diff --git a/.agents/pm/chores/pm-github-julo.toon b/.agents/pm/chores/pm-github-julo.toon new file mode 100644 index 0000000..59ddf9d --- /dev/null +++ b/.agents/pm/chores/pm-github-julo.toon @@ -0,0 +1,81 @@ +id: pm-github-julo +title: Certify pm-github on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates +description: "Raise the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops 2026.10.4 (pm-changelog already at 2026.9.25); consolidate Dependabot #101 (pm-cli), #102 (@types/node), #103 (pm-ops) and #104 (codeql-action pinned SHA group 2892aa5); keep the canonical pm-ops merge-driver launcher byte-identical; certify with the full release gate plus isolated real-tracker dogfooding of the read-only GitHub surfaces via npm and Bun." +type: Chore +status: in_progress +priority: 2 +tags[4]: cli,dependencies,release-readiness,sdk +created_at: "2026-10-04T10:20:50.548Z" +updated_at: "2026-10-04T11:51:32.498Z" +author: pi-glm +acceptance_criteria: "npm run release:check passes (privacy, docstring, coverage gates intact); pm health with the repo-pinned 2026.10.4 binary is clean; packed tarball exercises validate/import/export-preview/sync-preview against a real repo read-only via npx @unbrained/pm-cli@2026.10.4 and bunx with zero GitHub mutation" +actual_result: "Exact CLI/ops/changelog 2026.10.4 and development pins; canonical launcher unchanged; isolated lookup-loop suite 8/8. Clean npm ci and serialized release:check PASS 309/309, zero skips, unchanged coverage and privacy gate passed; both audit scopes 0, no open alerts. Packed own-tracker npx/bunx read-only commands pass (108 create + 1 update export preview, sync planned 1 / wouldSync 0 / skipped 1), no GitHub writes; scratch removed. Health exits 0 with stale_in_progress_items:2 advisory and no gate-failing findings, correcting the earlier zero-warning text. CodeRabbit and Greptile substantive reviews find no new actionable issues; other required reviews unavailable/pending. Leave item and PR open." +comments[7]{created_at,author,text}: + "2026-10-04T10:21:00.651Z",pi-glm,"Starting at 2daff95 (Release pm-github v2026.10.04). Plan: pm-cli 2026.9.26->2026.10.4, pm-ops 2026.9.28->2026.10.4, @types/node ->26.6.4 in range, codeql-action SHA group 1c5b6756->2892aa5 from #104; recopy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + read-only dogfood (validate/import/export dry-run/sync dry-run) + previews." + "2026-10-04T10:26:29.326Z",pi-glm,"Real-tracker dogfood PASS (read-only on GitHub). Packed pm-github-2026.10.4.tgz installed into a scratch copy of this repo's real .agents/pm and registered via pm package install with CLI 2026.10.4. npm path (npx -y @unbrained/pm-cli@2026.10.4): github validate --repo unbraind/pm-github -> ok (token via gh CLI, HTTP 200, quota 4813/5000); github import unbraind/pm-github -> no open issues found (truthful, both this repo and unbraind/pm-csv have zero open issues); github import unbraind/pm-cli -> Imported 26 new (real open issue data fetched read-only); re-import -> 0 new / 26 updated proving gh:owner/repo#N provenance idempotency; github export --dry-run -> create/update plan only, writes nothing; github sync --dry-run --repo unbraind/pm-csv -> planned 0. bun path (bunx @unbrained/pm-cli@2026.10.4): github validate -> ok; github import unbraind/pm-cli -> 0 new / 26 updated; export --dry-run and sync --dry-run identical. Zero GitHub mutation (reads + local scratch writes only); scratch deleted after evidence capture." + "2026-10-04T10:27:47.809Z",pi-glm,"pm-github installed as managed project extension from npm at latest 2026.10.4 (self-extension registration; extensions are per-clone/gitignored). Read-only previews against unbraind/pm-github: github validate -> ok (HTTP 200, quota 4776/5000); github export --dry-run -> plan only, writes nothing; github sync --dry-run -> planned 1 / skipped 1, no mutation. No issues created/modified, no scheduled sync enabled." + "2026-10-04T11:08:25.648Z",codex-sol,"Resumed PR #106 after re-reading current comments/reviews. Greptile correctly requests a NODE_PATH lookup-error regression. Add the looping-symlink child-process fixture before pin updates; retain the canonical launcher. Finish exact devDependency pins and latest pm-changelog 2026.10.4, clean npm ci, full locked gate and packed read-only real-tracker npm/bun dogfood." + "2026-10-04T11:19:04.632Z",codex-sol,"Also