From 6828dd045a757f18f153da32063ffadc579fb314 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 11:30:29 +0200 Subject: [PATCH 1/5] Certify pm-csv on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates Pin @unbrained/pm-cli to 2026.10.4 with pm-ops 2026.10.4 and pm-changelog 2026.9.25, take over the pending Dependabot dependency updates (eslint 10.12.0, jscpd 5.4.0, @types/node 26.6.4) and the codeql-action pinned SHA group, and recopy the canonical pm-ops merge-driver launcher byte-for-byte. README gate host pin follows the dev dependency. pm-github is registered as a managed extension for read-only preview only. Supersedes #137 #142 #143 #144 #145 #140. --- .agents/pm/chores/pm-csv-hzn7.toon | 29 +++ .agents/pm/history/pm-csv-hzn7.jsonl | 18 ++ .github/workflows/codeql.yml | 4 +- README.md | 2 +- package-lock.json | 362 +++++++-------------------- package.json | 6 +- scripts/prepare-merge-driver.ts | 29 ++- 7 files changed, 174 insertions(+), 276 deletions(-) create mode 100644 .agents/pm/chores/pm-csv-hzn7.toon create mode 100644 .agents/pm/history/pm-csv-hzn7.jsonl diff --git a/.agents/pm/chores/pm-csv-hzn7.toon b/.agents/pm/chores/pm-csv-hzn7.toon new file mode 100644 index 00000000..240990a3 --- /dev/null +++ b/.agents/pm/chores/pm-csv-hzn7.toon @@ -0,0 +1,29 @@ +id: pm-csv-hzn7 +title: Certify pm-csv on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates +description: "Bump the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops and pm-changelog latest, take over the open Dependabot dependency updates (@types/node, jscpd, eslint) and the pinned codeql-action SHA group, keep the canonical pm-ops merge-driver launcher byte-identical, and certify with the full release gate plus isolated real-tracker dogfooding on npm and Bun." +type: Chore +status: in_progress +priority: 2 +tags[4]: cli,dependencies,release-readiness,sdk +created_at: "2026-10-04T08:43:00.128Z" +updated_at: "2026-10-04T09:27:03.884Z" +author: pi-glm +acceptance_criteria: "npm run release:check passes with 100/100/100 coverage and clean npm audit including dev; pm health with the repo-pinned 2026.10.4 binary reports no gate-failing findings; packed tarball passes real-tracker import/export scenarios via npx @unbrained/pm-cli@2026.10.4 and bunx; pm-github managed extension installed with a read-only sync preview only" +actual_result: "Pins raised: @unbrained/pm-cli 2026.10.4 (exact), pm-ops 2026.10.4, pm-changelog 2026.9.25; consolidated Dependabot #137/#142/#143/#144/#145 via lockfile (eslint 10.12.0, jscpd 5.4.0, @types/node 26.6.4 - newer than proposed where available) and #140 via codeql-action SHA 1c5b6756 group. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. Full npm run release:check PASS: 235/235 tests, zero skipped, 100/100/100 coverage across index.ts and docstring-gate.ts, docstring 71 declarations, jscpd 0 clones, audit clean (0 vulnerabilities, dev included), pack dry-run and accept:packed green (npm-current/bun-current/npm-minimum scenarios on 2026.10.4), changelog check green. npx pm health: exit 0, one advisory (stale_in_progress_items from the prior cycle item). Real-tracker dogfood on packed tarball passed via npx and bunx (csv export/validate/import incl. --key upsert idempotency). pm-github 2026.9.26 managed extension installed; validate/export --dry-run/sync --dry-run previews only, no GitHub mutation. npm test harness run of release:check collided with the pm test sandbox env (ancestor tracker discovery) - infra_collision, not a gate failure; direct gate run is authoritative and green." +comments[3]{created_at,author,text}: + "2026-10-04T08:43:08.758Z",pi-glm,"Starting: worktree chore/pm-csv-pm-cli-2026-10-4 at c135b94. Plan: bump @unbrained/pm-cli 2026.9.28->2026.10.4, pm-ops 2026.9.23->2026.10.4, pm-changelog 2026.9.23->2026.9.25; consolidate Dependabot #137 (eslint 10.11.0), #142 (jscpd 5.4.0), #143 (pm-ops), #144 (@types/node 26.6.3), #145 (pm-changelog), #140 (codeql-action SHA 1c5b6756...); re-copy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + dogfood on npm/bun." + "2026-10-04T09:13:17.909Z",pi-glm,"Real-tracker dogfood PASS. Packed pm-csv-2026.9.26.tgz installed into a scratch copy of this repo's real .agents/pm (107 items). Registered via pm package install ./node_modules/pm-csv with pm-cli 2026.10.4 (capabilities commands/importers/schema). npm path (npx -y @unbrained/pm-cli@2026.10.4): csv export -> 107 items; csv export --status open -> 6; csv validate -> 107 rows clean; csv import -> imported 1; csv import --key title -> updated 1 (upsert verified idempotent, no duplicate). bun path (bunx @unbrained/pm-cli@2026.10.4): csv export -> 109 items; csv validate -> clean; csv import --key title --source bunx-cert -> updated 1. All commands exit 0 with correct real data round-trip. Scratch dir deleted after evidence capture." + "2026-10-04T09:14:03.016Z",pi-glm,"pm-github installed as managed project extension at latest npm 2026.9.26 (.agents/pm/extensions/.managed-extensions.json, capabilities commands/hooks/importers/preflight/schema/search). Read-only preview against unbraind/pm-csv: pm github validate --repo unbraind/pm-csv -> ok (token via gh CLI, repo HTTP 200, quota 4952/5000); pm github export --repo unbraind/pm-csv --dry-run -> plan only, writes nothing (create/update actions listed for real items incl. linked gh:unbraind/pm-csv#72); pm github sync --dry-run --repo unbraind/pm-csv -> wouldSync 1, no mutation. No issues created/modified, no scheduled sync enabled." +files[6]{path,scope,note}: + .agents/pm/extensions/.managed-extensions.json,project,pm-github 2026.9.26 managed extension registration + .github/workflows/codeql.yml,project,codeql-action pinned SHA group 1c5b6756 + package-lock.json,project,Resolved dependency graph with consolidated Dependabot bumps + package.json,project,Exact CLI/SDK/ops/changelog pins + README.md,project,Documented gate host pin raised to 2026.10.4 + scripts/prepare-merge-driver.ts,project,Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte +tests[4]{command,scope,provenance{author,created_at,source_kind,source_ref}}: + npx -y @unbrained/pm-cli@2026.10.4 csv export --output dogfood-export.csv,project,pi-glm,"2026-10-04T09:13:17.786Z",local_mutation,chore/pm-csv-pm-cli-2026-10-4 + bunx @unbrained/pm-cli@2026.10.4 csv import dogfood-import.csv --key title --source bunx-cert,project,pi-glm,"2026-10-04T09:13:18.328Z",local_mutation,chore/pm-csv-pm-cli-2026-10-4 + "npm run release:check",project,pi-glm,"2026-10-04T09:14:13.739Z",local_mutation,chore/pm-csv-pm-cli-2026-10-4 + npx pm health,project,pi-glm,"2026-10-04T09:14:15.089Z",local_mutation,chore/pm-csv-pm-cli-2026-10-4 +body: "" diff --git a/.agents/pm/history/pm-csv-hzn7.jsonl b/.agents/pm/history/pm-csv-hzn7.jsonl new file mode 100644 index 00000000..3796aae3 --- /dev/null +++ b/.agents/pm/history/pm-csv-hzn7.jsonl @@ -0,0 +1,18 @@ +{"hash_algorithm":"sha256","ts":"2026-10-04T08:43:00.128Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-csv-hzn7"},{"op":"add","path":"/metadata/title","value":"Certify pm-csv on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates"},{"op":"add","path":"/metadata/description","value":"Bump the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops and pm-changelog latest, take over the open Dependabot dependency updates (@types/node, jscpd, eslint) and the pinned codeql-action SHA group, keep the canonical pm-ops merge-driver launcher byte-identical, and certify with the full release gate plus isolated real-tracker dogfooding on npm and Bun."},{"op":"add","path":"/metadata/type","value":"Chore"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["cli","dependencies","release-readiness","sdk"]},{"op":"add","path":"/metadata/created_at","value":"2026-10-04T08:43:00.128Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-04T08:43:00.128Z"},{"op":"add","path":"/metadata/author","value":"pi-glm"},{"op":"add","path":"/metadata/acceptance_criteria","value":"npm run release:check passes with 100/100/100 coverage and clean npm audit including dev; pm health with the repo-pinned 2026.10.4 binary reports no gate-failing findings; packed tarball passes real-tracker import/export scenarios via npx @unbrained/pm-cli@2026.10.4 and bunx; pm-github managed extension installed with a read-only sync preview only"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"32d6d6e1a2bdb0bdf97fa404e99bf9aba6375ff90bae1626a2d7c466115950ad","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"af9dc14bb81e85de8227d95752439569dfd32c430a82306a889d933eccd3892d"} +{"hash_algorithm":"sha256","ts":"2026-10-04T08:43:07.147Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T08:43:07.147Z"},{"op":"add","path":"/metadata/assignee","value":"pi-glm"},{"op":"add","path":"/metadata/claim_principal","value":"pi-glm"}],"before_hash":"32d6d6e1a2bdb0bdf97fa404e99bf9aba6375ff90bae1626a2d7c466115950ad","after_hash":"991f97302546ce4ba858b22ecd155fa73317c42a1671c34880f2d13abb0f0cba","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"7fad0097199004c792a213a6d998989890bbca37c6da87963738f289fd6768ee"} +{"hash_algorithm":"sha256","ts":"2026-10-04T08:43:08.086Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T08:43:08.086Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"991f97302546ce4ba858b22ecd155fa73317c42a1671c34880f2d13abb0f0cba","after_hash":"188f518a8ab43d69d8e04d5f5913452f4d7e0861a4ce432b48136b7585c5ec23","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"ab8cb8c17d705e45993cf8666c005f8608b55bf64ab4f85e87b6f72933e08e87"} +{"hash_algorithm":"sha256","ts":"2026-10-04T08:43:08.759Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T08:43:08.759Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-10-04T08:43:08.758Z","author":"pi-glm","text":"Starting: worktree chore/pm-csv-pm-cli-2026-10-4 at c135b94. Plan: bump @unbrained/pm-cli 2026.9.28->2026.10.4, pm-ops 2026.9.23->2026.10.4, pm-changelog 2026.9.23->2026.9.25; consolidate Dependabot #137 (eslint 10.11.0), #142 (jscpd 5.4.0), #143 (pm-ops), #144 (@types/node 26.6.3), #145 (pm-changelog), #140 (codeql-action SHA 1c5b6756...); re-copy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + dogfood on npm/bun."}]}],"before_hash":"188f518a8ab43d69d8e04d5f5913452f4d7e0861a4ce432b48136b7585c5ec23","after_hash":"06aeffd4723eebb72c25740bde716f5077e19eb1301add67d87579e5fa32ffd0","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"31adebe9845857359d7323388e1facef74ca542449cc7f419476d24afe810bd7"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:13:17.824Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:13:17.824Z"},{"op":"add","path":"/metadata/tests","value":[{"command":"npx -y @unbrained/pm-cli@2026.10.4 csv export --output dogfood-export.csv","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T09:13:17.786Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}]}],"before_hash":"06aeffd4723eebb72c25740bde716f5077e19eb1301add67d87579e5fa32ffd0","after_hash":"f40d8f99ba5f912bd9ca62148ca743f5ec87734f63e1cf43df966c4756ec7fb7","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"710f6ac79c44889ae2c6dc7f3eee742165f1643f5379e95d10eb0f1e026ff593"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:13:17.909Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-10-04T09:13:17.909Z","author":"pi-glm","text":"Real-tracker dogfood PASS. Packed pm-csv-2026.9.26.tgz installed into a scratch copy of this repo's real .agents/pm (107 items). Registered via pm package install ./node_modules/pm-csv with pm-cli 2026.10.4 (capabilities commands/importers/schema). npm path (npx -y @unbrained/pm-cli@2026.10.4): csv export -> 107 items; csv export --status open -> 6; csv validate -> 107 rows clean; csv import -> imported 1; csv import --key title -> updated 1 (upsert verified idempotent, no duplicate). bun path (bunx @unbrained/pm-cli@2026.10.4): csv export -> 109 items; csv validate -> clean; csv import --key title --source bunx-cert -> updated 1. All commands exit 0 with correct real data round-trip. Scratch dir deleted after evidence capture."