/SDK/ops/changelog pins + - path: README.md + scope: project + note: Documented gate host pin raised to 2026.10.4 + - path: scripts/prepare-merge-driver.ts + scope: project + note: Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte + - path: test/prepare-merge-driver.test.ts + scope: project +tests[6]: + - command: npx -y @unbrained/pm-cli@2026.10.4 csv export --output dogfood-export.csv + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T09:13:17.786Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: bunx @unbrained/pm-cli@2026.10.4 csv import dogfood-import.csv --key title --source bunx-cert + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T09:13:18.328Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: "npm run release:check" + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T09:14:13.739Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: npx pm health + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T09:14:15.089Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: node --test test/prepare-merge-driver.test.ts + scope: project + pm_context_mode: none + provenance: + author: codex-sol + created_at: "2026-10-04T10:50:41.998Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: "env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts" + scope: project + pm_context_mode: tracker + provenance: + author: codex-sol + created_at: "2026-10-04T11:19:02.676Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 +body: "" diff --git a/.agents/pm/history/pm-csv-hzn7.jsonl b/.agents/pm/history/pm-csv-hzn7.jsonl new file mode 100644 index 0000000..7b2188a --- /dev/null +++ b/.agents/pm/history/pm-csv-hzn7.jsonl @@ -0,0 +1,37 @@ +{"hash_algorithm":"sha256","ts":"2026-10-04T08:43:00.128Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-csv-hzn7"},{"op":"add","path":"/metadata/title","value":"Certify pm-csv on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates"},{"op":"add","path":"/metadata/description","value":"Bump the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops and pm-changelog latest, take over the open Dependabot dependency updates (@types/node, jscpd, eslint) and the pinned codeql-action SHA group, keep the canonical pm-ops merge-driver launcher byte-identical, and certify with the full release gate plus isolated real-tracker dogfooding on npm and Bun."},{"op":"add","path":"/metadata/type","value":"Chore"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["cli","dependencies","release-readiness","sdk"]},{"op":"add","path":"/metadata/created_at","value":"2026-10-04T08:43:00.128Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-04T08:43:00.128Z"},{"op":"add","path":"/metadata/author","value":"pi-glm"},{"op":"add","path":"/metadata/acceptance_criteria","value":"npm run release:check passes with 100/100/100 coverage and clean npm audit including dev; pm health with the repo-pinned 2026.10.4 binary reports no gate-failing findings; packed tarball passes real-tracker import/export scenarios via npx @unbrained/pm-cli@2026.10.4 and bunx; pm-github managed extension installed with a read-only sync preview only"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"32d6d6e1a2bdb0bdf97fa404e99bf9aba6375ff90bae1626a2d7c466115950ad","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"af9dc14bb81e85de8227d95752439569dfd32c430a82306a889d933eccd3892d"} +{"hash_algorithm":"sha256","ts":"2026-10-04T08:43:07.147Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T08:43:07.147Z"},{"op":"add","path":"/metadata/assignee","value":"pi-glm"},{"op":"add","path":"/metadata/claim_principal","value":"pi-glm"}],"before_hash":"32d6d6e1a2bdb0bdf97fa404e99bf9aba6375ff90bae1626a2d7c466115950ad","after_hash":"991f97302546ce4ba858b22ecd155fa73317c42a1671c34880f2d13abb0f0cba","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"7fad0097199004c792a213a6d998989890bbca37c6da87963738f289fd6768ee"} +{"hash_algorithm":"sha256","ts":"2026-10-04T08:43:08.086Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T08:43:08.086Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"991f97302546ce4ba858b22ecd155fa73317c42a1671c34880f2d13abb0f0cba","after_hash":"188f518a8ab43d69d8e04d5f5913452f4d7e0861a4ce432b48136b7585c5ec23","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"ab8cb8c17d705e45993cf8666c005f8608b55bf64ab4f85e87b6f72933e08e87"} +{"hash_algorithm":"sha256","ts":"2026-10-04T08:43:08.759Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T08:43:08.759Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-10-04T08:43:08.758Z","author":"pi-glm","text":"Starting: worktree chore/pm-csv-pm-cli-2026-10-4 at c135b94. Plan: bump @unbrained/pm-cli 2026.9.28->2026.10.4, pm-ops 2026.9.23->2026.10.4, pm-changelog 2026.9.23->2026.9.25; consolidate Dependabot #137 (eslint 10.11.0), #142 (jscpd 5.4.0), #143 (pm-ops), #144 (@types/node 26.6.3), #145 (pm-changelog), #140 (codeql-action SHA 1c5b6756...); re-copy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + dogfood on npm/bun."}]}],"before_hash":"188f518a8ab43d69d8e04d5f5913452f4d7e0861a4ce432b48136b7585c5ec23","after_hash":"06aeffd4723eebb72c25740bde716f5077e19eb1301add67d87579e5fa32ffd0","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"31adebe9845857359d7323388e1facef74ca542449cc7f419476d24afe810bd7"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:13:17.824Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:13:17.824Z"},{"op":"add","path":"/metadata/tests","value":[{"command":"npx -y @unbrained/pm-cli@2026.10.4 csv export --output dogfood-export.csv","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T09:13:17.786Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}]}],"before_hash":"06aeffd4723eebb72c25740bde716f5077e19eb1301add67d87579e5fa32ffd0","after_hash":"f40d8f99ba5f912bd9ca62148ca743f5ec87734f63e1cf43df966c4756ec7fb7","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"710f6ac79c44889ae2c6dc7f3eee742165f1643f5379e95d10eb0f1e026ff593"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:13:17.909Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-10-04T09:13:17.909Z","author":"pi-glm","text":"Real-tracker dogfood PASS. Packed pm-csv-2026.9.26.tgz installed into a scratch copy of this repo's real .agents/pm (107 items). Registered via pm package install ./node_modules/pm-csv with pm-cli 2026.10.4 (capabilities commands/importers/schema). npm path (npx -y @unbrained/pm-cli@2026.10.4): csv export -> 107 items; csv export --status open -> 6; csv validate -> 107 rows clean; csv import -> imported 1; csv import --key title -> updated 1 (upsert verified idempotent, no duplicate). bun path (bunx @unbrained/pm-cli@2026.10.4): csv export -> 109 items; csv validate -> clean; csv import --key title --source bunx-cert -> updated 1. All commands exit 0 with correct real data round-trip. Scratch dir deleted after evidence capture."