applied the verified cross-repo fixture findings: Node junction type for unconditional Windows-compatible lookup fixtures, and cleared ambient NODE_PATH in the normal prepare helper while preserving the explicit looping lookup. No launcher changes, no new skips. Clean npm ci now succeeds and both audit scopes are clean." + "2026-10-04T11:30:44.957Z",codex-sol,"Resumption validation PASS: all devDependencies exact; CLI/ops/changelog 2026.10.4. Clean npm ci and flock-serialized npm run release:check passed 309/309, zero skips, unchanged configured coverage (2 measured sources), privacy 3052 Git objects clean, both audit scopes 0. Requested lookup-loop regression and hostile NODE_PATH fixture test pass 8/8, no skips; canonical launcher unchanged. Packed real own tracker npm/bun dogfood: npx -y @unbrained/pm-cli@2026.10.4 github validate --repo unbraind/pm-github; github import unbraind/pm-github --dry-run; github export --dry-run --repo unbraind/pm-github; github sync --dry-run --repo unbraind/pm-github; equivalent bunx @unbrained/pm-cli@2026.10.4 commands all pass. Export preview renders 108 creates + 1 update from 109 real items; sync planned 1, wouldSync 0, skipped 1; zero GitHub mutation. Scratch removed. Pinned npx pm health ok without warnings; managed pm-github 2026.10.4 own-repo sync preview returns planned 1 / wouldSync 0 / skipped 1. Review availability remains a separate gate." + "2026-10-04T11:51:30.969Z",codex-sol,"Final health receipt correction: the complete pinned health receipt has stale_in_progress_items:2 advisory, not zero warnings as the earlier resumption text claimed. Health exits 0 with no gate-failing findings. Existing items remain open for their owners. Package code, 309/309 full gate result, clean audits, packed read-only real-tracker dogfood and substantive CodeRabbit/Greptile reviews are unchanged." +files[5]: + - path: .github/workflows/codeql.yml + scope: project + note: codeql-action pinned SHA group 2892aa5 from #104 + - path: package-lock.json + scope: project + note: Resolved dependency graph with consolidated Dependabot bumps + - path: package.json + scope: project + note: Exact CLI/ops pins raised to 2026.10.4 + - path: scripts/prepare-merge-driver.ts + scope: project + note: Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte + - path: test/prepare-merge-driver.test.ts + scope: project +tests[6]: + - command: "npm run release:check" + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T10:27:55.325Z" + source_kind: local_mutation + source_ref: chore/pm-github-pm-cli-2026-10-4 + - command: npx pm health + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T10:27:56.397Z" + source_kind: local_mutation + source_ref: chore/pm-github-pm-cli-2026-10-4 + - command: npx -y @unbrained/pm-cli@2026.10.4 github import unbraind/pm-cli + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T10:27:57.374Z" + source_kind: local_mutation + source_ref: chore/pm-github-pm-cli-2026-10-4 + - command: bunx @unbrained/pm-cli@2026.10.4 github sync --dry-run --repo unbraind/pm-csv + scope: project + provenance: + author: pi-glm + created_at: "2026-10-04T10:27:58.293Z" + source_kind: local_mutation + source_ref: chore/pm-github-pm-cli-2026-10-4 + - command: node --test test/prepare-merge-driver.test.ts + scope: project + pm_context_mode: tracker + provenance: + author: codex-sol + created_at: "2026-10-04T11:08:29.490Z" + source_kind: local_mutation + source_ref: chore/pm-github-pm-cli-2026-10-4 + - command: "env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts" + scope: project + pm_context_mode: tracker + provenance: + author: codex-sol + created_at: "2026-10-04T11:19:02.787Z" + source_kind: local_mutation + source_ref: chore/pm-github-pm-cli-2026-10-4 +body: "" diff --git a/.agents/pm/history/pm-github-julo.jsonl b/.agents/pm/history/pm-github-julo.jsonl new file mode 100644 index 0000000..3b52117 --- /dev/null +++ b/.agents/pm/history/pm-github-julo.jsonl @@ -0,0 +1,29 @@ +{"hash_algorithm":"sha256","ts":"2026-10-04T10:20:50.548Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-github-julo"},{"op":"add","path":"/metadata/title","value":"Certify pm-github on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates"},{"op":"add","path":"/metadata/description","value":"Raise the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops 2026.10.4 (pm-changelog already at 2026.9.25); consolidate Dependabot #101 (pm-cli), #102 (@types/node), #103 (pm-ops) and #104 (codeql-action pinned SHA group 2892aa5); keep the canonical pm-ops merge-driver launcher byte-identical; certify with the full release gate plus isolated real-tracker dogfooding of the read-only GitHub surfaces via npm and Bun."