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:13:17.909Z"}],"before_hash":"f40d8f99ba5f912bd9ca62148ca743f5ec87734f63e1cf43df966c4756ec7fb7","after_hash":"dd3919d501a230f60e149e19dfd2a0fc61e2eb2116647712fc633a29f13e9c28","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"c6f6db7f6b237f3f848c4a20ad41658b9bf7c580fea48b097d3908c820c3d85a"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:13:18.356Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/1","value":{"command":"bunx @unbrained/pm-cli@2026.10.4 csv import dogfood-import.csv --key title --source bunx-cert","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T09:13:18.328Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:13:18.356Z"}],"before_hash":"dd3919d501a230f60e149e19dfd2a0fc61e2eb2116647712fc633a29f13e9c28","after_hash":"897dbd269236f0a1600a77854f08218822e23d5e633ca8155599a5edc92ccd68","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"60d8da2209556f52f96226413a32d08abf351b2d84f1036381446bfa4194f530"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:03.016Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/2","value":{"created_at":"2026-10-04T09:14:03.016Z","author":"pi-glm","text":"pm-github installed as managed project extension at latest npm 2026.9.26 (.agents/pm/extensions/.managed-extensions.json, capabilities commands/hooks/importers/preflight/schema/search). Read-only preview against unbraind/pm-csv: pm github validate --repo unbraind/pm-csv -> ok (token via gh CLI, repo HTTP 200, quota 4952/5000); pm github export --repo unbraind/pm-csv --dry-run -> plan only, writes nothing (create/update actions listed for real items incl. linked gh:unbraind/pm-csv#72); pm github sync --dry-run --repo unbraind/pm-csv -> wouldSync 1, no mutation. No issues created/modified, no scheduled sync enabled."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:03.016Z"}],"before_hash":"897dbd269236f0a1600a77854f08218822e23d5e633ca8155599a5edc92ccd68","after_hash":"20e5c56eb2c0b817aefd2d7b7eef4fc17c0813492bb9805136c97519f423bdb0","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"59caffa66303d56f969964b0923bfaadc384e3f4fb2ca271023bec40ca014d5e"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:13.807Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/2","value":{"command":"npm run release:check","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T09:14:13.739Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:13.807Z"}],"before_hash":"20e5c56eb2c0b817aefd2d7b7eef4fc17c0813492bb9805136c97519f423bdb0","after_hash":"ae5680d54a31ca3830e288cf56b7fbcc0124e578a5f05b36dd45638f465dd0ec","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"99398622492be3f2fc53b535f03543f96c16e972737465ece0792c43281f8186"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:15.155Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/3","value":{"command":"npx pm health","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T09:14:15.089Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:15.155Z"}],"before_hash":"ae5680d54a31ca3830e288cf56b7fbcc0124e578a5f05b36dd45638f465dd0ec","after_hash":"c4700d066f0513cea93e1ed5fdf342a09c92f7814458e741018028b19f163a67","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"e5963472367a3624062ddc29b14d178ed05fdc38a9cbd75194daa99cb9edb0e2"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:52.350Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:52.350Z"},{"op":"add","path":"/metadata/files","value":[{"path":"package.json","scope":"project","note":"Exact CLI/SDK/ops/changelog pins"}]}],"before_hash":"c4700d066f0513cea93e1ed5fdf342a09c92f7814458e741018028b19f163a67","after_hash":"c3a36fff001eac065e29b15a00c0aa4d81de1a7c248ca9da6f5427bd3a73b96f","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"629d61646e61cdf2b4301f931e397d96a8c685957db866fe59e5ce97b30b91ed"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:53.215Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/0/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/0/path","value":"package-lock.json"},{"op":"add","path":"/metadata/files/1","value":{"path":"package.json","scope":"project","note":"Exact CLI/SDK/ops/changelog pins"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:53.215Z"}],"before_hash":"c3a36fff001eac065e29b15a00c0aa4d81de1a7c248ca9da6f5427bd3a73b96f","after_hash":"b3952945a28f8308204e637f6a72784bff5d0dee6ca8e9ee808ed8715556cad8","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"7eb76c3b1dced09d3f3786cd2f10dd1a748444beae4173ed77137d042420941f"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:57.002Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/2","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:57.002Z"}],"before_hash":"b3952945a28f8308204e637f6a72784bff5d0dee6ca8e9ee808ed8715556cad8","after_hash":"46bc3199a6ff4a6b9be51c93db4e68ad4960a2b89d0cfcd7e25794169b3b04ac","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"e5b25a91b10a73a79ff71616e8298a9568f478a01104a0915ecdc85bea73453a"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:58.096Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/2/note","value":"Exact CLI/SDK/ops/changelog pins"},{"op":"replace","path":"/metadata/files/2/path","value":"package.json"},{"op":"replace","path":"/metadata/files/1/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/1/path","value":"package-lock.json"},{"op":"replace","path":"/metadata/files/0/note","value":"codeql-action pinned SHA group 1c5b6756"},{"op":"replace","path":"/metadata/files/0/path","value":".github/workflows/codeql.yml"},{"op":"add","path":"/metadata/files/3","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:58.096Z"}],"before_hash":"46bc3199a6ff4a6b9be51c93db4e68ad4960a2b89d0cfcd7e25794169b3b04ac","after_hash":"6f57e68877fe0a31b88e6962cbeb22937cbc6c204d4be52ff3a028ad11548642","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"447c5936a6c41d1d4a2b66a5f2ddeaa0994dcac2bd2658e941b389cab81c15ac"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:58.901Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/3/note","value":"Documented gate host pin raised to 2026.10.4"},{"op":"replace","path":"/metadata/files/3/path","value":"README.md"},{"op":"add","path":"/metadata/files/4","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:58.901Z"}],"before_hash":"6f57e68877fe0a31b88e6962cbeb22937cbc6c204d4be52ff3a028ad11548642","after_hash":"af165bdb3854a65eccc519fb938ccf86e44b72b005256ea27a4e414c72b028db","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"53d1840eb7e400a46dec1fc8f685577782c9101deb375e0972b8b8c5886a2dbf"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:14:59.844Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/4/note","value":"Documented gate host pin raised to 2026.10.4"},{"op":"replace","path":"/metadata/files/4/path","value":"README.md"},{"op":"replace","path":"/metadata/files/3/note","value":"Exact CLI/SDK/ops/changelog pins"},{"op":"replace","path":"/metadata/files/3/path","value":"package.json"},{"op":"replace","path":"/metadata/files/2/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/2/path","value":"package-lock.json"},{"op":"replace","path":"/metadata/files/1/note","value":"codeql-action pinned SHA group 1c5b6756"},{"op":"replace","path":"/metadata/files/1/path","value":".github/workflows/codeql.yml"},{"op":"replace","path":"/metadata/files/0/note","value":"pm-github 2026.9.26 managed extension registration"},{"op":"replace","path":"/metadata/files/0/path","value":".agents/pm/extensions/.managed-extensions.json"},{"op":"add","path":"/metadata/files/5","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:59.844Z"}],"before_hash":"af165bdb3854a65eccc519fb938ccf86e44b72b005256ea27a4e414c72b028db","after_hash":"99b2b0fce4538fd9c9c3867ac218332dea47f3b9e378c194cbf8147619ca156c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"110ee20f211c6e288ef0dfa8f752b8fb73da1d8fcd1dfd7846fbd9882a328b23"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:26:57.559Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:26:57.559Z"},{"op":"add","path":"/metadata/actual_result","value":"Pins raised: @unbrained/pm-cli 2026.10.4 (exact), pm-ops 2026.10.4, pm-changelog 2026.9.25; consolidated Dependabot #137/#142/#143/#144/#145 via lockfile (eslint 10.12.0, jscpd 5.4.0, @types/node 26.6.4 - newer than proposed where available) and #140 via codeql-action SHA 1c5b6756 group. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. Full npm run release:check PASS: 235/235 tests, zero skipped, 100/100/100 coverage across index.ts and docstring-gate.ts, docstring 71 declarations, jscpd 0 clones, audit clean (0 vulnerabilities, dev included), pack dry-run and accept:packed green (npm-current/bun-current/npm-minimum scenarios on 2026.10.4), changelog check green. npx pm health: exit 0, one advisory (stale_in_progress_items from the prior cycle item). Real-tracker dogfood on packed tarball passed via npx and bunx (csv export/validate/import incl. --key upsert idempotency). pm-github 2026.9.26 managed extension installed; validate/export --dry-run/sync --dry-run previews only, no GitHub mutation. npm test harness run of release:check collided with the pm test sandbox env (ancestor tracker discovery) - infra_collision, not a gate failure; direct gate run is authoritative and green."}],"before_hash":"99b2b0fce4538fd9c9c3867ac218332dea47f3b9e378c194cbf8147619ca156c","after_hash":"25c4fa7699fb8dfacd0f7bc5527f7d3d55dc7d7f267be59e212e27c57639fd5c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"24a10ff5c00dc1104119fc1c10181a5362a99946d4e1676219a8e199bde2ac99"} +{"hash_algorithm":"sha256","ts":"2026-10-04T09:27:03.884Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:27:03.884Z"}],"before_hash":"25c4fa7699fb8dfacd0f7bc5527f7d3d55dc7d7f267be59e212e27c57639fd5c","after_hash":"6a321b253e4d9339e722867857a1ef8a2f9c9ba58670c2c379bc3a73187edb40","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"cac9655d400a13a0dcff091786d27241db891019d6ec1f93f8045d789e168a43"} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7d481d72..e69672c0 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,13 +28,13 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: languages: javascript-typescript # These packages are analyzed from source without a compiled build. build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: category: "/language:javascript-typescript" diff --git a/README.md b/README.md index 06060db1..396dedd2 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ CSV importer and exporter for [pm-cli](https://github.com/unbraind/pm-cli). Import pm items from a CSV file, export them back out, or wire up a programmatic `csv-import` importer — all with zero external runtime dependencies. The extension requires pm CLI 2026.8.20 or newer. Its development and release -gates are pinned to pm CLI/SDK 2026.9.28 so host behavior stays reproducible. +gates are pinned to pm CLI/SDK 2026.10.4 so host behavior stays reproducible. --- diff --git a/package-lock.json b/package-lock.json index c438a135..6c45a58a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -12,12 +12,12 @@ "@babel/eslint-parser": "^8.0.1", "@babel/plugin-syntax-typescript": "^8.0.3", "@types/node": "^26.1.1", - "@unbrained/pm-cli": "2026.9.28", + "@unbrained/pm-cli": "2026.10.4", "eslint": "^10.8.1", "jiti": "^2.7.0", "jscpd": "^5.0.16", - "pm-changelog": "2026.9.23", - "pm-ops": "2026.9.23", + "pm-changelog": "2026.9.25", + "pm-ops": "2026.10.4", "typescript": "^7.0.2", "yaml": "2.9.1" }, @@ -576,44 +576,6 @@ "dev": true, "license": "MIT" }, - "node_modules/@nodelib/fs.scandir": { - "version": "2.1.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz", - "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "2.0.5", - "run-parallel": "^1.1.9" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.stat": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz", - "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.walk": { - "version": "1.2.8", - "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz", - "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.scandir": "2.1.5", - "fastq": "^1.6.0" - }, - "engines": { - "node": ">= 8" - } - }, "node_modules/@opentelemetry/api": { "version": "1.9.1", "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz", @@ -897,9 +859,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.6.1", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.1.tgz", - "integrity": "sha512-VqGJBMCtdhqkBUCcBLvywI0NJ+KLuVzgNnlBUNFOQjqVxzo2lxLUNg1DSey8+u2u6ktswSAxg+s68QLzWHNOuA==", + "version": "26.6.4", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.4.tgz", + "integrity": "sha512-ldVPDCzj7fsaGZrLB0NuHuTvJcsNasysBAqMolr/cgxrLd1xbqxIr3XJiPnHHJUCxj5sNF1vnRj9aWnrVh5Jcg==", "dev": true, "license": "MIT", "dependencies": { @@ -1247,9 +1209,9 @@ } }, "node_modules/@unbrained/pm-cli": { - "version": "2026.9.28", - "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.9.28.tgz", - "integrity": "sha512-bbyq/FIKMUxnGKJTieG3AVL96tS4l9JUuTgzgAiZTqI7lYyLXytmQFVD1a+2neVQT9+6sVNF8ko2u7DcqztxjQ==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.10.4.tgz", + "integrity": "sha512-NZLdiUSUKIRcFiMj9lG0L5UubA9G33fq5WzB1JzJjTTlYxYCVjrFFOCV2rtxYTaYTCzX9o/6V/A4fDx6N3mm/w==", "dev": true, "license": "MIT", "dependencies": { @@ -1257,10 +1219,10 @@ "@toon-format/toon": "^4.1.1", "@types/node": ">=22", "commander": "^15.0.0", - "fast-glob": "^3.3.3", "fast-json-patch": "^3.1.1", "npm-package-arg": "^13.0.2", "tar": "7.5.22", + "tinyglobby": "^0.2.17", "yaml": "^2.9.1" }, "bin": { @@ -1350,19 +1312,6 @@ "node": "20 || >=22" } }, - "node_modules/braces": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", - "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==", - "dev": true, - "license": "MIT", - "dependencies": { - "fill-range": "^7.1.