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:13:17.909Z"}],"before_hash":"f40d8f99ba5f912bd9ca62148ca743f5ec87734f63e1cf43df966c4756ec7fb7","after_hash":"dd3919d501a230f60e149e19dfd2a0fc61e2eb2116647712fc633a29f13e9c28","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"c6f6db7f6b237f3f848c4a20ad41658b9bf7c580fea48b097d3908c820c3d85a"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:13:18.356Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/1","value":{"command":"bunx @unbrained/pm-cli@2026.10.4 csv import dogfood-import.csv --key title --source bunx-cert","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T09:13:18.328Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:13:18.356Z"}],"before_hash":"dd3919d501a230f60e149e19dfd2a0fc61e2eb2116647712fc633a29f13e9c28","after_hash":"897dbd269236f0a1600a77854f08218822e23d5e633ca8155599a5edc92ccd68","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"60d8da2209556f52f96226413a32d08abf351b2d84f1036381446bfa4194f530"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:03.016Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/2","value":{"created_at":"2026-10-04T09:14:03.016Z","author":"pi-glm","text":"pm-github installed as managed project extension at latest npm 2026.9.26 (.agents/pm/extensions/.managed-extensions.json, capabilities commands/hooks/importers/preflight/schema/search). Read-only preview against unbraind/pm-csv: pm github validate --repo unbraind/pm-csv -> ok (token via gh CLI, repo HTTP 200, quota 4952/5000); pm github export --repo unbraind/pm-csv --dry-run -> plan only, writes nothing (create/update actions listed for real items incl. linked gh:unbraind/pm-csv#72); pm github sync --dry-run --repo unbraind/pm-csv -> wouldSync 1, no mutation. No issues created/modified, no scheduled sync enabled."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:03.016Z"}],"before_hash":"897dbd269236f0a1600a77854f08218822e23d5e633ca8155599a5edc92ccd68","after_hash":"20e5c56eb2c0b817aefd2d7b7eef4fc17c0813492bb9805136c97519f423bdb0","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"59caffa66303d56f969964b0923bfaadc384e3f4fb2ca271023bec40ca014d5e"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:13.807Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/2","value":{"command":"npm run release:check","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T09:14:13.739Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:13.807Z"}],"before_hash":"20e5c56eb2c0b817aefd2d7b7eef4fc17c0813492bb9805136c97519f423bdb0","after_hash":"ae5680d54a31ca3830e288cf56b7fbcc0124e578a5f05b36dd45638f465dd0ec","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"99398622492be3f2fc53b535f03543f96c16e972737465ece0792c43281f8186"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:15.155Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/3","value":{"command":"npx pm health","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T09:14:15.089Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:15.155Z"}],"before_hash":"ae5680d54a31ca3830e288cf56b7fbcc0124e578a5f05b36dd45638f465dd0ec","after_hash":"c4700d066f0513cea93e1ed5fdf342a09c92f7814458e741018028b19f163a67","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"e5963472367a3624062ddc29b14d178ed05fdc38a9cbd75194daa99cb9edb0e2"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:52.350Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:52.350Z"},{"op":"add","path":"/metadata/files","value":[{"path":"package.json","scope":"project","note":"Exact CLI/SDK/ops/changelog pins"}]}],"before_hash":"c4700d066f0513cea93e1ed5fdf342a09c92f7814458e741018028b19f163a67","after_hash":"c3a36fff001eac065e29b15a00c0aa4d81de1a7c248ca9da6f5427bd3a73b96f","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"629d61646e61cdf2b4301f931e397d96a8c685957db866fe59e5ce97b30b91ed"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:53.215Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/0/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/0/path","value":"package-lock.json"},{"op":"add","path":"/metadata/files/1","value":{"path":"package.json","scope":"project","note":"Exact CLI/SDK/ops/changelog pins"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:53.215Z"}],"before_hash":"c3a36fff001eac065e29b15a00c0aa4d81de1a7c248ca9da6f5427bd3a73b96f","after_hash":"b3952945a28f8308204e637f6a72784bff5d0dee6ca8e9ee808ed8715556cad8","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"7eb76c3b1dced09d3f3786cd2f10dd1a748444beae4173ed77137d042420941f"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:57.002Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/2","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:57.002Z"}],"before_hash":"b3952945a28f8308204e637f6a72784bff5d0dee6ca8e9ee808ed8715556cad8","after_hash":"46bc3199a6ff4a6b9be51c93db4e68ad4960a2b89d0cfcd7e25794169b3b04ac","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"e5b25a91b10a73a79ff71616e8298a9568f478a01104a0915ecdc85bea73453a"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:58.096Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/2/note","value":"Exact CLI/SDK/ops/changelog pins"},{"op":"replace","path":"/metadata/files/2/path","value":"package.json"},{"op":"replace","path":"/metadata/files/1/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/1/path","value":"package-lock.json"},{"op":"replace","path":"/metadata/files/0/note","value":"codeql-action pinned SHA group 1c5b6756"},{"op":"replace","path":"/metadata/files/0/path","value":".github/workflows/codeql.yml"},{"op":"add","path":"/metadata/files/3","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:58.096Z"}],"before_hash":"46bc3199a6ff4a6b9be51c93db4e68ad4960a2b89d0cfcd7e25794169b3b04ac","after_hash":"6f57e68877fe0a31b88e6962cbeb22937cbc6c204d4be52ff3a028ad11548642","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"447c5936a6c41d1d4a2b66a5f2ddeaa0994dcac2bd2658e941b389cab81c15ac"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:58.901Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/3/note","value":"Documented gate host pin raised to 