},{"op":"add","path":"/metadata/type","value":"Chore"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["cli","dependencies","release-readiness","sdk"]},{"op":"add","path":"/metadata/created_at","value":"2026-10-04T10:20:50.548Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-04T10:20:50.548Z"},{"op":"add","path":"/metadata/author","value":"pi-glm"},{"op":"add","path":"/metadata/acceptance_criteria","value":"npm run release:check passes (privacy, docstring, coverage gates intact); pm health with the repo-pinned 2026.10.4 binary is clean; packed tarball exercises validate/import/export-preview/sync-preview against a real repo read-only via npx @unbrained/pm-cli@2026.10.4 and bunx with zero GitHub mutation"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"540d001dae8e0f6635c1f419332d088a6d6933647e3de396d97bc135d30b449e","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"cbaa7a8f8e5f37dee786e9e552679ff440bfeb86bf9f7e155924c0825b65584f"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:20:57.976Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:20:57.976Z"},{"op":"add","path":"/metadata/assignee","value":"pi-glm"},{"op":"add","path":"/metadata/claim_principal","value":"pi-glm"}],"before_hash":"540d001dae8e0f6635c1f419332d088a6d6933647e3de396d97bc135d30b449e","after_hash":"5a0d68144578deb01ff2fd1384fb71c68d66c59b2dccb99dc5143fdca265a28f","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"4ab9bfe847c0c346f54a34c6209629cfa15749b1146646cc376aa275f6247f4d"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:20:59.407Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:20:59.407Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"5a0d68144578deb01ff2fd1384fb71c68d66c59b2dccb99dc5143fdca265a28f","after_hash":"ecef66876b0abb7c79b501928e1d82cc409042fa33382cb924ea422f56f10200","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"d498797da2c5f732727c6e3fdce6fae5ae5fd3f216159fb2d4c7a218fccb87e5"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:21:00.651Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:21:00.651Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-10-04T10:21:00.651Z","author":"pi-glm","text":"Starting at 2daff95 (Release pm-github v2026.10.04). Plan: pm-cli 2026.9.26->2026.10.4, pm-ops 2026.9.28->2026.10.4, @types/node ->26.6.4 in range, codeql-action SHA group 1c5b6756->2892aa5 from #104; recopy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + read-only dogfood (validate/import/export dry-run/sync dry-run) + previews."}]}],"before_hash":"ecef66876b0abb7c79b501928e1d82cc409042fa33382cb924ea422f56f10200","after_hash":"93af9d890f0d14e1d6d5006bf829317ed1d864417daa16ec74cca761722ae9bd","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"07a09251bef0ae86f134eb770c624a9bd587cce7226be9427c2b41a9eae17d60"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:26:29.326Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-10-04T10:26:29.326Z","author":"pi-glm","text":"Real-tracker dogfood PASS (read-only on GitHub). Packed pm-github-2026.10.4.tgz installed into a scratch copy of this repo's real .agents/pm and registered via pm package install with CLI 2026.10.4. npm path (npx -y @unbrained/pm-cli@2026.10.4): github validate --repo unbraind/pm-github -> ok (token via gh CLI, HTTP 200, quota 4813/5000); github import unbraind/pm-github -> no open issues found (truthful, both this repo and unbraind/pm-csv have zero open issues); github import unbraind/pm-cli -> Imported 26 new (real open issue data fetched read-only); re-import -> 0 new / 26 updated proving gh:owner/repo#N provenance idempotency; github export --dry-run -> create/update plan only, writes nothing; github sync --dry-run --repo unbraind/pm-csv -> planned 0. bun path (bunx @unbrained/pm-cli@2026.10.4): github validate -> ok; github import unbraind/pm-cli -> 0 new / 26 updated; export --dry-run and sync --dry-run identical. Zero GitHub mutation (reads + local scratch writes only); scratch deleted after evidence capture."