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/browserslist": { "version": "4.28.8", "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz", @@ -1560,9 +1509,9 @@ } }, "node_modules/eslint": { - "version": "10.10.0", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.10.0.tgz", - "integrity": "sha512-NPXn6r5zl4uET1DAVPaOwzX3rut4c0wcmw3dWJAfOsTM5+TogXo0DDjz8pwm/hL8cyVNpHqeK4JpN0NjnyFFNw==", + "version": "10.12.0", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.12.0.tgz", + "integrity": "sha512-npHjrHb2o4ehH3mE+YuxABR+0gyb0aVWCIolgJDArwCiHEIsonBm3ZKjel5b0U5+a+MbEvIyRCGCzD3eKKK2NA==", "dev": true, "license": "MIT", "workspaces": [ @@ -1734,23 +1683,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fast-glob": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz", - "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "^2.0.2", - "@nodelib/fs.walk": "^1.2.3", - "glob-parent": "^5.1.2", - "merge2": "^1.3.0", - "micromatch": "^4.0.8" - }, - "engines": { - "node": ">=8.6.0" - } - }, "node_modules/fast-json-patch": { "version": "3.1.1", "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz", @@ -1772,16 +1704,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fastq": { - "version": "1.20.1", - "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz", - "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==", - "dev": true, - "license": "ISC", - "dependencies": { - "reusify": "^1.0.4" - } - }, "node_modules/file-entry-cache": { "version": "11.1.5", "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-11.1.5.tgz", @@ -1792,19 +1714,6 @@ "flat-cache": "^6.1.23" } }, - "node_modules/fill-range": { - "version": "7.1.1", - "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz", - "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==", - "dev": true, - "license": "MIT", - "dependencies": { - "to-regex-range": "^5.0.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/find-up": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz", @@ -1852,19 +1761,6 @@ "node": ">=6.9.0" } }, - "node_modules/glob-parent": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", - "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", - "dev": true, - "license": "ISC", - "dependencies": { - "is-glob": "^4.0.1" - }, - "engines": { - "node": ">= 6" - } - }, "node_modules/hashery": { "version": "1.5.1", "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz", @@ -1968,16 +1864,6 @@ "node": ">=0.10.0" } }, - "node_modules/is-number": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz", - "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.12.0" - } - }, "node_modules/isexe": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz", @@ -2004,9 +1890,9 @@ "peer": true }, "node_modules/jscpd": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd/-/jscpd-5.3.0.tgz", - "integrity": "sha512-EiGK3H6ZF8jbyiIU1c+iPkgWskcXVoSozfobYIbySK1KPlo+UYmVqSVpKUiLnfoNDOTy9vqACSmiS+JA7xPsQg==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd/-/jscpd-5.4.0.tgz", + "integrity": "sha512-6mU8OHff4rPJ3D5lIsQns82/aQhDas22gMsGurHx1wcrfXWOZDNaobi6rKhLevo+77ntWKUXOwtM6lcrkJeL7w==", "dev": true, "license": "MIT", "bin": { @@ -2019,20 +1905,20 @@ "url": "https://opencollective.com/jscpd" }, "optionalDependencies": { - "jscpd-darwin-arm64": "5.3.0", - "jscpd-darwin-x64": "5.3.0", - "jscpd-linux-arm64-gnu": "5.3.0", - "jscpd-linux-arm64-musl": "5.3.0", - "jscpd-linux-x64-gnu": "5.3.0", - "jscpd-linux-x64-musl": "5.3.0", - "jscpd-windows-arm64-msvc": "5.3.0", - "jscpd-windows-x64-msvc": "5.3.0" + "jscpd-darwin-arm64": "5.4.0", + "jscpd-darwin-x64": "5.4.0", + "jscpd-linux-arm64-gnu": "5.4.0", + "jscpd-linux-arm64-musl": "5.4.0", + "jscpd-linux-x64-gnu": "5.4.0", + "jscpd-linux-x64-musl": "5.4.0", + "jscpd-windows-arm64-msvc": "5.4.0", + "jscpd-windows-x64-msvc": "5.4.0" } }, "node_modules/jscpd-darwin-arm64": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-darwin-arm64/-/jscpd-darwin-arm64-5.3.0.tgz", - "integrity": "sha512-kH4O+vgWtWbaE42+KejOmDZW9nB4WqsbX+NxAQPwVxZg1TQTM2bhDhYdQo+MHpN+vf4HpQ+dOCsARBn2ri+ing==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-darwin-arm64/-/jscpd-darwin-arm64-5.4.0.tgz", + "integrity": "sha512-fNIDtNn9WE4YXoFoqf+3tkHb1+GaKKOeKzh77Wx61Gfa9iDxlCv5rO0Fjy7oWmGehUUKqslDaeXXtn/RoDprCg==", "cpu": [ "arm64" ], @@ -2044,9 +1930,9 @@ ] }, "node_modules/jscpd-darwin-x64": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-darwin-x64/-/jscpd-darwin-x64-5.3.0.tgz", - "integrity": "sha512-IMobUmmZcrxKbziuni93ljtIMtAyPY4lFPNcopgTOFwO3vlHeYZV1r0sY8eP0APvW5BSFW2nBA/WG5+EezYpYw==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-darwin-x64/-/jscpd-darwin-x64-5.4.0.tgz", + "integrity": "sha512-bxlnCVEb69SGIsas1+PaqZyFY8iYVTVjCBxfjVD74UafX115Ysw+oO9LAlsJaGsKUnK8Zsq5bhM33kBHux6bTA==", "cpu": [ "x64" ], @@ -2058,9 +1944,9 @@ ] }, "node_modules/jscpd-linux-arm64-gnu": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-gnu/-/jscpd-linux-arm64-gnu-5.3.0.tgz", - "integrity": "sha512-VdN3g485lHqGxysAuij0KkDh4HSczUOJ8d8rXdCBSYBBqIrSMkVtfy7iug7GUhGkLZ7qukTkgvZs0P7mEMH8Yw==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-gnu/-/jscpd-linux-arm64-gnu-5.4.0.tgz", + "integrity": "sha512-c4hX5QjuRyzLFJ+A+jNGHRpGlDvxcx+zzs4RJmZHpl23istuTMIkelwTOWliF4gXOm0RWXDlX/ywWKr9+Lre7w==", "cpu": [ "arm64" ], @@ -2075,9 +1961,9 @@ ] }, "node_modules/jscpd-linux-arm64-musl": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-musl/-/jscpd-linux-arm64-musl-5.3.0.tgz", - "integrity": "sha512-96JQfVFcSBjoUwqFeEQQ4c2wHHT4kE+LqZtEayc6ko3Ouu1nLJvCnBA5DSOU0HuIvGAVq8A2CmkWJ6I1XCCt/A==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-musl/-/jscpd-linux-arm64-musl-5.4.0.tgz", + "integrity": "sha512-p4FUCNyL8WPTlizdZqfjontFwJ/+jnERYM2+YX2miYvm0NxzsIi23MhfzPl/eUHxkiT5wethV0NRYEAkJr999Q==", "cpu": [ "arm64" ], @@ -2092,9 +1978,9 @@ ] }, "node_modules/jscpd-linux-x64-gnu": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-linux-x64-gnu/-/jscpd-linux-x64-gnu-5.3.0.tgz", - "integrity": "sha512-teMMfXFE1iAJ2rgqxRUOxX6U7glr//8WKZhEH0sRIN6QwstjKmzKlEPEf1UU2rH7JyYlsIGAYcjrWzmJ7wDLcA==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-x64-gnu/-/jscpd-linux-x64-gnu-5.4.0.tgz", + "integrity": "sha512-44NXS0gtYbjBCc53Gwilgj7PPwnWv9YTF/rGc0ZfnFcpzSoOKKU11yH+qHfCVie1hHte1wHyZ1f9Kjc8nGe2/g==", "cpu": [ "x64" ], @@ -2109,9 +1995,9 @@ ] }, "node_modules/jscpd-linux-x64-musl": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-linux-x64-musl/-/jscpd-linux-x64-musl-5.3.0.tgz", - "integrity": "sha512-mVsivu/awa17BwOZbnkGo/H8P1IedckXswuT5ZwYXkgpVD//ken4HjjcUO8+fwxu3cRbk0qycdLfP/B1VAtAMA==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-linux-x64-musl/-/jscpd-linux-x64-musl-5.4.0.tgz", + "integrity": "sha512-m9XHj14Zwia9RjWDkHDrl6VJ3W/b7m8qjFqjhcJ668Vkxoj4Ri/qeo0bo6is+fSw+bYxYexV6xxqIKRDolc8Lg==", "cpu": [ "x64" ], @@ -2126,9 +2012,9 @@ ] }, "node_modules/jscpd-windows-arm64-msvc": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-windows-arm64-msvc/-/jscpd-windows-arm64-msvc-5.3.0.tgz", - "integrity": "sha512-uzkJo9bY2Er91MFyovQUYOAq06bjoO9E36v7qAhzh0yzhYaQNVchmKrP3qEFjA+5K2DL9jeJCD6JL9q4ZiQyGg==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-windows-arm64-msvc/-/jscpd-windows-arm64-msvc-5.4.0.tgz", + "integrity": "sha512-AoP5RXyb9gIf8xmFwAc+Rgh4XJNyX1upcD+R1A6u4XjsDo2/oF+KKB4dtKnG2DbFQ+0fyFg/ClOcw+asQZJfPg==", "cpu": [ "arm64" ], @@ -2140,9 +2026,9 @@ ] }, "node_modules/jscpd-windows-x64-msvc": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/jscpd-windows-x64-msvc/-/jscpd-windows-x64-msvc-5.3.0.tgz", - "integrity": "sha512-E9FBk7BzAC6EffvFuV5ggDhXFJW1F6odrdgLe9RaMW9IWjhgHhmliJgse0ehmaqQu9HGNVwx+Cq238U4Cfe5Iw==", + "version": "5.4.0", + "resolved": "https://registry.npmjs.org/jscpd-windows-x64-msvc/-/jscpd-windows-x64-msvc-5.4.0.tgz", + "integrity": "sha512-dYkb5mAo5i7fjrtf2Ft6z9a/I38RJMd4JirEgJiW2BIv5pAGmfMVPDy1xEXL3hJqraXzeMIfnzqJFanefCyC6g==", "cpu": [ "x64" ], @@ -2245,30 +2131,6 @@ "node": "20 || >=22" } }, - "node_modules/merge2": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz", - "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/micromatch": { - "version": "4.0.8", - "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz", - "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==", - "dev": true, - "license": "MIT", - "dependencies": { - "braces": "^3.0.3", - "picomatch": "^2.3.1" - }, - "engines": { - "node": ">=8.6" - } - }, "node_modules/minimatch": { "version": "10.2.6", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", @@ -2449,23 +2311,10 @@ "license": "ISC", "peer": true }, - "node_modules/picomatch": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", - "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8.6" - }, - "funding": { - "url": "https://github.com/sponsors/jonschlinkert" - } - }, "node_modules/pm-changelog": { - "version": "2026.9.23", - "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.23.tgz", - "integrity": "sha512-hrHFbRgz/LyiCBN9ic0I1C//SRL/zjU5fxcyCeCAnM2qTrz14A7f9ayMXeiu/ChDkVFMxfz8Ps2j3TuUG6K1QA==", + "version": "2026.9.25", + "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.25.tgz", + "integrity": "sha512-j2l97jlJIfuMiB7KDi7oIr9MWxdQvqnDx/JwE3pxC31fDw3MywnSmaTcE9/gV6sVlZbQkOSxnxooHzDwRo+1+g==", "dev": true, "license": "MIT", "bin": { @@ -2479,9 +2328,9 @@ } }, "node_modules/pm-ops": { - "version": "2026.9.23", - "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.9.23.tgz", - "integrity": "sha512-FglZHOXjsuG8WWf9Ca90/IX1u4ZCxVTvHpwMaiA0TAWBx/lLalM2Ic12gtWZvm3OAJsMMuXvfRBHWxwYLzESsg==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.10.4.tgz", + "integrity": "sha512-/6ehQBNwKquIol3EUW1r4pZSXKaohHc1gXJUSk7cqQwkVJOSlP8cCcHzNFH76/6O9hG04Eb5KAH90vFkhTxfMQ==", "dev": true, "license": "MIT", "dependencies": { @@ -2567,27 +2416,6 @@ "dev": true, "license": "MIT" }, - "node_modules/queue-microtask": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz", - "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT" - }, "node_modules/require-in-the-middle": { "version": "8.0.1", "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz", @@ -2602,41 +2430,6 @@ "node": ">=9.3.0 || >=8.10.0 <9.0.0" } }, - "node_modules/reusify": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz", - "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==", - "dev": true, - "license": "MIT", - "engines": { - "iojs": ">=1.0.0", - "node": ">=0.10.0" - } - }, - "node_modules/run-parallel": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz", - "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT", - "dependencies": { - "queue-microtask": "^1.2.2" - } - }, "node_modules/semver": { "version": "7.8.5", "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", @@ -2690,17 +2483,52 @@ "node": ">=18" } }, - "node_modules/to-regex-range": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", - "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==", + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", "dev": true, "license": "MIT", "dependencies": { - "is-number": "^7.0.0" + "fdir": "^6.5.0", + "picomatch": "^4.0.4" }, "engines": { - "node": ">=8.0" + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" + } + }, + "node_modules/tinyglobby/node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, + "node_modules/tinyglobby/node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" } }, "node_modules/type-check": { diff --git a/package.json b/package.json index f1286363..c2e5d7ef 100644 --- a/package.json +++ b/package.json @@ -67,12 +67,12 @@ "@babel/eslint-parser": "^8.0.1", "@babel/plugin-syntax-typescript": "^8.0.3", "@types/node": "^26.1.1", - "@unbrained/pm-cli": "2026.9.28", + "@unbrained/pm-cli": "2026.10.4", "eslint": "^10.8.1", "jiti": "^2.7.0", "jscpd": "^5.0.16", - "pm-changelog": "2026.9.23", - "pm-ops": "2026.9.23", + "pm-changelog": "2026.9.25", + "pm-ops": "2026.10.4", "typescript": "^7.0.2", "yaml": "2.9.1" }, diff --git a/scripts/prepare-merge-driver.ts b/scripts/prepare-merge-driver.ts index 66e512e9..f6f49f07 100644 --- a/scripts/prepare-merge-driver.ts +++ b/scripts/prepare-merge-driver.ts @@ -7,13 +7,15 @@ * therefore imports nothing from pm-ops: it resolves the installer entry from * the package root and runs it in a child process. Only a missing pm-ops package skips, with one * notice; any other resolution failure (for example a pm-ops too old to export - * the entry) and any installer failure fail the install. + * the entry, or a `pm-ops` directory whose package.json is gone) and any + * installer failure fail the install. * * Canonical copy: `pm-ops/templates/prepare-merge-driver.ts`. Copy it * unchanged to `scripts/prepare-merge-driver.ts`. */ import { spawnSync } from "node:child_process"; +import { lstatSync } from "node:fs"; import { createRequire } from "node:module"; import { join } from "node:path"; @@ -26,12 +28,33 @@ try { // Only an absent pm-ops package may skip. Probing its package.json tells that // apart from an installed pm-ops that cannot serve the entry (exports without // it, no exports map, a missing file): those resolve or fail differently, and - // the original error is rethrown. + // the original error is rethrown. A probe that finds no package.json is not + // yet proof of absence: a broken install can leave `node_modules/pm-ops` (a + // directory or a dangling link) with no package.json in any ancestor Node + // searches. Such an entry also counts as present. Keep Node's global paths + // too: the installer resolution above can use them, so an absent local + // package alone cannot prove absence. An unreadable or malformed lookup path + // leaves presence uncertain and must fail closed with the original error. + // Node returns null paths only for built-in modules; pm-ops/package.json is + // a package specifier. let packagePresent = true; try { resolver.resolve("pm-ops/package.json"); } catch (probe) { - packagePresent = !(probe instanceof Error && "code" in probe && probe.code === "MODULE_NOT_FOUND"); + packagePresent = + !(probe instanceof Error && "code" in probe && probe.code === "MODULE_NOT_FOUND") || + resolver.resolve.paths("pm-ops/package.json")!.some( + (directory) => { + try { + return lstatSync(join(directory, "pm-ops"), { throwIfNoEntry: false }) !== undefined; + } catch { + // throwIfNoEntry:false only suppresses ENOENT, not EACCES, EPERM, + // ENOTDIR, or ELOOP. Do not replace the installer diagnostic or + // treat an inconclusive presence check as an omit-dev install. + return true; + } + }, + ); } if (packagePresent) throw error; } From a65507e88b1a1df50ba94d8da2a93c7400a78497 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 12:19:41 +0200 Subject: [PATCH 2/5] docs(pm): upgrade pm-github extension evidence to 2026.10.4 pm-github 2026.10.4 was published during the certification window; re-ran the read-only previews against the repo with the upgraded extension and recorded the result on pm-csv-hzn7. --- .agents/pm/chores/pm-csv-hzn7.toon | 5 +++-- .agents/pm/history/pm-csv-hzn7.jsonl | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.agents/pm/chores/pm-csv-hzn7.toon b/.agents/pm/chores/pm-csv-hzn7.toon index 240990a3..306aa11f 100644 --- a/.agents/pm/chores/pm-csv-hzn7.toon +++ b/.agents/pm/chores/pm-csv-hzn7.toon @@ -6,14 +6,15 @@ status: in_progress priority: 2 tags[4]: cli,dependencies,release-readiness,sdk created_at: "2026-10-04T08:43:00.128Z" -updated_at: "2026-10-04T09:27:03.884Z" +updated_at: "2026-10-04T10:19:41.350Z" author: pi-glm acceptance_criteria: "npm run release:check passes with 100/100/100 coverage and clean npm audit including dev; pm health with the repo-pinned 2026.10.4 binary reports no gate-failing findings; packed tarball passes real-tracker import/export scenarios via npx @unbrained/pm-cli@2026.10.4 and bunx; pm-github managed extension installed with a read-only sync preview only" actual_result: "Pins raised: @unbrained/pm-cli 2026.10.4 (exact), pm-ops 2026.10.4, pm-changelog 2026.9.25; consolidated Dependabot #137/#142/#143/#144/#145 via lockfile (eslint 10.12.0, jscpd 5.4.0, @types/node 26.6.4 - newer than proposed where available) and #140 via codeql-action SHA 1c5b6756 group. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. Full npm run release:check PASS: 235/235 tests, zero skipped, 100/100/100 coverage across index.ts and docstring-gate.ts, docstring 71 declarations, jscpd 0 clones, audit clean (0 vulnerabilities, dev included), pack dry-run and accept:packed green (npm-current/bun-current/npm-minimum scenarios on 2026.10.4), changelog check green. npx pm health: exit 0, one advisory (stale_in_progress_items from the prior cycle item). Real-tracker dogfood on packed tarball passed via npx and bunx (csv export/validate/import incl. --key upsert idempotency). pm-github 2026.9.26 managed extension installed; validate/export --dry-run/sync --dry-run previews only, no GitHub mutation. npm test harness run of release:check collided with the pm test sandbox env (ancestor tracker discovery) - infra_collision, not a gate failure; direct gate run is authoritative and green." -comments[3]{created_at,author,text}: +comments[4]{created_at,author,text}: "2026-10-04T08:43:08.758Z",pi-glm,"Starting: worktree chore/pm-csv-pm-cli-2026-10-4 at c135b94. Plan: bump @unbrained/pm-cli 2026.9.28->2026.10.4, pm-ops 2026.9.23->2026.10.4, pm-changelog 2026.9.23->2026.9.25; consolidate Dependabot #137 (eslint 10.11.0), #142 (jscpd 5.4.0), #143 (pm-ops), #144 (@types/node 26.6.3), #145 (pm-changelog), #140 (codeql-action SHA 1c5b6756...); re-copy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + dogfood on npm/bun." "2026-10-04T09:13:17.909Z",pi-glm,"Real-tracker dogfood PASS. Packed pm-csv-2026.9.26.tgz installed into a scratch copy of this repo's real .agents/pm (107 items). Registered via pm package install ./node_modules/pm-csv with pm-cli 2026.10.4 (capabilities commands/importers/schema). npm path (npx -y @unbrained/pm-cli@2026.10.4): csv export -> 107 items; csv export --status open -> 6; csv validate -> 107 rows clean; csv import -> imported 1; csv import --key title -> updated 1 (upsert verified idempotent, no duplicate). bun path (bunx @unbrained/pm-cli@2026.10.4): csv export -> 109 items; csv validate -> clean; csv import --key title --source bunx-cert -> updated 1. All commands exit 0 with correct real data round-trip. Scratch dir deleted after evidence capture." "2026-10-04T09:14:03.016Z",pi-glm,"pm-github installed as managed project extension at latest npm 2026.9.26 (.agents/pm/extensions/.managed-extensions.json, capabilities commands/hooks/importers/preflight/schema/search). Read-only preview against unbraind/pm-csv: pm github validate --repo unbraind/pm-csv -> ok (token via gh CLI, repo HTTP 200, quota 4952/5000); pm github export --repo unbraind/pm-csv --dry-run -> plan only, writes nothing (create/update actions listed for real items incl. linked gh:unbraind/pm-csv#72); pm github sync --dry-run --repo unbraind/pm-csv -> wouldSync 1, no mutation. No issues created/modified, no scheduled sync enabled." + "2026-10-04T10:19:39.515Z",pi-glm,"Correction: pm-github 2026.10.4 was published mid-certification; the managed project extension was upgraded from 2026.9.26 to 2026.10.4 (latest npm). Re-ran read-only previews against unbraind/pm-csv: validate ok (HTTP 200, quota 4871/5000), sync --dry-run -> wouldSync 1, no mutation. Still no issues created/modified, no scheduled sync." files[6]{path,scope,note}: .agents/pm/extensions/.managed-extensions.json,project,pm-github 2026.9.26 managed extension registration .github/workflows/codeql.yml,project,codeql-action pinned SHA group 1c5b6756 diff --git a/.agents/pm/history/pm-csv-hzn7.jsonl b/.agents/pm/history/pm-csv-hzn7.jsonl index 3796aae3..ab33deca 100644 --- a/.agents/pm/history/pm-csv-hzn7.jsonl +++ b/.agents/pm/history/pm-csv-hzn7.jsonl @@ -16,3 +16,5 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T09:14:59.844Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/4/note","value":"Documented gate host pin raised to 2026.10.4"},{"op":"replace","path":"/metadata/files/4/path","value":"README.md"},{"op":"replace","path":"/metadata/files/3/note","value":"Exact CLI/SDK/ops/changelog pins"},{"op":"replace","path":"/metadata/files/3/path","value":"package.json"},{"op":"replace","path":"/metadata/files/2/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/2/path","value":"package-lock.json"},{"op":"replace","path":"/metadata/files/1/note","value":"codeql-action pinned SHA group 1c5b6756"},{"op":"replace","path":"/metadata/files/1/path","value":".github/workflows/codeql.yml"},{"op":"replace","path":"/metadata/files/0/note","value":"pm-github 2026.9.26 managed extension registration"},{"op":"replace","path":"/metadata/files/0/path","value":".agents/pm/extensions/.managed-extensions.json"},{"op":"add","path":"/metadata/files/5","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:14:59.844Z"}],"before_hash":"af165bdb3854a65eccc519fb938ccf86e44b72b005256ea27a4e414c72b028db","after_hash":"99b2b0fce4538fd9c9c3867ac218332dea47f3b9e378c194cbf8147619ca156c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"110ee20f211c6e288ef0dfa8f752b8fb73da1d8fcd1dfd7846fbd9882a328b23"} {"hash_algorithm":"sha256","ts":"2026-10-04T09:26:57.559Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:26:57.559Z"},{"op":"add","path":"/metadata/actual_result","value":"Pins raised: @unbrained/pm-cli 2026.10.4 (exact), pm-ops 2026.10.4, pm-changelog 2026.9.25; consolidated Dependabot #137/#142/#143/#144/#145 via lockfile (eslint 10.12.0, jscpd 5.4.0, @types/node 26.6.4 - newer than proposed where available) and #140 via codeql-action SHA 1c5b6756 group. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. Full npm run release:check PASS: 235/235 tests, zero skipped, 100/100/100 coverage across index.ts and docstring-gate.ts, docstring 71 declarations, jscpd 0 clones, audit clean (0 vulnerabilities, dev included), pack dry-run and accept:packed green (npm-current/bun-current/npm-minimum scenarios on 2026.10.4), changelog check green. npx pm health: exit 0, one advisory (stale_in_progress_items from the prior cycle item). Real-tracker dogfood on packed tarball passed via npx and bunx (csv export/validate/import incl. --key upsert idempotency). pm-github 2026.9.26 managed extension installed; validate/export --dry-run/sync --dry-run previews only, no GitHub mutation. npm test harness run of release:check collided with the pm test sandbox env (ancestor tracker discovery) - infra_collision, not a gate failure; direct gate run is authoritative and green."}],"before_hash":"99b2b0fce4538fd9c9c3867ac218332dea47f3b9e378c194cbf8147619ca156c","after_hash":"25c4fa7699fb8dfacd0f7bc5527f7d3d55dc7d7f267be59e212e27c57639fd5c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"24a10ff5c00dc1104119fc1c10181a5362a99946d4e1676219a8e199bde2ac99"} {"hash_algorithm":"sha256","ts":"2026-10-04T09:27:03.884Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:27:03.884Z"}],"before_hash":"25c4fa7699fb8dfacd0f7bc5527f7d3d55dc7d7f267be59e212e27c57639fd5c","after_hash":"6a321b253e4d9339e722867857a1ef8a2f9c9ba58670c2c379bc3a73187edb40","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"cac9655d400a13a0dcff091786d27241db891019d6ec1f93f8045d789e168a43"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:19:39.515Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/3","value":{"created_at":"2026-10-04T10:19:39.515Z","author":"pi-glm","text":"Correction: pm-github 2026.10.4 was published mid-certification; the managed project extension was upgraded from 2026.9.26 to 2026.10.4 (latest npm). Re-ran read-only previews against unbraind/pm-csv: validate ok (HTTP 200, quota 4871/5000), sync --dry-run -> wouldSync 1, no mutation. Still no issues created/modified, no scheduled sync."