2026.10.4"},{"op":"replace","path":"/metadata/files/3/path","value":"README.md"},{"op":"add","path":"/metadata/files/4","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:58.901Z"}],"before_hash":"6f57e68877fe0a31b88e6962cbeb22937cbc6c204d4be52ff3a028ad11548642","after_hash":"af165bdb3854a65eccc519fb938ccf86e44b72b005256ea27a4e414c72b028db","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"53d1840eb7e400a46dec1fc8f685577782c9101deb375e0972b8b8c5886a2dbf"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:59.844Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/4/note","value":"Documented gate host pin raised to 2026.10.4"},{"op":"replace","path":"/metadata/files/4/path","value":"README.md"},{"op":"replace","path":"/metadata/files/3/note","value":"Exact CLI/SDK/ops/changelog pins"},{"op":"replace","path":"/metadata/files/3/path","value":"package.json"},{"op":"replace","path":"/metadata/files/2/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/2/path","value":"package-lock.json"},{"op":"replace","path":"/metadata/files/1/note","value":"codeql-action pinned SHA group 1c5b6756"},{"op":"replace","path":"/metadata/files/1/path","value":".github/workflows/codeql.yml"},{"op":"replace","path":"/metadata/files/0/note","value":"pm-github 2026.9.26 managed extension registration"},{"op":"replace","path":"/metadata/files/0/path","value":".agents/pm/extensions/.managed-extensions.json"},{"op":"add","path":"/metadata/files/5","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:59.844Z"}],"before_hash":"af165bdb3854a65eccc519fb938ccf86e44b72b005256ea27a4e414c72b028db","after_hash":"99b2b0fce4538fd9c9c3867ac218332dea47f3b9e378c194cbf8147619ca156c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"110ee20f211c6e288ef0dfa8f752b8fb73da1d8fcd1dfd7846fbd9882a328b23"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:26:57.559Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:26:57.559Z"},{"op":"add","path":"/metadata/actual_result","value":"Pins raised: @unbrained/pm-cli 2026.10.4 (exact), pm-ops 2026.10.4, pm-changelog 2026.9.25; consolidated Dependabot #137/#142/#143/#144/#145 via lockfile (eslint 10.12.0, jscpd 5.4.0, @types/node 26.6.4 - newer than proposed where available) and #140 via codeql-action SHA 1c5b6756 group. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. Full npm run release:check PASS: 235/235 tests, zero skipped, 100/100/100 coverage across index.ts and docstring-gate.ts, docstring 71 declarations, jscpd 0 clones, audit clean (0 vulnerabilities, dev included), pack dry-run and accept:packed green (npm-current/bun-current/npm-minimum scenarios on 2026.10.4), changelog check green. npx pm health: exit 0, one advisory (stale_in_progress_items from the prior cycle item). Real-tracker dogfood on packed tarball passed via npx and bunx (csv export/validate/import incl. --key upsert idempotency). pm-github 2026.9.26 managed extension installed; validate/export --dry-run/sync --dry-run previews only, no GitHub mutation. npm test harness run of release:check collided with the pm test sandbox env (ancestor tracker discovery) - infra_collision, not a gate failure; direct gate run is authoritative and green."}],"before_hash":"99b2b0fce4538fd9c9c3867ac218332dea47f3b9e378c194cbf8147619ca156c","after_hash":"25c4fa7699fb8dfacd0f7bc5527f7d3d55dc7d7f267be59e212e27c57639fd5c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"24a10ff5c00dc1104119fc1c10181a5362a99946d4e1676219a8e199bde2ac99"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:27:03.884Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:27:03.884Z"}],"before_hash":"25c4fa7699fb8dfacd0f7bc5527f7d3d55dc7d7f267be59e212e27c57639fd5c","after_hash":"6a321b253e4d9339e722867857a1ef8a2f9c9ba58670c2c379bc3a73187edb40","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"cac9655d400a13a0dcff091786d27241db891019d6ec1f93f8045d789e168a43"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:19:39.515Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/3","value":{"created_at":"2026-10-04T10:19:39.515Z","author":"pi-glm","text":"Correction: pm-github 2026.10.4 was published mid-certification; the managed project extension was upgraded from 2026.9.26 to 2026.10.4 (latest npm). Re-ran read-only previews against unbraind/pm-csv: validate ok (HTTP 200, quota 4871/5000), sync --dry-run -> wouldSync 1, no mutation. Still no issues created/modified, no scheduled sync."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:19:39.515Z"}],"before_hash":"6a321b253e4d9339e722867857a1ef8a2f9c9ba58670c2c379bc3a73187edb40","after_hash":"fee75b68819c50f670c11e4347a80afaf4aaa18db640f0e1647371a7c253a0cf","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"1d108d8ec81039dab55c596e927e86e04671a31b392b9f88d7c1f6a865102697"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:19:41.350Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:19:41.350Z"}],"before_hash":"fee75b68819c50f670c11e4347a80afaf4aaa18db640f0e1647371a7c253a0cf","after_hash":"50ef7f09b18f7c01b722a761e82f338aa292f31b7d7cf9013dd20cf726812dc5","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"e65c9295def57ded9437774e2c4ef0a0d0feaf745ca6625dbd40fbd8bbfeae22"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:48:41.663Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:48:41.663Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"50ef7f09b18f7c01b722a761e82f338aa292f31b7d7cf9013dd20cf726812dc5","after_hash":"dd257c88012933197e34da75df931a5c8b896db472bb51a5cb70b469d32c4ac4","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"fb93f4cd3db8857d1a93b786a03d38d53e7c233f966f470af6437622c28e70b6"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:48:42.360Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/4","value":{"created_at":"2026-10-04T10:48:42.360Z","author":"codex-sol","text":"Resumed after provider quota exhaustion. Re-read PR #146, existing author comments/reactions and Greptile thread. Rebased onto origin/main 7473779; addressing missing broken-install/lookup regression fixtures, exact devDependency pins, and newly published pm-changelog 2026.10.4 before rerunning the locked full gate."