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:26:29.326Z"}],"before_hash":"93af9d890f0d14e1d6d5006bf829317ed1d864417daa16ec74cca761722ae9bd","after_hash":"a21b7a525c9461d038e4719ac70d7f70a7a9936b02c34b632e31efafcf91b8d7","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"bd3362fc7236e53cd613749025d5b98c524f4f6fb7d8867ef43107fc76675650"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:27:47.809Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/2","value":{"created_at":"2026-10-04T10:27:47.809Z","author":"pi-glm","text":"pm-github installed as managed project extension from npm at latest 2026.10.4 (self-extension registration; extensions are per-clone/gitignored). Read-only previews against unbraind/pm-github: github validate -> ok (HTTP 200, quota 4776/5000); github export --dry-run -> plan only, writes nothing; github sync --dry-run -> planned 1 / skipped 1, no mutation. No issues created/modified, no scheduled sync enabled."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:27:47.809Z"}],"before_hash":"a21b7a525c9461d038e4719ac70d7f70a7a9936b02c34b632e31efafcf91b8d7","after_hash":"352f669b95de0eb8f7309299825abf898014ae8e0333a8f06679f60a072ff946","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"f3ef2ebd5969e9625690b329c4f5d2c3dd2ac1349577b83871acbeae15116056"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:27:49.051Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:27:49.051Z"},{"op":"add","path":"/metadata/files","value":[{"path":"package.json","scope":"project","note":"Exact CLI/ops pins raised to 2026.10.4"}]}],"before_hash":"352f669b95de0eb8f7309299825abf898014ae8e0333a8f06679f60a072ff946","after_hash":"699d45f3b10f7aaf3dc7c651616e4b46ed6bfa90f1db47fc6431f913cfd857ec","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"8c2b99708eeae9cdb60c7af11040faa067a1ed5b759de1fe1af6ebacdd15b594"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:27:49.721Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/0/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/0/path","value":"package-lock.json"},{"op":"add","path":"/metadata/files/1","value":{"path":"package.json","scope":"project","note":"Exact CLI/ops pins raised to 2026.10.4"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:27:49.721Z"}],"before_hash":"699d45f3b10f7aaf3dc7c651616e4b46ed6bfa90f1db47fc6431f913cfd857ec","after_hash":"42f1d8032986abeade3c659235ba63953574f9d205b0863d0cf0a3c31198ad81","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"894c5daca2f0877de0c2dee548c59817709cd977899bbf6d3721a1dc691d0026"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:27:50.468Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/2","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:27:50.468Z"}],"before_hash":"42f1d8032986abeade3c659235ba63953574f9d205b0863d0cf0a3c31198ad81","after_hash":"2509f9c2dc3caf538f1f1cf467253a9bb4fa6b1e0074ea9ea2fd017e123a14c6","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"caf36225a8ff7f885ec150810bda36b98ec6b66661c999699df37e78e8cea1ac"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:27:51.160Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/2/note","value":"Exact CLI/ops pins raised to 2026.10.4"},{"op":"replace","path":"/metadata/files/2/path","value":"package.json"},{"op":"replace","path":"/metadata/files/1/note","value":"Resolved dependency graph with consolidated Dependabot bumps"},{"op":"replace","path":"/metadata/files/1/path","value":"package-lock.json"},{"op":"replace","path":"/metadata/files/0/note","value":"codeql-action pinned SHA group 2892aa5 from #104"},{"op":"replace","path":"/metadata/files/0/path","value":".github/workflows/codeql.yml"},{"op":"add","path":"/metadata/files/3","value":{"path":"scripts/prepare-merge-driver.ts","scope":"project","note":"Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:27:51.160Z"}],"before_hash":"2509f9c2dc3caf538f1f1cf467253a9bb4fa6b1e0074ea9ea2fd017e123a14c6","after_hash":"7290b65f7a9a998401a9c160d5e559229a1e292bff11f88f3e745b6a3b0df290","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"e8891b7ff2a13eca7f6e805bdcde3da8e9b52e46e2727490680e1a623b637fd7"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:27:55.379Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:27:55.379Z"},{"op":"add","path":"/metadata/tests","value":[{"command":"npm run