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:19:39.515Z"}],"before_hash":"6a321b253e4d9339e722867857a1ef8a2f9c9ba58670c2c379bc3a73187edb40","after_hash":"fee75b68819c50f670c11e4347a80afaf4aaa18db640f0e1647371a7c253a0cf","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"1d108d8ec81039dab55c596e927e86e04671a31b392b9f88d7c1f6a865102697"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:19:41.350Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:19:41.350Z"}],"before_hash":"fee75b68819c50f670c11e4347a80afaf4aaa18db640f0e1647371a7c253a0cf","after_hash":"50ef7f09b18f7c01b722a761e82f338aa292f31b7d7cf9013dd20cf726812dc5","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"e65c9295def57ded9437774e2c4ef0a0d0feaf745ca6625dbd40fbd8bbfeae22"} From 22a14917b6090612dfb59f00137e1502b554f5d9 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 12:57:47 +0200 Subject: [PATCH 3/5] test: cover broken merge-driver installs and finish exact certification pins --- .agents/pm/chores/pm-csv-hzn7.toon | 80 ++++++++++++++++++++++------ .agents/pm/history/pm-csv-hzn7.jsonl | 9 ++++ package-lock.json | 22 ++++---- package.json | 16 +++--- test/prepare-merge-driver.test.ts | 36 +++++++++++++ 5 files changed, 129 insertions(+), 34 deletions(-) diff --git a/.agents/pm/chores/pm-csv-hzn7.toon b/.agents/pm/chores/pm-csv-hzn7.toon index 306aa11f..c50bdf7e 100644 --- a/.agents/pm/chores/pm-csv-hzn7.toon +++ b/.agents/pm/chores/pm-csv-hzn7.toon @@ -6,25 +6,75 @@ status: in_progress priority: 2 tags[4]: cli,dependencies,release-readiness,sdk created_at: "2026-10-04T08:43:00.128Z" -updated_at: "2026-10-04T10:19:41.350Z" +updated_at: "2026-10-04T10:57:38.897Z" author: pi-glm acceptance_criteria: "npm run release:check passes with 100/100/100 coverage and clean npm audit including dev; pm health with the repo-pinned 2026.10.4 binary reports no gate-failing findings; packed tarball passes real-tracker import/export scenarios via npx @unbrained/pm-cli@2026.10.4 and bunx; pm-github managed extension installed with a read-only sync preview only" -actual_result: "Pins raised: @unbrained/pm-cli 2026.10.4 (exact), pm-ops 2026.10.4, pm-changelog 2026.9.25; consolidated Dependabot #137/#142/#143/#144/#145 via lockfile (eslint 10.12.0, jscpd 5.4.0, @types/node 26.6.4 - newer than proposed where available) and #140 via codeql-action SHA 1c5b6756 group. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. Full npm run release:check PASS: 235/235 tests, zero skipped, 100/100/100 coverage across index.ts and docstring-gate.ts, docstring 71 declarations, jscpd 0 clones, audit clean (0 vulnerabilities, dev included), pack dry-run and accept:packed green (npm-current/bun-current/npm-minimum scenarios on 2026.10.4), changelog check green. npx pm health: exit 0, one advisory (stale_in_progress_items from the prior cycle item). Real-tracker dogfood on packed tarball passed via npx and bunx (csv export/validate/import incl. --key upsert idempotency). pm-github 2026.9.26 managed extension installed; validate/export --dry-run/sync --dry-run previews only, no GitHub mutation. npm test harness run of release:check collided with the pm test sandbox env (ancestor tracker discovery) - infra_collision, not a gate failure; direct gate run is authoritative and green." -comments[4]{created_at,author,text}: +actual_result: "Resumed candidate rebased onto main release 7473779. Every devDependency exact; CLI/ops/changelog 2026.10.4, resolved Dependabot versions retained. Canonical launcher unchanged; 3 Greptile regression cases added. Clean npm ci and full release:check PASS: 238/238, zero skipped, 100/100/100 measured lines/branches/functions (2 sources). npm audit and audit --omit=dev: 0. Packed current-version tarball npx/bunx real tracker dogfood passed: 107 original exports, 108 after 1 isolated create; repeated imports update 1 with no duplicate. pm health ok, one prior stale-item advisory; read-only pm-github preview wouldSync 1. Pending reviewer availability is missing evidence; leave open." +comments[8]{created_at,author,text}: "2026-10-04T08:43:08.758Z",pi-glm,"Starting: worktree chore/pm-csv-pm-cli-2026-10-4 at c135b94. Plan: bump @unbrained/pm-cli 2026.9.28->2026.10.4, pm-ops 2026.9.23->2026.10.4, pm-changelog 2026.9.23->2026.9.25; consolidate Dependabot #137 (eslint 10.11.0), #142 (jscpd 5.4.0), #143 (pm-ops), #144 (@types/node 26.6.3), #145 (pm-changelog), #140 (codeql-action SHA 1c5b6756...); re-copy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + dogfood on npm/bun." "2026-10-04T09:13:17.909Z",pi-glm,"Real-tracker dogfood PASS. Packed pm-csv-2026.9.26.tgz installed into a scratch copy of this repo's real .agents/pm (107 items). Registered via pm package install ./node_modules/pm-csv with pm-cli 2026.10.4 (capabilities commands/importers/schema). npm path (npx -y @unbrained/pm-cli@2026.10.4): csv export -> 107 items; csv export --status open -> 6; csv validate -> 107 rows clean; csv import -> imported 1; csv import --key title -> updated 1 (upsert verified idempotent, no duplicate). bun path (bunx @unbrained/pm-cli@2026.10.4): csv export -> 109 items; csv validate -> clean; csv import --key title --source bunx-cert -> updated 1. All commands exit 0 with correct real data round-trip. Scratch dir deleted after evidence capture." "2026-10-04T09:14:03.016Z",pi-glm,"pm-github installed as managed project extension at latest npm 2026.9.26 (.agents/pm/extensions/.managed-extensions.json, capabilities commands/hooks/importers/preflight/schema/search). Read-only preview against unbraind/pm-csv: pm github validate --repo unbraind/pm-csv -> ok (token via gh CLI, repo HTTP 200, quota 4952/5000); pm github export --repo unbraind/pm-csv --dry-run -> plan only, writes nothing (create/update actions listed for real items incl. linked gh:unbraind/pm-csv#72); pm github sync --dry-run --repo unbraind/pm-csv -> wouldSync 1, no mutation. No issues created/modified, no scheduled sync enabled." "2026-10-04T10:19:39.515Z",pi-glm,"Correction: pm-github 2026.10.4 was published mid-certification; the managed project extension was upgraded from 2026.9.26 to 2026.10.4 (latest npm). Re-ran read-only previews against unbraind/pm-csv: validate ok (HTTP 200, quota 4871/5000), sync --dry-run -> wouldSync 1, no mutation. Still no issues created/modified, no scheduled sync." -files[6]{path,scope,note}: - .agents/pm/extensions/.managed-extensions.json,project,pm-github 2026.9.26 managed extension registration - .github/workflows/codeql.yml,project,codeql-action pinned SHA group 1c5b6756 - package-lock.json,project,Resolved dependency graph with consolidated Dependabot bumps - package.json,project,Exact CLI/SDK/ops/changelog pins - README.md,project,Documented gate host pin raised to 2026.10.4 - scripts/prepare-merge-driver.ts,project,Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte -tests[4]{command,scope,provenance{author,created_at,source_kind,source_ref}}: - npx -y @unbrained/pm-cli@2026.10.4 csv export --output dogfood-export.csv,project,pi-glm,"2026-10-04T09:13:17.786Z",local_mutation,chore/pm-csv-pm-cli-2026-10-4 - bunx @unbrained/pm-cli@2026.10.4 csv import dogfood-import.csv --key title --source bunx-cert,project,pi-glm,"2026-10-04T09:13:18.328Z",local_mutation,chore/pm-csv-pm-cli-2026-10-4 - "npm run release:check",project,pi-glm,"2026-10-04T09:14:13.739Z",local_mutation,chore/pm-csv-pm-cli-2026-10-4 - npx pm health,project,pi-glm,"2026-10-04T09:14:15.089Z",local_mutation,chore/pm-csv-pm-cli-2026-10-4 + "2026-10-04T10:48:42.360Z",codex-sol,"Resumed after provider quota exhaustion. Re-read PR #146, existing author comments/reactions and Greptile thread. Rebased onto origin/main 7473779; addressing missing broken-install/lookup regression fixtures, exact devDependency pins, and newly published pm-changelog 2026.10.4 before rerunning the locked full gate." + "2026-10-04T10:50:43.600Z",codex-sol,"Greptile regression request verified: 9/9 launcher tests pass, zero skips, including incomplete package directory, dangling pm-ops symlink, and looping NODE_PATH. All assert a nonzero result and preserve the original installer diagnostic; canonical launcher is unchanged." + "2026-10-04T10:52:58.812Z",codex-sol,All devDependencies now use exact installed versions; pm-changelog upgraded to latest published 2026.10.4. The linked launcher run passed 9/9 using explicit tracker context (none requires an isolated/snapshot source mode; reserved PM_PATH env clearing was correctly rejected). No gate changes. + "2026-10-04T10:57:36.785Z",codex-sol,"Resumption validation PASS after rebase and exact pins: clean npm ci; flock-serialized npm run release:check passed 238/238 tests, 0 skipped, measured lines/branches/functions 100/100/100 across the existing two-source gate. Audits all/prod each 0. Packed pm-csv-2026.10.4.tgz installed into a fresh copy of this real tracker; npx -y @unbrained/pm-cli@2026.10.4 csv export --output real.csv exported 107; csv validate real.csv clean; csv import input.csv --key title created 1 then updated 1. bunx @unbrained/pm-cli@2026.10.4 csv export --output real-bun.csv exported 108; validate clean; import --key title updated 1. Scratch deleted. npx pm health ok with one prior-item stale advisory. Managed pm-github 2026.10.4 sync --dry-run --repo unbraind/pm-csv: wouldSync 1, no writes. Review availability remains separate from green gates." +files[7]: + - path: .agents/pm/extensions/.managed-extensions.json + scope: project + note: pm-github 2026.9.26 managed extension registration + - path: .github/workflows/codeql.yml + scope: project + note: codeql-action pinned SHA group 1c5b6756 + - path: package-lock.json + scope: project + note: Resolved dependency graph with consolidated Dependabot bumps + - path: package.json + scope: project + note: Exact CLI/SDK/ops/changelog pins + - path: README.md + scope: project + note: Documented gate host pin raised to 2026.10.4 + - path: scripts/prepare-merge-driver.ts + scope: project + note: Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte + - path: test/prepare-merge-driver.test.ts + scope: project +tests[5]: + - command: npx -y @unbrained/pm-cli@2026.10.4 csv export --output dogfood-export.csv + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T09:13:17.786Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: bunx @unbrained/pm-cli@2026.10.4 csv import dogfood-import.csv --key title --source bunx-cert + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T09:13:18.328Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: "npm run release:check" + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T09:14:13.739Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: npx pm health + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T09:14:15.089Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: node --test test/prepare-merge-driver.test.ts + scope: project + pm_context_mode: none + provenance: + author: codex-sol + created_at: "2026-10-04T10:50:41.998Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 body: "" diff --git a/.agents/pm/history/pm-csv-hzn7.jsonl b/.agents/pm/history/pm-csv-hzn7.jsonl index ab33deca..726845f4 100644 --- a/.agents/pm/history/pm-csv-hzn7.jsonl +++ b/.agents/pm/history/pm-csv-hzn7.jsonl @@ -18,3 +18,12 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T09:27:03.884Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T09:27:03.884Z"}],"before_hash":"25c4fa7699fb8dfacd0f7bc5527f7d3d55dc7d7f267be59e212e27c57639fd5c","after_hash":"6a321b253e4d9339e722867857a1ef8a2f9c9ba58670c2c379bc3a73187edb40","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"cac9655d400a13a0dcff091786d27241db891019d6ec1f93f8045d789e168a43"} {"hash_algorithm":"sha256","ts":"2026-10-04T10:19:39.515Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/3","value":{"created_at":"2026-10-04T10:19:39.515Z","author":"pi-glm","text":"Correction: pm-github 2026.10.4 was published mid-certification; the managed project extension was upgraded from 2026.9.26 to 2026.10.4 (latest npm). Re-ran read-only previews against unbraind/pm-csv: validate ok (HTTP 200, quota 4871/5000), sync --dry-run -> wouldSync 1, no mutation. Still no issues created/modified, no scheduled sync."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:19:39.515Z"}],"before_hash":"6a321b253e4d9339e722867857a1ef8a2f9c9ba58670c2c379bc3a73187edb40","after_hash":"fee75b68819c50f670c11e4347a80afaf4aaa18db640f0e1647371a7c253a0cf","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"1d108d8ec81039dab55c596e927e86e04671a31b392b9f88d7c1f6a865102697"} {"hash_algorithm":"sha256","ts":"2026-10-04T10:19:41.350Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:19:41.350Z"}],"before_hash":"fee75b68819c50f670c11e4347a80afaf4aaa18db640f0e1647371a7c253a0cf","after_hash":"50ef7f09b18f7c01b722a761e82f338aa292f31b7d7cf9013dd20cf726812dc5","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"e65c9295def57ded9437774e2c4ef0a0d0feaf745ca6625dbd40fbd8bbfeae22"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:48:41.663Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:48:41.663Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"50ef7f09b18f7c01b722a761e82f338aa292f31b7d7cf9013dd20cf726812dc5","after_hash":"dd257c88012933197e34da75df931a5c8b896db472bb51a5cb70b469d32c4ac4","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"fb93f4cd3db8857d1a93b786a03d38d53e7c233f966f470af6437622c28e70b6"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:48:42.360Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/4","value":{"created_at":"2026-10-04T10:48:42.360Z","author":"codex-sol","text":"Resumed after provider quota exhaustion. Re-read PR #146, existing author comments/reactions and Greptile thread. Rebased onto origin/main 7473779; addressing missing broken-install/lookup regression fixtures, exact devDependency pins, and newly published pm-changelog 2026.10.4 before rerunning the locked full gate."