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:48:42.360Z"}],"before_hash":"dd257c88012933197e34da75df931a5c8b896db472bb51a5cb70b469d32c4ac4","after_hash":"a0e799ca46a573f11465fde3ba8b9f0c9292d967b85139699db72763f976a623","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"93a5847ee5468a76953774af0827e1ebdd00e1ec2e90dc9fe16dc7e827671cfd"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:50:40.867Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/6","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:50:40.867Z"}],"before_hash":"a0e799ca46a573f11465fde3ba8b9f0c9292d967b85139699db72763f976a623","after_hash":"ab28cbf07294fff9fc67d85ffc12fb74e2a35d911ee7439f1c91266ae51983f6","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"900842e5e4490dda5e36127453ca0f988d571d431460fee58ff56e53f02b9ac6"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:50:42.059Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/4","value":{"command":"node --test test/prepare-merge-driver.test.ts","scope":"project","pm_context_mode":"none","provenance":{"author":"codex-sol","created_at":"2026-10-04T10:50:41.998Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:50:42.059Z"}],"before_hash":"ab28cbf07294fff9fc67d85ffc12fb74e2a35d911ee7439f1c91266ae51983f6","after_hash":"ca6760e6cd70fa1b9b3986a518ea3ed33ac8c79832279d9f83bea9ca551168d2","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"deff2dcb57779f802491a73ce283c6c624b83fc6f50b686a567e8044c7d3e6ac"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:50:43.600Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/5","value":{"created_at":"2026-10-04T10:50:43.600Z","author":"codex-sol","text":"Greptile regression request verified: 9/9 launcher tests pass, zero skips, including incomplete package directory, dangling pm-ops symlink, and looping NODE_PATH. All assert a nonzero result and preserve the original installer diagnostic; canonical launcher is unchanged."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:50:43.600Z"}],"before_hash":"ca6760e6cd70fa1b9b3986a518ea3ed33ac8c79832279d9f83bea9ca551168d2","after_hash":"11f7fb009a3597ede5ff84cee69600b50f31a95ee7946f779b13e9c399744ff2","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5fcff62505f345572fdcf88667fa70af6733ac074c394bd998116bdc9262d154"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:52:58.812Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/6","value":{"created_at":"2026-10-04T10:52:58.812Z","author":"codex-sol","text":"All devDependencies now use exact installed versions; pm-changelog upgraded to latest published 2026.10.4. The linked launcher run passed 9/9 using explicit tracker context (none requires an isolated/snapshot source mode; reserved PM_PATH env clearing was correctly rejected). No gate changes."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:52:58.812Z"}],"before_hash":"11f7fb009a3597ede5ff84cee69600b50f31a95ee7946f779b13e9c399744ff2","after_hash":"20e70f3a353f8ae4163e330214ef8e999f551465ffd25bd89287f9c33d6322b0","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"6d71a3eed1036cd99e78343e73b4375a1bc25c128e27239d905c2f76cca378e1"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:57:36.785Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/7","value":{"created_at":"2026-10-04T10:57:36.785Z","author":"codex-sol","text":"Resumption validation PASS after rebase and exact pins: clean npm ci; flock-serialized npm run release:check passed 238/238 tests, 0 skipped, measured lines/branches/functions 100/100/100 across the existing two-source gate. Audits all/prod each 0. Packed pm-csv-2026.10.4.tgz installed into a fresh copy of this real tracker; npx -y @unbrained/pm-cli@2026.10.4 csv export --output real.csv exported 107; csv validate real.csv clean; csv import input.csv --key title created 1 then updated 1. bunx @unbrained/pm-cli@2026.10.4 csv export --output real-bun.csv exported 108; validate clean; import --key title updated 1. Scratch deleted. npx pm health ok with one prior-item stale advisory. Managed pm-github 2026.10.4 sync --dry-run --repo unbraind/pm-csv: wouldSync 1, no writes. Review availability remains separate from green gates."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:57:36.785Z"}],"before_hash":"20e70f3a353f8ae4163e330214ef8e999f551465ffd25bd89287f9c33d6322b0","after_hash":"a167ba451ea2c4eddaea01b1a7bf3ddbbfa3baf1836e9bae1808aef528322046","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"537d646f4b308d792990a81011623355b663679a22351507a71bc78ca49922e8"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:57:37.843Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"Resumed candidate rebased onto main release 7473779. Every devDependency exact; CLI/ops/changelog 2026.10.4, resolved Dependabot versions retained. Canonical launcher unchanged; 3 Greptile regression cases added. Clean npm ci and full release:check PASS: 238/238, zero skipped, 100/100/100 measured lines/branches/functions (2 sources). npm audit and audit --omit=dev: 0. Packed current-version tarball npx/bunx real tracker dogfood passed: 107 original exports, 108 after 1 isolated create; repeated imports update 1 with no duplicate. pm health ok, one prior stale-item advisory; read-only pm-github preview wouldSync 1. Pending reviewer availability is missing evidence; leave open."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:57:37.843Z"}],"before_hash":"a167ba451ea2c4eddaea01b1a7bf3ddbbfa3baf1836e9bae1808aef528322046","after_hash":"bdeff7a435aaa0cf51b96ed8fbb0848b808ffdbc7e3284ef1530b5f84e075437","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"03f170caa85a3b5e5610a00db1e1b9eff19d47aadd26606e532566a99b91e169"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:57:38.897Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:57:38.897Z"}],"before_hash":"bdeff7a435aaa0cf51b96ed8fbb0848b808ffdbc7e3284ef1530b5f84e075437","after_hash":"f4e88e2d7da9b108e76e0f74741d74609ce2b5a8a4d998c5281b1cf9c799bfca","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b613a5a69111d9fb46952822b3c6ed55c87c38256661a281077c78b41a55e7af"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:59:47.750Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:59:47.750Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"f4e88e2d7da9b108e76e0f74741d74609ce2b5a8a4d998c5281b1cf9c799bfca","after_hash":"8a53279f9177370ebf94219563dadb3ee8bcb3c0c948fe28dee34cb2d165e33c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5d1d5c304a37a24302323816b8383ad98f2556140cf4e7e4103f5bb799fbb550"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:59:48.449Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/8","value":{"created_at":"2026-10-04T10:59:48.449Z","author":"codex-sol","text":"The three new regression fixtures run unconditionally; no new platform skips were added. Rechecked 9/9 launcher tests, zero skips. Linux full-gate behavior and the validated canonical launcher remain unchanged."