release:check","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T10:27:55.325Z","source_kind":"local_mutation","source_ref":"chore/pm-github-pm-cli-2026-10-4"}}]}],"before_hash":"7290b65f7a9a998401a9c160d5e559229a1e292bff11f88f3e745b6a3b0df290","after_hash":"05d5834636e2395b4965d3d0552ccab2146fe97b14d3ed26fc7bf6e891dabaa0","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"93b4bb778c2d9278707b118e7ecf782f811c571b320ca305212ceda85fa8c59d"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:27:56.430Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/1","value":{"command":"npx pm health","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T10:27:56.397Z","source_kind":"local_mutation","source_ref":"chore/pm-github-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:27:56.430Z"}],"before_hash":"05d5834636e2395b4965d3d0552ccab2146fe97b14d3ed26fc7bf6e891dabaa0","after_hash":"5e1a726042593abfbe2557f52354bea756e0f8be0d5d421f863d97dfb22c1e1c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"9c894d46dbe363182d696e8e9e675b411a03cf65f42ac271f999a10b99ff6a99"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:27:57.452Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/2","value":{"command":"npx -y @unbrained/pm-cli@2026.10.4 github import unbraind/pm-cli","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T10:27:57.374Z","source_kind":"local_mutation","source_ref":"chore/pm-github-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:27:57.452Z"}],"before_hash":"5e1a726042593abfbe2557f52354bea756e0f8be0d5d421f863d97dfb22c1e1c","after_hash":"3fef428706b38b8200439c8966208426d184887a02edb97cc1fb1f9880ec5e1f","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"a4c1d752aa9229b72a298cc6d810953701824331f6788f0253805c1a3d81d99b"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:27:58.328Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/3","value":{"command":"bunx @unbrained/pm-cli@2026.10.4 github sync --dry-run --repo unbraind/pm-csv","scope":"project","provenance":{"author":"pi-glm","created_at":"2026-10-04T10:27:58.293Z","source_kind":"local_mutation","source_ref":"chore/pm-github-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:27:58.328Z"}],"before_hash":"3fef428706b38b8200439c8966208426d184887a02edb97cc1fb1f9880ec5e1f","after_hash":"5586e67b390d62abf75f113fe679463c0a69ec76ecfffec4516aac58efbe9ec1","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"0812af803a259575d7c0432a1ecae441946c22fc382bf5584cf1f792713991c9"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:28:04.223Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:28:04.223Z"},{"op":"add","path":"/metadata/actual_result","value":"Pins raised: @unbrained/pm-cli 2026.9.26->2026.10.4, pm-ops 2026.9.28->2026.10.4; pm-changelog already latest 2026.9.25; @types/node 26.6.4 in range; codeql-action pinned SHA group 2892aa5 carried from Dependabot #104. Canonical pm-ops 2026.10.4 prepare-merge-driver.ts recopied byte-for-byte. npm audit and npm audit --omit=dev both 0 vulnerabilities. Full npm run release:check PASS: typecheck, build, docstring, privacy gate, coverage at configured thresholds, pack dry-run, changelog check, publish-attestation gate. npx pm health exit 0 (one pre-existing stale-items advisory). Real-tracker read-only dogfood on the packed tarball passed via npx and bunx: validate ok; real 26-issue import from unbraind/pm-cli with provenance-tag idempotent re-import (0 new / 26 updated); export --dry-run plan only; sync --dry-run planned 0/1 with no GitHub mutation. pm-github managed extension (self, npm 2026.10.4) registered with read-only previews only."}],"before_hash":"5586e67b390d62abf75f113fe679463c0a69ec76ecfffec4516aac58efbe9ec1","after_hash":"10e176aa87f0fe2e602f7bf6321c4a57a0258063312d357d2b06a2706743fae5","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"b25d99840463706b8195938b5c83e573b11d007dbdc1b263d0cc23e7012192a3"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:28:04.897Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"5a19c20da0d320085dc6f794","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:28:04.897Z"}],"before_hash":"10e176aa87f0fe2e602f7bf6321c4a57a0258063312d357d2b06a2706743fae5","after_hash":"3787773cad65f4a3e596c6e318713b096cf204cadd699e573cacbdc350c3210c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"e01f7e8bfbca37d23290018753d3ad233a00c3c80d53c2b38fefccff7be0473e"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:08:24.876Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:08:24.876Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"3787773cad65f4a3e596c6e318713b096cf204cadd699e573cacbdc350c3210c","after_hash":"5f128648f8a33c58ba2f466f1af9ab83276cab9707d01978aa0060421f8912d6","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"b0747f7de4e1ee269365012d7541e585ead78389c84bb207a368cc2e09a39653"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:08:25.648Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/3","value":{"created_at":"2026-10-04T11:08:25.648Z","author":"codex-sol","text":"Resumed