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:48:42.360Z"}],"before_hash":"dd257c88012933197e34da75df931a5c8b896db472bb51a5cb70b469d32c4ac4","after_hash":"a0e799ca46a573f11465fde3ba8b9f0c9292d967b85139699db72763f976a623","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"93a5847ee5468a76953774af0827e1ebdd00e1ec2e90dc9fe16dc7e827671cfd"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:50:40.867Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/6","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:50:40.867Z"}],"before_hash":"a0e799ca46a573f11465fde3ba8b9f0c9292d967b85139699db72763f976a623","after_hash":"ab28cbf07294fff9fc67d85ffc12fb74e2a35d911ee7439f1c91266ae51983f6","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"900842e5e4490dda5e36127453ca0f988d571d431460fee58ff56e53f02b9ac6"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:50:42.059Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/4","value":{"command":"node --test test/prepare-merge-driver.test.ts","scope":"project","pm_context_mode":"none","provenance":{"author":"codex-sol","created_at":"2026-10-04T10:50:41.998Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:50:42.059Z"}],"before_hash":"ab28cbf07294fff9fc67d85ffc12fb74e2a35d911ee7439f1c91266ae51983f6","after_hash":"ca6760e6cd70fa1b9b3986a518ea3ed33ac8c79832279d9f83bea9ca551168d2","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"deff2dcb57779f802491a73ce283c6c624b83fc6f50b686a567e8044c7d3e6ac"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:50:43.600Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/5","value":{"created_at":"2026-10-04T10:50:43.600Z","author":"codex-sol","text":"Greptile regression request verified: 9/9 launcher tests pass, zero skips, including incomplete package directory, dangling pm-ops symlink, and looping NODE_PATH. All assert a nonzero result and preserve the original installer diagnostic; canonical launcher is unchanged."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:50:43.600Z"}],"before_hash":"ca6760e6cd70fa1b9b3986a518ea3ed33ac8c79832279d9f83bea9ca551168d2","after_hash":"11f7fb009a3597ede5ff84cee69600b50f31a95ee7946f779b13e9c399744ff2","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5fcff62505f345572fdcf88667fa70af6733ac074c394bd998116bdc9262d154"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:52:58.812Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/6","value":{"created_at":"2026-10-04T10:52:58.812Z","author":"codex-sol","text":"All devDependencies now use exact installed versions; pm-changelog upgraded to latest published 2026.10.4. The linked launcher run passed 9/9 using explicit tracker context (none requires an isolated/snapshot source mode; reserved PM_PATH env clearing was correctly rejected). No gate changes."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:52:58.812Z"}],"before_hash":"11f7fb009a3597ede5ff84cee69600b50f31a95ee7946f779b13e9c399744ff2","after_hash":"20e70f3a353f8ae4163e330214ef8e999f551465ffd25bd89287f9c33d6322b0","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"6d71a3eed1036cd99e78343e73b4375a1bc25c128e27239d905c2f76cca378e1"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:57:36.785Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/7","value":{"created_at":"2026-10-04T10:57:36.785Z","author":"codex-sol","text":"Resumption validation PASS after rebase and exact pins: clean npm ci; flock-serialized npm run release:check passed 238/238 tests, 0 skipped, measured lines/branches/functions 100/100/100 across the existing two-source gate. Audits all/prod each 0. Packed pm-csv-2026.10.4.tgz installed into a fresh copy of this real tracker; npx -y @unbrained/pm-cli@2026.10.4 csv export --output real.csv exported 107; csv validate real.csv clean; csv import input.csv --key title created 1 then updated 1. bunx @unbrained/pm-cli@2026.10.4 csv export --output real-bun.csv exported 108; validate clean; import --key title updated 1. Scratch deleted. npx pm health ok with one prior-item stale advisory. Managed pm-github 2026.10.4 sync --dry-run --repo unbraind/pm-csv: wouldSync 1, no writes. Review availability remains separate from green gates."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:57:36.785Z"}],"before_hash":"20e70f3a353f8ae4163e330214ef8e999f551465ffd25bd89287f9c33d6322b0","after_hash":"a167ba451ea2c4eddaea01b1a7bf3ddbbfa3baf1836e9bae1808aef528322046","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"537d646f4b308d792990a81011623355b663679a22351507a71bc78ca49922e8"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:57:37.843Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"Resumed candidate rebased onto main release 7473779. Every devDependency exact; CLI/ops/changelog 2026.10.4, resolved Dependabot versions retained. Canonical launcher unchanged; 3 Greptile regression cases added. Clean npm ci and full release:check PASS: 238/238, zero skipped, 100/100/100 measured lines/branches/functions (2 sources). npm audit and audit --omit=dev: 0. Packed current-version tarball npx/bunx real tracker dogfood passed: 107 original exports, 108 after 1 isolated create; repeated imports update 1 with no duplicate. pm health ok, one prior stale-item advisory; read-only pm-github preview wouldSync 1. Pending reviewer availability is missing evidence; leave open."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:57:37.843Z"}],"before_hash":"a167ba451ea2c4eddaea01b1a7bf3ddbbfa3baf1836e9bae1808aef528322046","after_hash":"bdeff7a435aaa0cf51b96ed8fbb0848b808ffdbc7e3284ef1530b5f84e075437","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"03f170caa85a3b5e5610a00db1e1b9eff19d47aadd26606e532566a99b91e169"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:57:38.897Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:57:38.897Z"}],"before_hash":"bdeff7a435aaa0cf51b96ed8fbb0848b808ffdbc7e3284ef1530b5f84e075437","after_hash":"f4e88e2d7da9b108e76e0f74741d74609ce2b5a8a4d998c5281b1cf9c799bfca","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b613a5a69111d9fb46952822b3c6ed55c87c38256661a281077c78b41a55e7af"} diff --git a/package-lock.json b/package-lock.json index 6c45a58a..771ee268 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,16 +9,16 @@ "version": "2026.10.4", "license": "MIT", "devDependencies": { - "@babel/eslint-parser": "^8.0.1", - "@babel/plugin-syntax-typescript": "^8.0.3", - "@types/node": "^26.1.1", + "@babel/eslint-parser": "8.0.6", + "@babel/plugin-syntax-typescript": "8.0.3", + "@types/node": "26.6.4", "@unbrained/pm-cli": "2026.10.4", - "eslint": "^10.8.1", - "jiti": "^2.7.0", - "jscpd": "^5.0.16", - "pm-changelog": "2026.9.25", + "eslint": "10.12.0", + "jiti": "2.7.0", + "jscpd": "5.4.0", + "pm-changelog": "2026.10.4", "pm-ops": "2026.10.4", - "typescript": "^7.0.2", + "typescript": "7.0.2", "yaml": "2.9.1" }, "engines": { @@ -2312,9 +2312,9 @@ "peer": true }, "node_modules/pm-changelog": { - "version": "2026.9.25", - "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.25.tgz", - "integrity": "sha512-j2l97jlJIfuMiB7KDi7oIr9MWxdQvqnDx/JwE3pxC31fDw3MywnSmaTcE9/gV6sVlZbQkOSxnxooHzDwRo+1+g==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.10.4.tgz", + "integrity": "sha512-YJJHJYv2i+olzGVF+qdab3wWG6auiRVIvf7TZD4ZdUhE/8lIawf3aYOOZZVJHogN8xP8rNUlVV9Lc1OXKLlQ7w==", "dev": true, "license": "MIT", "bin": { diff --git a/package.json b/package.json index c2e5d7ef..1a21132c 100644 --- a/package.json +++ b/package.json @@ -64,16 +64,16 @@ "@unbrained/pm-cli": ">=2026.8.20" }, "devDependencies": { - "@babel/eslint-parser": "^8.0.1", - "@babel/plugin-syntax-typescript": "^8.0.3", - "@types/node": "^26.1.1", + "@babel/eslint-parser": "8.0.6", + "@babel/plugin-syntax-typescript": "8.0.3", + "@types/node": "26.6.4", "@unbrained/pm-cli": "2026.10.4", - "eslint": "^10.8.1", - "jiti": "^2.7.0", - "jscpd": "^5.0.16", - "pm-changelog": "2026.9.25", + "eslint": "10.12.0", + "jiti": "2.7.0", + "jscpd": "5.4.0", + "pm-changelog": "2026.10.4", "pm-ops": "2026.10.4", - "typescript": "^7.0.2", + "typescript": "7.0.2", "yaml": "2.9.1" }, "keywords": [ diff --git a/test/prepare-merge-driver.test.ts b/test/prepare-merge-driver.test.ts index c3bb230f..d1798228 100644 --- a/test/prepare-merge-driver.test.ts +++ b/test/prepare-merge-driver.test.ts @@ -109,6 +109,42 @@ test("a pm-ops too old to export the launcher entry fails the install", posixOnl assert.match(result.stderr, /ERR_PACKAGE_PATH_NOT_EXPORTED/); }); +test("an incomplete pm-ops directory fails instead of reporting an omit-dev install", posixOnly, () => { + const directory = checkout("incomplete", "absent"); + mkdirSync(join(directory, "node_modules", "pm-ops"), { recursive: true }); + const result = prepare(directory, hostPath); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install/); + assert.deepEqual(registeredDrivers(directory), []); +}); + +test("a dangling pm-ops link fails instead of reporting an omit-dev install", posixOnly, () => { + const directory = checkout("dangling", "absent"); + mkdirSync(join(directory, "node_modules")); + symlinkSync(join(directory, "missing-pm-ops"), join(directory, "node_modules", "pm-ops"), "dir"); + const result = prepare(directory, hostPath); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install/); + assert.deepEqual(registeredDrivers(directory), []); +}); + +test("a looping lookup path preserves the original installer error", posixOnly, () => { + const directory = checkout("lookup-loop", "absent"); + const lookup = join(directory, "lookup"); + symlinkSync(lookup, lookup, "dir"); + const result = spawnSync(process.execPath, [launcher], { + cwd: directory, + encoding: "utf8", + env: { ...process.env, PATH: hostPath, NODE_PATH: lookup }, + }); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install|ELOOP|lstat/); + assert.deepEqual(registeredDrivers(directory), []); +}); + test("a failing pm merge install fails the install with the same status", posixOnly, () => { const result = prepare(checkout("failing-pm", "pinned"), stubPm("failing-pm", 7)); assert.equal(result.status, 7, result.stderr); From d579ba4a5874868630e056cb3d9ddfb880047c52 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 12:59:58 +0200 Subject: [PATCH 4/5] test: run new merge-driver regressions without platform skips --- .agents/pm/chores/pm-csv-hzn7.toon | 5 +++-- .agents/pm/history/pm-csv-hzn7.jsonl | 3 +++ test/prepare-merge-driver.test.ts | 6 +++--- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.agents/pm/chores/pm-csv-hzn7.toon b/.agents/pm/chores/pm-csv-hzn7.toon index c50bdf7e..4abf32c5 100644 --- a/.agents/pm/chores/pm-csv-hzn7.toon +++ b/.agents/pm/chores/pm-csv-hzn7.toon @@ -6,11 +6,11 @@ status: in_progress priority: 2 tags[4]: cli,dependencies,release-readiness,sdk created_at: "2026-10-04T08:43:00.128Z" -updated_at: "2026-10-04T10:57:38.897Z" +updated_at: "2026-10-04T10:59:49.048Z" author: pi-glm acceptance_criteria: "npm run release:check passes with 100/100/100 coverage and clean npm audit including dev; pm health with the repo-pinned 2026.10.4 binary reports no gate-failing findings; packed tarball passes real-tracker import/export scenarios via npx @unbrained/pm-cli@2026.10.4 and bunx; pm-github managed extension installed with a read-only sync preview only" actual_result: "Resumed candidate rebased onto main release 7473779. Every devDependency exact; CLI/ops/changelog 2026.10.4, resolved Dependabot versions retained. Canonical launcher unchanged; 3 Greptile regression cases added. Clean npm ci and full release:check PASS: 238/238, zero skipped, 100/100/100 measured lines/branches/functions (2 sources). npm audit and audit --omit=dev: 0. Packed current-version tarball npx/bunx real tracker dogfood passed: 107 original exports, 108 after 1 isolated create; repeated imports update 1 with no duplicate. pm health ok, one prior stale-item advisory; read-only pm-github preview wouldSync 