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:59:48.449Z"}],"before_hash":"8a53279f9177370ebf94219563dadb3ee8bcb3c0c948fe28dee34cb2d165e33c","after_hash":"24a4b341c635c5c39eb4e18a8a4ca81d37cf27271c6e894c1fb74d1f21565899","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"269e1cb819f64c231140f845c76decd7c6f6462382a73877b1fe4e126b46c6fb"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:59:49.048Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:59:49.048Z"}],"before_hash":"24a4b341c635c5c39eb4e18a8a4ca81d37cf27271c6e894c1fb74d1f21565899","after_hash":"fa9d8c5bd2e07bbb5214d619a041db5973c6f3c6337f7cac05b2f0e5ba0f9230","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"d32cbc4bba306602f0fae0c508e9c5ff38ecf40f09911850cead8d811ab99527"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:10:14.615Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:10:14.615Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"fa9d8c5bd2e07bbb5214d619a041db5973c6f3c6337f7cac05b2f0e5ba0f9230","after_hash":"e41e612210ba433399712d2251a19cd55345ee60f335734e34397d6ad4300bfa","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"662c63ab36bd4d0f281b0c12f14fc8df493b6f526fa98ffa2f5df696d492cc66"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:10:15.475Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/9","value":{"created_at":"2026-10-04T11:10:15.475Z","author":"codex-sol","text":"Review round 2: Greptile found Windows symbolic-link privilege requirements in the new unconditional fixtures. Use symlinkSync type junction with absolute targets, which Node applies only on Windows (ignored on POSIX), retaining all scenarios without new skips. Linux launcher suite still passes 9/9; a Windows runner is unavailable. Canonical launcher remains unchanged; rerun the full locked release gate before push."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:10:15.475Z"}],"before_hash":"e41e612210ba433399712d2251a19cd55345ee60f335734e34397d6ad4300bfa","after_hash":"621f6ded9968f82c3e5ed25a22b9e197e6387d17ddeb93dcd4ad3908050881d5","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"d8068b7123e48a419b48dd47c3c518c69183b0f57e0f50a8fbe0290c4d575ac2"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:19:02.791Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/5","value":{"command":"env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts","scope":"project","pm_context_mode":"tracker","provenance":{"author":"codex-sol","created_at":"2026-10-04T11:19:02.676Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:19:02.791Z"}],"before_hash":"621f6ded9968f82c3e5ed25a22b9e197e6387d17ddeb93dcd4ad3908050881d5","after_hash":"913ec691c00302469afb5160a4ca4c3fcf3535d675b663641391ed4b2b209be4","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"8568b6b730a4a4e1417903232c089d6e2d1eaa90cceb78f6ee59b01500a5bcc5"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:22:55.937Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/10","value":{"created_at":"2026-10-04T11:22:55.937Z","author":"codex-sol","text":"Review correction validation PASS: full flock-serialized npm run release:check re-run after portable junction and ambient NODE_PATH isolation changes: 238/238 tests, zero skips, measured 100/100/100 thresholds met, audits/packed current npm/Bun/minimum-host acceptance/changelog/attestation/date gates green. Linked hostile run env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts also passes 9/9. Windows execution is not available; junction fixture API follows https://nodejs.org/api/fs.html#fssymlinksynctarget-path-type. Production package unchanged; real-tracker dogfood from this certification remains applicable."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:22:55.937Z"}],"before_hash":"913ec691c00302469afb5160a4ca4c3fcf3535d675b663641391ed4b2b209be4","after_hash":"8d7a433d945163c10fd73756dc0dede51374c557c0216deefaa1d7755b596011","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"f36b22a251946d77532a1b530c87907a35984469967d7187e5d12958f109e4bd"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:22:56.589Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:22:56.589Z"}],"before_hash":"8d7a433d945163c10fd73756dc0dede51374c557c0216deefaa1d7755b596011","after_hash":"b65f21364cc508d16053c090f4e6dd286fa1aa2ab615c5b0b421bf835e9ee312","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"021700d8e356fc7b437f1762c36f0429be642018a0e613af303ed5cc9e33a968"} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7d481d7..e69672c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,13 +28,13 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: languages: javascript-typescript # These packages are analyzed from source without a compiled build. build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: category: "/language:javascript-typescript" diff --git a/README.md b/README.md index 06060db..396dedd 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ CSV importer and exporter for [pm-cli](https://github.com/unbraind/pm-cli). Import pm items from a CSV file, export them back out, or wire up a programmatic `csv-import` importer — all with zero external runtime dependencies. The extension requires pm CLI 2026.8.20 or newer. Its development and release -gates are pinned to pm CLI/SDK 2026.9.28 so host behavior stays reproducible. +gates are pinned to pm CLI/SDK 2026.10.4 so host behavior stays reproducible. --- diff --git a/package-lock.json b/package-lock.json index c438a13..771ee26 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,16 +9,16 @@ "version": "2026.10.4", "license": "MIT", "devDependencies": { - "@babel/eslint-parser": "^8.0.1", - "@babel/plugin-syntax-typescript": "^8.0.3", - "@types/node": "^26.1.1", - "@unbrained/pm-cli": "2026.9.28", - "eslint": "^10.8.1", - "jiti": "^2.7.0", - "jscpd": "^5.0.16", - "pm-changelog": "2026.9.23", - "pm-ops": "2026.9.23", - "typescript": "^7.0.2", + "@babel/eslint-parser": "8.0.6", + "@babel/plugin-syntax-typescript": "8.0.3", + "@types/node": "26.6.4", + "@unbrained/pm-cli": "2026.10.4", + "eslint": "10.12.0", + "jiti": "2.7.0", + "jscpd": "5.4.0", + "pm-changelog": "2026.10.4", + "pm-ops": "2026.10.4", + "typescript": "7.0.2", "yaml": "2.9.1" }, "engines": { @@ -576,44 +576,6 @@ "dev": true, "license": "MIT" }, - "node_modules/@nodelib/fs.scandir": { - "version": "2.1.