PR #106 after re-reading current comments/reviews. Greptile correctly requests a NODE_PATH lookup-error regression. Add the looping-symlink child-process fixture before pin updates; retain the canonical launcher. Finish exact devDependency pins and latest pm-changelog 2026.10.4, clean npm ci, full locked gate and packed read-only real-tracker npm/bun dogfood."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:08:25.648Z"}],"before_hash":"5f128648f8a33c58ba2f466f1af9ab83276cab9707d01978aa0060421f8912d6","after_hash":"8996705c5785ee9cfee6fd85f010d184b4a7eb350c7121c581cb83e41aeddd92","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"ad974d97217152f752c03ead385221dc4bb2eb37935ca7e844d72aa717ae06f2"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:08:28.836Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"add","path":"/metadata/files/4","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:08:28.836Z"}],"before_hash":"8996705c5785ee9cfee6fd85f010d184b4a7eb350c7121c581cb83e41aeddd92","after_hash":"166ce8e04c4a5bced64d54f97b2a7763d3593ba30fb61ebd32628f43edd75020","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"657cfde52cbe15b77c0cf37cf5a5f0527ed78e2b3c5da876d4e8abd3913655ac"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:08:29.521Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/4","value":{"command":"node --test test/prepare-merge-driver.test.ts","scope":"project","pm_context_mode":"tracker","provenance":{"author":"codex-sol","created_at":"2026-10-04T11:08:29.490Z","source_kind":"local_mutation","source_ref":"chore/pm-github-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:08:29.521Z"}],"before_hash":"166ce8e04c4a5bced64d54f97b2a7763d3593ba30fb61ebd32628f43edd75020","after_hash":"02a01cfa214b8e9c4880e9e47482bbf4b6fd6f8fabe9c6d00039ac94d0982476","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b3ae56dad3b59153eb4dd903487b8a5e2045b4faf30f95da2d8827f31b214aa2"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:19:02.834Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/5","value":{"command":"env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts","scope":"project","pm_context_mode":"tracker","provenance":{"author":"codex-sol","created_at":"2026-10-04T11:19:02.787Z","source_kind":"local_mutation","source_ref":"chore/pm-github-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:19:02.834Z"}],"before_hash":"02a01cfa214b8e9c4880e9e47482bbf4b6fd6f8fabe9c6d00039ac94d0982476","after_hash":"968e572b29f645579d29ac78c4d336366803c941dd23355d22bc913e40e4242d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"e7bd7db049b1b468a99bd90fd697bcd8494be676ecb80fee9438ec43192a340d"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:19:04.632Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/4","value":{"created_at":"2026-10-04T11:19:04.632Z","author":"codex-sol","text":"Also applied the verified cross-repo fixture findings: Node junction type for unconditional Windows-compatible lookup fixtures, and cleared ambient NODE_PATH in the normal prepare helper while preserving the explicit looping lookup. No launcher changes, no new skips. Clean npm ci now succeeds and both audit scopes are clean."