1. Pending reviewer availability is missing evidence; leave open." -comments[8]{created_at,author,text}: +comments[9]{created_at,author,text}: "2026-10-04T08:43:08.758Z",pi-glm,"Starting: worktree chore/pm-csv-pm-cli-2026-10-4 at c135b94. Plan: bump @unbrained/pm-cli 2026.9.28->2026.10.4, pm-ops 2026.9.23->2026.10.4, pm-changelog 2026.9.23->2026.9.25; consolidate Dependabot #137 (eslint 10.11.0), #142 (jscpd 5.4.0), #143 (pm-ops), #144 (@types/node 26.6.3), #145 (pm-changelog), #140 (codeql-action SHA 1c5b6756...); re-copy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + dogfood on npm/bun." "2026-10-04T09:13:17.909Z",pi-glm,"Real-tracker dogfood PASS. Packed pm-csv-2026.9.26.tgz installed into a scratch copy of this repo's real .agents/pm (107 items). Registered via pm package install ./node_modules/pm-csv with pm-cli 2026.10.4 (capabilities commands/importers/schema). npm path (npx -y @unbrained/pm-cli@2026.10.4): csv export -> 107 items; csv export --status open -> 6; csv validate -> 107 rows clean; csv import -> imported 1; csv import --key title -> updated 1 (upsert verified idempotent, no duplicate). bun path (bunx @unbrained/pm-cli@2026.10.4): csv export -> 109 items; csv validate -> clean; csv import --key title --source bunx-cert -> updated 1. All commands exit 0 with correct real data round-trip. Scratch dir deleted after evidence capture." "2026-10-04T09:14:03.016Z",pi-glm,"pm-github installed as managed project extension at latest npm 2026.9.26 (.agents/pm/extensions/.managed-extensions.json, capabilities commands/hooks/importers/preflight/schema/search). Read-only preview against unbraind/pm-csv: pm github validate --repo unbraind/pm-csv -> ok (token via gh CLI, repo HTTP 200, quota 4952/5000); pm github export --repo unbraind/pm-csv --dry-run -> plan only, writes nothing (create/update actions listed for real items incl. linked gh:unbraind/pm-csv#72); pm github sync --dry-run --repo unbraind/pm-csv -> wouldSync 1, no mutation. No issues created/modified, no scheduled sync enabled." @@ -19,6 +19,7 @@ comments[8]{created_at,author,text}: "2026-10-04T10:50:43.600Z",codex-sol,"Greptile regression request verified: 9/9 launcher tests pass, zero skips, including incomplete package directory, dangling pm-ops symlink, and looping NODE_PATH. All assert a nonzero result and preserve the original installer diagnostic; canonical launcher is unchanged." "2026-10-04T10:52:58.812Z",codex-sol,All devDependencies now use exact installed versions; pm-changelog upgraded to latest published 2026.10.4. The linked launcher run passed 9/9 using explicit tracker context (none requires an isolated/snapshot source mode; reserved PM_PATH env clearing was correctly rejected). No gate changes. "2026-10-04T10:57:36.785Z",codex-sol,"Resumption validation PASS after rebase and exact pins: clean npm ci; flock-serialized npm run release:check passed 238/238 tests, 0 skipped, measured lines/branches/functions 100/100/100 across the existing two-source gate. Audits all/prod each 0. Packed pm-csv-2026.10.4.tgz installed into a fresh copy of this real tracker; npx -y @unbrained/pm-cli@2026.10.4 csv export --output real.csv exported 107; csv validate real.csv clean; csv import input.csv --key title created 1 then updated 1. bunx @unbrained/pm-cli@2026.10.4 csv export --output real-bun.csv exported 108; validate clean; import --key title updated 1. Scratch deleted. npx pm health ok with one prior-item stale advisory. Managed pm-github 2026.10.4 sync --dry-run --repo unbraind/pm-csv: wouldSync 1, no writes. Review availability remains separate from green gates." + "2026-10-04T10:59:48.449Z",codex-sol,"The three new regression fixtures run unconditionally; no new platform skips were added. Rechecked 9/9 launcher tests, zero skips. Linux full-gate behavior and the validated canonical launcher remain unchanged." files[7]: - path: .agents/pm/extensions/.managed-extensions.json scope: project diff --git a/.agents/pm/history/pm-csv-hzn7.jsonl b/.agents/pm/history/pm-csv-hzn7.jsonl index 726845f4..e670431e 100644 --- a/.agents/pm/history/pm-csv-hzn7.jsonl +++ b/.agents/pm/history/pm-csv-hzn7.jsonl @@ -27,3 +27,6 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T10:57:36.785Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/7","value":{"created_at":"2026-10-04T10:57:36.785Z","author":"codex-sol","text":"Resumption validation PASS after rebase and exact pins: clean npm ci; flock-serialized npm run release:check passed 238/238 tests, 0 skipped, measured lines/branches/functions 100/100/100 across the existing two-source gate. Audits all/prod each 0. Packed pm-csv-2026.10.4.tgz installed into a fresh copy of this real tracker; npx -y @unbrained/pm-cli@2026.10.4 csv export --output real.csv exported 107; csv validate real.csv clean; csv import input.csv --key title created 1 then updated 1. bunx @unbrained/pm-cli@2026.10.4 csv export --output real-bun.csv exported 108; validate clean; import --key title updated 1. Scratch deleted. npx pm health ok with one prior-item stale advisory. Managed pm-github 2026.10.4 sync --dry-run --repo unbraind/pm-csv: wouldSync 1, no writes. Review availability remains separate from green gates."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:57:36.785Z"}],"before_hash":"20e70f3a353f8ae4163e330214ef8e999f551465ffd25bd89287f9c33d6322b0","after_hash":"a167ba451ea2c4eddaea01b1a7bf3ddbbfa3baf1836e9bae1808aef528322046","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"537d646f4b308d792990a81011623355b663679a22351507a71bc78ca49922e8"} {"hash_algorithm":"sha256","ts":"2026-10-04T10:57:37.843Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"Resumed candidate rebased onto main release 7473779. Every devDependency exact; CLI/ops/changelog 2026.10.4, resolved Dependabot versions retained. Canonical launcher unchanged; 3 Greptile regression cases added. Clean npm ci and full release:check PASS: 238/238, zero skipped, 100/100/100 measured lines/branches/functions (2 sources). npm audit and audit --omit=dev: 0. Packed current-version tarball npx/bunx real tracker dogfood passed: 107 original exports, 108 after 1 isolated create; repeated imports update 1 with no duplicate. pm health ok, one prior stale-item advisory; read-only pm-github preview wouldSync 1. Pending reviewer availability is missing evidence; leave open."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:57:37.843Z"}],"before_hash":"a167ba451ea2c4eddaea01b1a7bf3ddbbfa3baf1836e9bae1808aef528322046","after_hash":"bdeff7a435aaa0cf51b96ed8fbb0848b808ffdbc7e3284ef1530b5f84e075437","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"03f170caa85a3b5e5610a00db1e1b9eff19d47aadd26606e532566a99b91e169"} {"hash_algorithm":"sha256","ts":"2026-10-04T10:57:38.897Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:57:38.897Z"}],"before_hash":"bdeff7a435aaa0cf51b96ed8fbb0848b808ffdbc7e3284ef1530b5f84e075437","after_hash":"f4e88e2d7da9b108e76e0f74741d74609ce2b5a8a4d998c5281b1cf9c799bfca","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b613a5a69111d9fb46952822b3c6ed55c87c38256661a281077c78b41a55e7af"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:59:47.750Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:59:47.750Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"f4e88e2d7da9b108e76e0f74741d74609ce2b5a8a4d998c5281b1cf9c799bfca","after_hash":"8a53279f9177370ebf94219563dadb3ee8bcb3c0c948fe28dee34cb2d165e33c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5d1d5c304a37a24302323816b8383ad98f2556140cf4e7e4103f5bb799fbb550"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:59:48.449Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/8","value":{"created_at":"2026-10-04T10:59:48.449Z","author":"codex-sol","text":"The three new regression fixtures run unconditionally; no new platform skips were added. Rechecked 9/9 launcher tests, zero skips. Linux full-gate behavior and the validated canonical launcher remain unchanged."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:59:48.449Z"}],"before_hash":"8a53279f9177370ebf94219563dadb3ee8bcb3c0c948fe28dee34cb2d165e33c","after_hash":"24a4b341c635c5c39eb4e18a8a4ca81d37cf27271c6e894c1fb74d1f21565899","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"269e1cb819f64c231140f845c76decd7c6f6462382a73877b1fe4e126b46c6fb"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:59:49.048Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:59:49.048Z"}],"before_hash":"24a4b341c635c5c39eb4e18a8a4ca81d37cf27271c6e894c1fb74d1f21565899","after_hash":"fa9d8c5bd2e07bbb5214d619a041db5973c6f3c6337f7cac05b2f0e5ba0f9230","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"d32cbc4bba306602f0fae0c508e9c5ff38ecf40f09911850cead8d811ab99527"} diff --git a/test/prepare-merge-driver.test.ts b/test/prepare-merge-driver.test.ts index d1798228..b6ae7706 100644 --- a/test/prepare-merge-driver.test.ts +++ b/test/prepare-merge-driver.test.ts @@ -109,7 +109,7 @@ test("a pm-ops too old to export the launcher entry fails the install", posixOnl assert.match(result.stderr, /ERR_PACKAGE_PATH_NOT_EXPORTED/); }); -test("an incomplete pm-ops directory fails instead of reporting an omit-dev install", posixOnly, () => { +test("an incomplete pm-ops directory fails instead of reporting an omit-dev install", () => { const directory = checkout("incomplete", "absent"); mkdirSync(join(directory, "node_modules", "pm-ops"), { recursive: true }); const result = prepare(directory, hostPath); @@ -119,7 +119,7 @@ test("an incomplete pm-ops directory fails instead of reporting an omit-dev inst assert.deepEqual(registeredDrivers(directory), []); }); -test("a dangling pm-ops link fails instead of reporting an omit-dev install", posixOnly, () => { +test("a dangling pm-ops link fails instead of reporting an omit-dev install", () => { const directory = checkout("dangling", "absent"); mkdirSync(join(directory, "node_modules")); symlinkSync(join(directory, "missing-pm-ops"), join(directory, "node_modules", "pm-ops"), "dir"); @@ -130,7 +130,7 @@ test("a dangling pm-ops link fails instead of reporting an omit-dev install", po assert.deepEqual(registeredDrivers(directory), []); }); -test("a looping lookup path preserves the original installer error", posixOnly, () => { +test("a looping lookup path preserves the original installer error", () => { const directory = checkout("lookup-loop", "absent"); const lookup = join(directory, "lookup"); symlinkSync(lookup, lookup, "dir"); From 2a8496aef873788e85d0fef6818cdf1dc61ca416 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 13:23:03 +0200 Subject: [PATCH 5/5] test: make merge-driver fixtures portable and isolate lookup paths --- .agents/pm/chores/pm-csv-hzn7.toon | 16 +++++++++++++--- .agents/pm/history/pm-csv-hzn7.jsonl | 5 +++++ test/prepare-merge-driver.test.ts | 6 +++--- 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/.agents/pm/chores/pm-csv-hzn7.toon b/.agents/pm/chores/pm-csv-hzn7.toon index 4abf32c5..b6999443 100644 --- a/.agents/pm/chores/pm-csv-hzn7.toon +++ b/.agents/pm/chores/pm-csv-hzn7.toon @@ -6,11 +6,11 @@ status: in_progress priority: 2 tags[4]: cli,dependencies,release-readiness,sdk created_at: "2026-10-04T08:43:00.128Z" -updated_at: "2026-10-04T10:59:49.048Z" +updated_at: "2026-10-04T11:22:56.589Z" author: pi-glm acceptance_criteria: "npm run release:check passes with 100/100/100 coverage and clean npm audit including dev; pm health with the repo-pinned 2026.10.4 binary reports no gate-failing findings; packed tarball passes real-tracker import/export scenarios via npx @unbrained/pm-cli@2026.10.4 and bunx; pm-github managed extension installed with a read-only sync preview only" actual_result: "Resumed candidate rebased onto main release 7473779. Every devDependency exact; CLI/ops/changelog 2026.10.4, resolved Dependabot versions retained. Canonical launcher unchanged; 3 Greptile regression cases added. Clean npm ci and full release:check PASS: 238/238, zero skipped, 100/100/100 measured lines/branches/functions (2 sources). npm audit and audit --omit=dev: 0. Packed current-version tarball npx/bunx real tracker dogfood passed: 107 original exports, 108 after 1 isolated create; repeated imports update 1 with no duplicate. pm health ok, one prior stale-item advisory; read-only pm-github preview wouldSync 1. Pending reviewer availability is missing evidence; leave open." -comments[9]{created_at,author,text}: +comments[11]{created_at,author,text}: "2026-10-04T08:43:08.758Z",pi-glm,"Starting: worktree chore/pm-csv-pm-cli-2026-10-4 at c135b94. Plan: bump @unbrained/pm-cli 2026.9.28->2026.10.4, pm-ops 