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz", - "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "2.0.5", - "run-parallel": "^1.1.9" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.stat": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz", - "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.walk": { - "version": "1.2.8", - "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz", - "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.scandir": "2.1.5", - "fastq": "^1.6.0" - }, - "engines": { - "node": ">= 8" - } - }, "node_modules/@opentelemetry/api": { "version": "1.9.1", "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz", @@ -897,9 +859,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.6.1", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.1.tgz", - "integrity": "sha512-VqGJBMCtdhqkBUCcBLvywI0NJ+KLuVzgNnlBUNFOQjqVxzo2lxLUNg1DSey8+u2u6ktswSAxg+s68QLzWHNOuA==", + "version": "26.6.4", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.4.tgz", + "integrity": "sha512-ldVPDCzj7fsaGZrLB0NuHuTvJcsNasysBAqMolr/cgxrLd1xbqxIr3XJiPnHHJUCxj5sNF1vnRj9aWnrVh5Jcg==", "dev": true, "license": "MIT", "dependencies": { @@ -1247,9 +1209,9 @@ } }, "node_modules/@unbrained/pm-cli": { - "version": "2026.9.28", - "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.9.28.tgz", - "integrity": "sha512-bbyq/FIKMUxnGKJTieG3AVL96tS4l9JUuTgzgAiZTqI7lYyLXytmQFVD1a+2neVQT9+6sVNF8ko2u7DcqztxjQ==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.10.4.tgz", + "integrity": "sha512-NZLdiUSUKIRcFiMj9lG0L5UubA9G33fq5WzB1JzJjTTlYxYCVjrFFOCV2rtxYTaYTCzX9o/6V/A4fDx6N3mm/w==", "dev": true, "license": "MIT", "dependencies": { @@ -1257,10 +1219,10 @@ "@toon-format/toon": "^4.1.1", "@types/node": ">=22", "commander": "^15.0.0", - "fast-glob": "^3.3.3", "fast-json-patch": "^3.1.1", "npm-package-arg": "^13.0.2", "tar": "7.5.22", + "tinyglobby": "^0.2.17", "yaml": "^2.9.1" }, "bin": { @@ -1350,19 +1312,6 @@ "node": "20 || >=22" } }, - "node_modules/braces": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", - "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==", - "dev": true, - "license": "MIT", - "dependencies": { - "fill-range": "^7.1.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/browserslist": { "version": "4.28.8", "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz", @@ -1560,9 +1509,9 @@ } }, "node_modules/eslint": { - "version": "10.10.0", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.10.0.tgz", - "integrity": "sha512-NPXn6r5zl4uET1DAVPaOwzX3rut4c0wcmw3dWJAfOsTM5+TogXo0DDjz8pwm/hL8cyVNpHqeK4JpN0NjnyFFNw==", + "version": "10.12.0", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.12.0.tgz", + "integrity": "sha512-npHjrHb2o4ehH3mE+YuxABR+0gyb0aVWCIolgJDArwCiHEIsonBm3ZKjel5b0U5+a+MbEvIyRCGCzD3eKKK2NA==", "dev": true, "license": "MIT", "workspaces": [ @@ -1734,23 +1683,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fast-glob": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz", - "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "^2.0.2", - "@nodelib/fs.walk": "^1.2.3", - "glob-parent": "^5.1.2", - "merge2": "^1.3.0", - "micromatch": "^4.0.8" - }, - "engines": { - "node": ">=8.6.0" - } - }, "node_modules/fast-json-patch": { "version": "3.1.1", "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz", @@ -1772,16 +1704,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fastq": { - "version": "1.20.1", - "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz", - "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==", - "dev": true, - "license": "ISC", - "dependencies": { - "reusify": "^1.0.4" - } - }, "node_modules/file-entry-cache": { "version": "11.1.5", "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-11.1.5.tgz", @@ -1792,19 +1714,6 @@ "flat-cache": "^6.1.23" } }, - "node_modules/fill-range": { - "version": "7.1.1", - "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz", - "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==", - "dev": true, - "license": "MIT", - "dependencies": { - "to-regex-range": "^5.0.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/find-up": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz", @@ -1852,19 +1761,6 @@ "node": ">=6.9.0" } }, - "node_modules/glob-parent": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", - "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", - "dev": true, - "license": "ISC", - "dependencies": { - "is-glob": "^4.0.1" - }, - "engines": { - "node": ">= 6" - } - }, "node_modules/hashery": { "version": "1.5.1", "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz", @@ -1968,16 +1864,6 @@ "node": ">=0.10.0" } }, - "node_modules/is-number": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz", - "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.12.0" - } - }, "node_modules/isexe": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz", @@ -2004,9 +1890,9 @@ "peer": true }, "node_modules/jscpd": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd/-/jscpd-5.3.0.tgz", - "integrity": "sha512-EiGK3H6ZF8jbyiIU1c+iPkgWskcXVoSozfobYIbySK1KPlo+UYmVqSVpKUiLnfoNDOTy9vqACSmiS+JA7xPsQg==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd/-/jscpd-5.4.0.tgz", + "integrity": "sha512-6mU8OHff4rPJ3D5lIsQns82/aQhDas22gMsGurHx1wcrfXWOZDNaobi6rKhLevo+77ntWKUXOwtM6lcrkJeL7w==", "dev": true, "license": "MIT", "bin": { @@ -2019,20 +1905,20 @@ "url": "https://opencollective.com/jscpd" }, "optionalDependencies": { - "jscpd-darwin-arm64": "5.3.0", - "jscpd-darwin-x64": "5.3.0", - "jscpd-linux-arm64-gnu": "5.3.0", - "jscpd-linux-arm64-musl": "5.3.0", - "jscpd-linux-x64-gnu": "5.3.0", - "jscpd-linux-x64-musl": "5.3.0", - "jscpd-windows-arm64-msvc": "5.3.0", - "jscpd-windows-x64-msvc": "5.3.0" + "jscpd-darwin-arm64": "5.4.0", + "jscpd-darwin-x64": "5.4.0", + "jscpd-linux-arm64-gnu": "5.4.0", + "jscpd-linux-arm64-musl": "5.4.0", + "jscpd-linux-x64-gnu": "5.4.0", + "jscpd-linux-x64-musl": "5.4.0", + "jscpd-windows-arm64-msvc": "5.4.0", + "jscpd-windows-x64-msvc": "5.4.0" } }, "node_modules/jscpd-darwin-arm64": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-darwin-arm64/-/jscpd-darwin-arm64-5.3.0.tgz", - "integrity": "sha512-kH4O+vgWtWbaE42+KejOmDZW9nB4WqsbX+NxAQPwVxZg1TQTM2bhDhYdQo+MHpN+vf4HpQ+dOCsARBn2ri+ing==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-darwin-arm64/-/jscpd-darwin-arm64-5.4.0.tgz", + "integrity": "sha512-fNIDtNn9WE4YXoFoqf+3tkHb1+GaKKOeKzh77Wx61Gfa9iDxlCv5rO0Fjy7oWmGehUUKqslDaeXXtn/RoDprCg==", "cpu": [ "arm64" ], @@ -2044,9 +1930,9 @@ ] }, "node_modules/jscpd-darwin-x64": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-darwin-x64/-/jscpd-darwin-x64-5.3.0.tgz", - "integrity": "sha512-IMobUmmZcrxKbziuni93ljtIMtAyPY4lFPNcopgTOFwO3vlHeYZV1r0sY8eP0APvW5BSFW2nBA/WG5+EezYpYw==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-darwin-x64/-/jscpd-darwin-x64-5.4.0.tgz", + "integrity": "sha512-bxlnCVEb69SGIsas1+PaqZyFY8iYVTVjCBxfjVD74UafX115Ysw+oO9LAlsJaGsKUnK8Zsq5bhM33kBHux6bTA==", "cpu": [ "x64" ], @@ -2058,9 +1944,9 @@ ] }, "node_modules/jscpd-linux-arm64-gnu": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-gnu/-/jscpd-linux-arm64-gnu-5.3.0.tgz", - "integrity": "sha512-VdN3g485lHqGxysAuij0KkDh4HSczUOJ8d8rXdCBSYBBqIrSMkVtfy7iug7GUhGkLZ7qukTkgvZs0P7mEMH8Yw==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-gnu/-/jscpd-linux-arm64-gnu-5.4.0.tgz", + "integrity": "sha512-c4hX5QjuRyzLFJ+A+jNGHRpGlDvxcx+zzs4RJmZHpl23istuTMIkelwTOWliF4gXOm0RWXDlX/ywWKr9+Lre7w==", "cpu": [ "arm64" ], @@ -2075,9 +1961,9 @@ ] }, "node_modules/jscpd-linux-arm64-musl": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-musl/-/jscpd-linux-arm64-musl-5.3.0.tgz", - "integrity": "sha512-96JQfVFcSBjoUwqFeEQQ4c2wHHT4kE+LqZtEayc6ko3Ouu1nLJvCnBA5DSOU0HuIvGAVq8A2CmkWJ6I1XCCt/A==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-musl/-/jscpd-linux-arm64-musl-5.4.0.tgz", + "integrity": "sha512-p4FUCNyL8WPTlizdZqfjontFwJ/+jnERYM2+YX2miYvm0NxzsIi23MhfzPl/eUHxkiT5wethV0NRYEAkJr999Q==", "cpu": [ "arm64" ], @@ -2092,9 +1978,9 @@ ] }, "node_modules/jscpd-linux-x64-gnu": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-linux-x64-gnu/-/jscpd-linux-x64-gnu-5.3.0.tgz", - "integrity": "sha512-teMMfXFE1iAJ2rgqxRUOxX6U7glr//8WKZhEH0sRIN6QwstjKmzKlEPEf1UU2rH7JyYlsIGAYcjrWzmJ7wDLcA==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-x64-gnu/-/jscpd-linux-x64-gnu-5.4.0.tgz", + "integrity": "sha512-44NXS0gtYbjBCc53Gwilgj7PPwnWv9YTF/rGc0ZfnFcpzSoOKKU11yH+qHfCVie1hHte1wHyZ1f9Kjc8nGe2/g==", "cpu": [ "x64" ], @@ -2109,9 +1995,9 @@ ] }, "node_modules/jscpd-linux-x64-musl": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-linux-x64-musl/-/jscpd-linux-x64-musl-5.3.0.tgz", - "integrity": "sha512-mVsivu/awa17BwOZbnkGo/H8P1IedckXswuT5ZwYXkgpVD//ken4HjjcUO8+fwxu3cRbk0qycdLfP/B1VAtAMA==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-x64-musl/-/jscpd-linux-x64-musl-5.4.0.tgz", + "integrity": "sha512-m9XHj14Zwia9RjWDkHDrl6VJ3W/b7m8qjFqjhcJ668Vkxoj4Ri/qeo0bo6is+fSw+bYxYexV6xxqIKRDolc8Lg==", "cpu": [ "x64" ], @@ -2126,9 +2012,9 @@ ] }, "node_modules/jscpd-windows-arm64-msvc": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-windows-arm64-msvc/-/jscpd-windows-arm64-msvc-5.3.0.tgz", - "integrity": "sha512-uzkJo9bY2Er91MFyovQUYOAq06bjoO9E36v7qAhzh0yzhYaQNVchmKrP3qEFjA+5K2DL9jeJCD6JL9q4ZiQyGg==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-windows-arm64-msvc/-/jscpd-windows-arm64-msvc-5.4.0.tgz", + "integrity": "sha512-AoP5RXyb9gIf8xmFwAc+Rgh4XJNyX1upcD+R1A6u4XjsDo2/oF+KKB4dtKnG2DbFQ+0fyFg/ClOcw+asQZJfPg==", "cpu": [ "arm64" ], @@ -2140,9 +2026,9 @@ ] }, "node_modules/jscpd-windows-x64-msvc": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-windows-x64-msvc/-/jscpd-windows-x64-msvc-5.3.0.tgz", - "integrity": "sha512-E9FBk7BzAC6EffvFuV5ggDhXFJW1F6odrdgLe9RaMW9IWjhgHhmliJgse0ehmaqQu9HGNVwx+Cq238U4Cfe5Iw==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-windows-x64-msvc/-/jscpd-windows-x64-msvc-5.4.0.tgz", + "integrity": "sha512-dYkb5mAo5i7fjrtf2Ft6z9a/I38RJMd4JirEgJiW2BIv5pAGmfMVPDy1xEXL3hJqraXzeMIfnzqJFanefCyC6g==", "cpu": [ "x64" ], @@ -2245,30 +2131,6 @@ "node": "20 || >=22" } }, - "node_modules/merge2": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz", - "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/micromatch": { - "version": "4.0.8", - "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz", - "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==", - "dev": true, - "license": "MIT", - "dependencies": { - "braces": "^3.0.3", - "picomatch": "^2.3.1" - }, - "engines": { - "node": ">=8.6" - } - }, "node_modules/minimatch": { "version": "10.2.6", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", @@ -2449,23 +2311,10 @@ "license": "ISC", "peer": true }, - "node_modules/picomatch": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", - "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8.6" - }, - "funding": { - "url": "https://github.com/sponsors/jonschlinkert" - } - }, "node_modules/pm-changelog": { - "version": "2026.9.23", - "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.23.tgz", - "integrity": "sha512-hrHFbRgz/LyiCBN9ic0I1C//SRL/zjU5fxcyCeCAnM2qTrz14A7f9ayMXeiu/ChDkVFMxfz8Ps2j3TuUG6K1QA==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.10.4.tgz", + "integrity": "sha512-YJJHJYv2i+olzGVF+qdab3wWG6auiRVIvf7TZD4ZdUhE/8lIawf3aYOOZZVJHogN8xP8rNUlVV9Lc1OXKLlQ7w==", "dev": true, "license": "MIT", "bin": { @@ -2479,9 +2328,9 @@ } }, "node_modules/pm-ops": { - "version": "2026.9.23", - "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.9.23.tgz", - "integrity": "sha512-FglZHOXjsuG8WWf9Ca90/IX1u4ZCxVTvHpwMaiA0TAWBx/lLalM2Ic12gtWZvm3OAJsMMuXvfRBHWxwYLzESsg==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.10.4.tgz", + "integrity": "sha512-/6ehQBNwKquIol3EUW1r4pZSXKaohHc1gXJUSk7cqQwkVJOSlP8cCcHzNFH76/6O9hG04Eb5KAH90vFkhTxfMQ==", "dev": true, "license": "MIT", "dependencies": { @@ -2567,27 +2416,6 @@ "dev": true, "license": "MIT" }, - "node_modules/queue-microtask": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz", - "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT" - }, "node_modules/require-in-the-middle": { "version": "8.0.1", "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz", @@ -2602,41 +2430,6 @@ "node": ">=9.3.0 || >=8.10.0 <9.0.0" } }, - "node_modules/reusify": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz", - "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==", - "dev": true, - "license": "MIT", - "engines": { - "iojs": ">=1.0.0", - "node": ">=0.10.0" - } - }, - "node_modules/run-parallel": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz", - "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT", - "dependencies": { - "queue-microtask": "^1.2.2" - } - }, "node_modules/semver": { "version": "7.8.5", "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", @@ -2690,17 +2483,52 @@ "node": ">=18" } }, - "node_modules/to-regex-range": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", - "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==", + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", "dev": true, "license": "MIT", "dependencies": { - "is-number": "^7.0.0" + "fdir": "^6.5.0", + "picomatch": "^4.0.4" }, "engines": { - "node": ">=8.0" + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" + } + }, + "node_modules/tinyglobby/node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, + "node_modules/tinyglobby/node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" } }, "node_modules/type-check": { diff --git a/package.json b/package.json index f128636..1a21132 100644 --- a/package.json +++ b/package.json @@ -64,16 +64,16 @@ "@unbrained/pm-cli": ">=2026.8.20" }, "devDependencies": { - "@babel/eslint-parser": "^8.0.1", - "@babel/plugin-syntax-typescript": "^8.0.3", - "@types/node": "^26.1.1", - "@unbrained/pm-cli": "2026.9.28", - "eslint": "^10.8.1", - "jiti": "^2.7.0", - "jscpd": "^5.0.16", - "pm-changelog": "2026.9.23", - "pm-ops": "2026.9.23", - "typescript": "^7.0.2", + "@babel/eslint-parser": "8.0.6", + "@babel/plugin-syntax-typescript": "8.0.3", + "@types/node": "26.6.4", + "@unbrained/pm-cli": "2026.10.4", + "eslint": "10.12.0", + "jiti": "2.7.0", + "jscpd": "5.4.0", + "pm-changelog": "2026.10.4", + "pm-ops": "2026.10.4", + "typescript": "7.0.2", "yaml": "2.9.1" }, "keywords": [ diff --git a/scripts/prepare-merge-driver.ts b/scripts/prepare-merge-driver.ts index 66e512e..f6f49f0 100644 --- a/scripts/prepare-merge-driver.ts +++ b/scripts/prepare-merge-driver.ts @@ -7,13 +7,15 @@ * therefore imports nothing from pm-ops: it resolves the installer entry from * the package root and runs it in a child process. Only a missing pm-ops package skips, with one * notice; any other resolution failure (for example a pm-ops too old to export - * the entry) and any installer failure fail the install. + * the entry, or a `pm-ops` directory whose package.json is gone) and any + * installer failure fail the install. * * Canonical copy: `pm-ops/templates/prepare-merge-driver.ts`. Copy it * unchanged to `scripts/prepare-merge-driver.ts`. */ import { spawnSync } from "node:child_process"; +import { lstatSync } from "node:fs"; import { createRequire } from "node:module"; import { join } from "node:path"; @@ -26,12 +28,33 @@ try { // Only an absent pm-ops package may skip. Probing its package.json tells that // apart from an installed pm-ops that cannot serve the entry (exports without // it, no exports map, a missing file): those resolve or fail differently, and - // the original error is rethrown. + // the original error is rethrown. A probe that finds no package.json is not + // yet proof of absence: a broken install can leave `node_modules/pm-ops` (a + // directory or a dangling link) with no package.json in any ancestor Node + // searches. Such an entry also counts as present. Keep Node's global paths + // too: the installer resolution above can use them, so an absent local + // package alone cannot prove absence. An unreadable or malformed lookup path + // leaves presence uncertain and must fail closed with the original error. + // Node returns null paths only for built-in modules; pm-ops/package.json is + // a package specifier. let packagePresent = true; try { resolver.resolve("pm-ops/package.json"); } catch (probe) { - packagePresent = !(probe instanceof Error && "code" in probe && probe.code === "MODULE_NOT_FOUND"); + packagePresent = + !(probe instanceof Error && "code" in probe && probe.code === "MODULE_NOT_FOUND") || + resolver.resolve.paths("pm-ops/package.json")!.some( + (directory) => { + try { + return lstatSync(join(directory, "pm-ops"), { throwIfNoEntry: false }) !== undefined; + } catch { + // throwIfNoEntry:false only suppresses ENOENT, not EACCES, EPERM, + // ENOTDIR, or ELOOP. Do not replace the installer diagnostic or + // treat an inconclusive presence check as an omit-dev install. + return true; + } + }, + ); } if (packagePresent) throw error; } diff --git a/test/prepare-merge-driver.test.ts b/test/prepare-merge-driver.test.ts index c3bb230..7ab978c 100644 --- a/test/prepare-merge-driver.test.ts +++ b/test/prepare-merge-driver.test.ts @@ -67,7 +67,7 @@ function stubPm(name: string, status: number, body = ""): string { /** Run the launcher as npm's `prepare` hook would: as the entry point, from `cwd`, with `path` as PATH. */ function prepare(cwd: string, path: string): SpawnSyncReturns { - return spawnSync(process.execPath, [launcher], { cwd, encoding: "utf8", env: { ...process.env, PATH: path } }); + return spawnSync(process.execPath, [launcher], { cwd, encoding: "utf8", env: { ...process.env, PATH: path, NODE_PATH: "" } }); } /** The merge drivers registered in a checkout's LOCAL Git config, by name. */ @@ -109,6 +109,42 @@ test("a pm-ops too old to export the launcher entry fails the install", posixOnl assert.match(result.stderr, /ERR_PACKAGE_PATH_NOT_EXPORTED/); }); +test("an incomplete pm-ops directory fails instead of reporting an omit-dev install", () => { + const directory = checkout("incomplete", "absent"); + mkdirSync(join(directory, "node_modules", "pm-ops"), { recursive: true }); + const result = prepare(directory, hostPath); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install/); + assert.deepEqual(registeredDrivers(directory), []); +}); + +test("a dangling pm-ops link fails instead of reporting an omit-dev install", () => { + const directory = checkout("dangling", "absent"); + mkdirSync(join(directory, "node_modules")); + symlinkSync(join(directory, "missing-pm-ops"), join(directory, "node_modules", "pm-ops"), "junction"); + const result = prepare(directory, hostPath); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install/); + assert.deepEqual(registeredDrivers(directory), []); +}); + +test("a looping lookup path preserves the original installer error", () => { + const directory = checkout("lookup-loop", "absent"); + const lookup = join(directory, "lookup"); + symlinkSync(lookup, lookup, "junction"); + const result = spawnSync(process.execPath, [launcher], { + cwd: directory, + encoding: "utf8", + env: { ...process.env, PATH: hostPath, NODE_PATH: lookup }, + }); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install|ELOOP|lstat/); + assert.deepEqual(registeredDrivers(directory), []); +}); + test("a failing pm merge install fails the install with the same status", posixOnly, () => { const result = prepare(checkout("failing-pm", "pinned"), stubPm("failing-pm", 7)); assert.equal(result.status, 7, result.stderr);