2026.9.23->2026.10.4, pm-changelog 2026.9.23->2026.9.25; consolidate Dependabot #137 (eslint 10.11.0), #142 (jscpd 5.4.0), #143 (pm-ops), #144 (@types/node 26.6.3), #145 (pm-changelog), #140 (codeql-action SHA 1c5b6756...); re-copy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + dogfood on npm/bun." "2026-10-04T09:13:17.909Z",pi-glm,"Real-tracker dogfood PASS. Packed pm-csv-2026.9.26.tgz installed into a scratch copy of this repo's real .agents/pm (107 items). Registered via pm package install ./node_modules/pm-csv with pm-cli 2026.10.4 (capabilities commands/importers/schema). npm path (npx -y @unbrained/pm-cli@2026.10.4): csv export -> 107 items; csv export --status open -> 6; csv validate -> 107 rows clean; csv import -> imported 1; csv import --key title -> updated 1 (upsert verified idempotent, no duplicate). bun path (bunx @unbrained/pm-cli@2026.10.4): csv export -> 109 items; csv validate -> clean; csv import --key title --source bunx-cert -> updated 1. All commands exit 0 with correct real data round-trip. Scratch dir deleted after evidence capture." "2026-10-04T09:14:03.016Z",pi-glm,"pm-github installed as managed project extension at latest npm 2026.9.26 (.agents/pm/extensions/.managed-extensions.json, capabilities commands/hooks/importers/preflight/schema/search). Read-only preview against unbraind/pm-csv: pm github validate --repo unbraind/pm-csv -> ok (token via gh CLI, repo HTTP 200, quota 4952/5000); pm github export --repo unbraind/pm-csv --dry-run -> plan only, writes nothing (create/update actions listed for real items incl. linked gh:unbraind/pm-csv#72); pm github sync --dry-run --repo unbraind/pm-csv -> wouldSync 1, no mutation. No issues created/modified, no scheduled sync enabled." @@ -20,6 +20,8 @@ comments[9]{created_at,author,text}: "2026-10-04T10:52:58.812Z",codex-sol,All devDependencies now use exact installed versions; pm-changelog upgraded to latest published 2026.10.4. The linked launcher run passed 9/9 using explicit tracker context (none requires an isolated/snapshot source mode; reserved PM_PATH env clearing was correctly rejected). No gate changes. "2026-10-04T10:57:36.785Z",codex-sol,"Resumption validation PASS after rebase and exact pins: clean npm ci; flock-serialized npm run release:check passed 238/238 tests, 0 skipped, measured lines/branches/functions 100/100/100 across the existing two-source gate. Audits all/prod each 0. Packed pm-csv-2026.10.4.tgz installed into a fresh copy of this real tracker; npx -y @unbrained/pm-cli@2026.10.4 csv export --output real.csv exported 107; csv validate real.csv clean; csv import input.csv --key title created 1 then updated 1. bunx @unbrained/pm-cli@2026.10.4 csv export --output real-bun.csv exported 108; validate clean; import --key title updated 1. Scratch deleted. npx pm health ok with one prior-item stale advisory. Managed pm-github 2026.10.4 sync --dry-run --repo unbraind/pm-csv: wouldSync 1, no writes. Review availability remains separate from green gates." "2026-10-04T10:59:48.449Z",codex-sol,"The three new regression fixtures run unconditionally; no new platform skips were added. Rechecked 9/9 launcher tests, zero skips. Linux full-gate behavior and the validated canonical launcher remain unchanged." + "2026-10-04T11:10:15.475Z",codex-sol,"Review round 2: Greptile found Windows symbolic-link privilege requirements in the new unconditional fixtures. Use symlinkSync type junction with absolute targets, which Node applies only on Windows (ignored on POSIX), retaining all scenarios without new skips. Linux launcher suite still passes 9/9; a Windows runner is unavailable. Canonical launcher remains unchanged; rerun the full locked release gate before push." + "2026-10-04T11:22:55.937Z",codex-sol,"Review correction validation PASS: full flock-serialized npm run release:check re-run after portable junction and ambient NODE_PATH isolation changes: 238/238 tests, zero skips, measured 100/100/100 thresholds met, audits/packed current npm/Bun/minimum-host acceptance/changelog/attestation/date gates green. Linked hostile run env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts also passes 9/9. Windows execution is not available; junction fixture API follows https://nodejs.org/api/fs.html#fssymlinksynctarget-path-type. Production package unchanged; real-tracker dogfood from this certification remains applicable." files[7]: - path: .agents/pm/extensions/.managed-extensions.json scope: project @@ -41,7 +43,7 @@ files[7]: note: Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte - path: test/prepare-merge-driver.test.ts scope: project -tests[5]: +tests[6]: - command: npx -y @unbrained/pm-cli@2026.10.4 csv export --output dogfood-export.csv scope: project provenance: @@ -78,4 +80,12 @@ tests[5]: created_at: "2026-10-04T10:50:41.998Z" source_kind: local_mutation source_ref: chore/pm-csv-pm-cli-2026-10-4 + - command: "env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts" + scope: project + pm_context_mode: tracker + provenance: + author: codex-sol + created_at: "2026-10-04T11:19:02.676Z" + source_kind: local_mutation + source_ref: chore/pm-csv-pm-cli-2026-10-4 body: "" diff --git a/.agents/pm/history/pm-csv-hzn7.jsonl b/.agents/pm/history/pm-csv-hzn7.jsonl index e670431e..7b2188a3 100644 --- a/.agents/pm/history/pm-csv-hzn7.jsonl +++ b/.agents/pm/history/pm-csv-hzn7.jsonl @@ -30,3 +30,8 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T10:59:47.750Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:59:47.750Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"f4e88e2d7da9b108e76e0f74741d74609ce2b5a8a4d998c5281b1cf9c799bfca","after_hash":"8a53279f9177370ebf94219563dadb3ee8bcb3c0c948fe28dee34cb2d165e33c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5d1d5c304a37a24302323816b8383ad98f2556140cf4e7e4103f5bb799fbb550"} {"hash_algorithm":"sha256","ts":"2026-10-04T10:59:48.449Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/8","value":{"created_at":"2026-10-04T10:59:48.449Z","author":"codex-sol","text":"The three new regression fixtures run unconditionally; no new platform skips were added. Rechecked 9/9 launcher tests, zero skips. Linux full-gate behavior and the validated canonical launcher remain unchanged."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:59:48.449Z"}],"before_hash":"8a53279f9177370ebf94219563dadb3ee8bcb3c0c948fe28dee34cb2d165e33c","after_hash":"24a4b341c635c5c39eb4e18a8a4ca81d37cf27271c6e894c1fb74d1f21565899","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"269e1cb819f64c231140f845c76decd7c6f6462382a73877b1fe4e126b46c6fb"} {"hash_algorithm":"sha256","ts":"2026-10-04T10:59:49.048Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:59:49.048Z"}],"before_hash":"24a4b341c635c5c39eb4e18a8a4ca81d37cf27271c6e894c1fb74d1f21565899","after_hash":"fa9d8c5bd2e07bbb5214d619a041db5973c6f3c6337f7cac05b2f0e5ba0f9230","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"d32cbc4bba306602f0fae0c508e9c5ff38ecf40f09911850cead8d811ab99527"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:10:14.615Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:10:14.615Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"fa9d8c5bd2e07bbb5214d619a041db5973c6f3c6337f7cac05b2f0e5ba0f9230","after_hash":"e41e612210ba433399712d2251a19cd55345ee60f335734e34397d6ad4300bfa","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"662c63ab36bd4d0f281b0c12f14fc8df493b6f526fa98ffa2f5df696d492cc66"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:10:15.475Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/9","value":{"created_at":"2026-10-04T11:10:15.475Z","author":"codex-sol","text":"Review round 2: Greptile found Windows symbolic-link privilege requirements in the new unconditional fixtures. Use symlinkSync type junction with absolute targets, which Node applies only on Windows (ignored on POSIX), retaining all scenarios without new skips. Linux launcher suite still passes 9/9; a Windows runner is unavailable. Canonical launcher remains unchanged; rerun the full locked release gate before push."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:10:15.475Z"}],"before_hash":"e41e612210ba433399712d2251a19cd55345ee60f335734e34397d6ad4300bfa","after_hash":"621f6ded9968f82c3e5ed25a22b9e197e6387d17ddeb93dcd4ad3908050881d5","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"d8068b7123e48a419b48dd47c3c518c69183b0f57e0f50a8fbe0290c4d575ac2"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:19:02.791Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/5","value":{"command":"env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts","scope":"project","pm_context_mode":"tracker","provenance":{"author":"codex-sol","created_at":"2026-10-04T11:19:02.676Z","source_kind":"local_mutation","source_ref":"chore/pm-csv-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:19:02.791Z"}],"before_hash":"621f6ded9968f82c3e5ed25a22b9e197e6387d17ddeb93dcd4ad3908050881d5","after_hash":"913ec691c00302469afb5160a4ca4c3fcf3535d675b663641391ed4b2b209be4","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"8568b6b730a4a4e1417903232c089d6e2d1eaa90cceb78f6ee59b01500a5bcc5"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:22:55.937Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/10","value":{"created_at":"2026-10-04T11:22:55.937Z","author":"codex-sol","text":"Review correction validation PASS: full flock-serialized npm run release:check re-run after portable junction and ambient NODE_PATH isolation changes: 238/238 tests, zero skips, measured 100/100/100 thresholds met, audits/packed current npm/Bun/minimum-host acceptance/changelog/attestation/date gates green. Linked hostile run env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts also passes 9/9. Windows execution is not available; junction fixture API follows https://nodejs.org/api/fs.html#fssymlinksynctarget-path-type. Production package unchanged; real-tracker dogfood from this certification remains applicable."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:22:55.937Z"}],"before_hash":"913ec691c00302469afb5160a4ca4c3fcf3535d675b663641391ed4b2b209be4","after_hash":"8d7a433d945163c10fd73756dc0dede51374c557c0216deefaa1d7755b596011","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"f36b22a251946d77532a1b530c87907a35984469967d7187e5d12958f109e4bd"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:22:56.589Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:22:56.589Z"}],"before_hash":"8d7a433d945163c10fd73756dc0dede51374c557c0216deefaa1d7755b596011","after_hash":"b65f21364cc508d16053c090f4e6dd286fa1aa2ab615c5b0b421bf835e9ee312","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"021700d8e356fc7b437f1762c36f0429be642018a0e613af303ed5cc9e33a968"} diff --git a/test/prepare-merge-driver.test.ts b/test/prepare-merge-driver.test.ts index b6ae7706..7ab978ca 100644 --- a/test/prepare-merge-driver.test.ts +++ b/test/prepare-merge-driver.test.ts @@ -67,7 +67,7 @@ function stubPm(name: string, status: number, body = ""): string { /** Run the launcher as npm's `prepare` hook would: as the entry point, from `cwd`, with `path` as PATH. */ function prepare(cwd: string, path: string): SpawnSyncReturns { - return spawnSync(process.execPath, [launcher], { cwd, encoding: "utf8", env: { ...process.env, PATH: path } }); + return spawnSync(process.execPath, [launcher], { cwd, encoding: "utf8", env: { ...process.env, PATH: path, NODE_PATH: "" } }); } /** The merge drivers registered in a checkout's LOCAL Git config, by name. */ @@ -122,7 +122,7 @@ test("an incomplete pm-ops directory fails instead of reporting an omit-dev inst test("a dangling pm-ops link fails instead of reporting an omit-dev install", () => { const directory = checkout("dangling", "absent"); mkdirSync(join(directory, "node_modules")); - symlinkSync(join(directory, "missing-pm-ops"), join(directory, "node_modules", "pm-ops"), "dir"); + symlinkSync(join(directory, "missing-pm-ops"), join(directory, "node_modules", "pm-ops"), "junction"); const result = prepare(directory, hostPath); assert.notEqual(result.status, 0); assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); @@ -133,7 +133,7 @@ test("a dangling pm-ops link fails instead of reporting an omit-dev install", () test("a looping lookup path preserves the original installer error", () => { const directory = checkout("lookup-loop", "absent"); const lookup = join(directory, "lookup"); - symlinkSync(lookup, lookup, "dir"); + symlinkSync(lookup, lookup, "junction"); const result = spawnSync(process.execPath, [launcher], { cwd: directory, encoding: "utf8",