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:19:04.632Z"}],"before_hash":"968e572b29f645579d29ac78c4d336366803c941dd23355d22bc913e40e4242d","after_hash":"c8d6155ddb3bc32653a5b53f13589e40110460c82348dfcd1e927715c8ce55bf","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5f1d0c3fee68211d8beb1df59f9c1354fb31f1b15974f5b3b828c0fca0edba4b"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:30:44.957Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/5","value":{"created_at":"2026-10-04T11:30:44.957Z","author":"codex-sol","text":"Resumption validation PASS: all devDependencies exact; CLI/ops/changelog 2026.10.4. Clean npm ci and flock-serialized npm run release:check passed 309/309, zero skips, unchanged configured coverage (2 measured sources), privacy 3052 Git objects clean, both audit scopes 0. Requested lookup-loop regression and hostile NODE_PATH fixture test pass 8/8, no skips; canonical launcher unchanged. Packed real own tracker npm/bun dogfood: npx -y @unbrained/pm-cli@2026.10.4 github validate --repo unbraind/pm-github; github import unbraind/pm-github --dry-run; github export --dry-run --repo unbraind/pm-github; github sync --dry-run --repo unbraind/pm-github; equivalent bunx @unbrained/pm-cli@2026.10.4 commands all pass. Export preview renders 108 creates + 1 update from 109 real items; sync planned 1, wouldSync 0, skipped 1; zero GitHub mutation. Scratch removed. Pinned npx pm health ok without warnings; managed pm-github 2026.10.4 own-repo sync preview returns planned 1 / wouldSync 0 / skipped 1. Review availability remains a separate gate."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:30:44.957Z"}],"before_hash":"c8d6155ddb3bc32653a5b53f13589e40110460c82348dfcd1e927715c8ce55bf","after_hash":"dfad84fbd7acee0da9868f57393e173e162f96d21996fbfb67b966a4412c4b23","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"7d19ddf08a8704f248ab4e580dd255c21a5981e38983106009fccabb99db913e"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:30:45.955Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"Exact development pins completed: CLI/ops/changelog 2026.10.4, Node types 26.6.4, TypeScript 7.0.2. Canonical launcher unchanged; lookup-loop and isolated ambient NODE_PATH fixtures pass 8/8, no skips; junction type avoids new platform skips. Clean npm ci and serialized release:check PASS: 309/309 tests, zero skips; unchanged configured coverage, 3052 Git objects privacy audited. npm audit all/prod each 0; no open alerts. Packed own tracker npx/bunx validate/import preview/export preview/sync preview pass; real export plans 108 creates and 1 update; sync planned 1, wouldSync 0, skipped 1. Zero GitHub writes; scratch removed. Pinned health ok with no warnings. Review receipts pending; leave certification item and PR open."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:30:45.955Z"}],"before_hash":"dfad84fbd7acee0da9868f57393e173e162f96d21996fbfb67b966a4412c4b23","after_hash":"05c46b62e3714bd14415671f39878c6777c10e4a89a1af6ccbc4f128ea83bef6","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"6773d020afbd7d7695b837eded0ef0780f8fdf4e7b597d12e8342f95de7a1952"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:30:47.106Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:30:47.106Z"}],"before_hash":"05c46b62e3714bd14415671f39878c6777c10e4a89a1af6ccbc4f128ea83bef6","after_hash":"99de8eab9dcb1314b1144660c0a6550e9281768ac79d1969b01dfca1d524cc4a","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"30bed3a774377349fe41af169f3fca3433e234ea83b4014432cb82da93423ef3"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:51:29.977Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:51:29.977Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"99de8eab9dcb1314b1144660c0a6550e9281768ac79d1969b01dfca1d524cc4a","after_hash":"82417f91a5bd95f8a9ecb37f888b92cd08930f7152ef3f851c330ff4fb349c90","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"a47becd0ff33eb9901a312ac00d8ed24ea505f6bfc91a490edded571b8e2f800"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:51:30.969Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/6","value":{"created_at":"2026-10-04T11:51:30.969Z","author":"codex-sol","text":"Final health receipt correction: the complete pinned health receipt has stale_in_progress_items:2 advisory, not zero warnings as the earlier resumption text claimed. Health exits 0 with no gate-failing findings. Existing items remain open for their owners. Package code, 309/309 full gate result, clean audits, packed read-only real-tracker dogfood and substantive CodeRabbit/Greptile reviews are unchanged."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:51:30.969Z"}],"before_hash":"82417f91a5bd95f8a9ecb37f888b92cd08930f7152ef3f851c330ff4fb349c90","after_hash":"3bf3fb5518f01cf94173ba43b9201f200903e8f63bf9a48a613a4562b968e218","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"646636e1f98f08774322b0015213dd2c7ea81dabc4b13ef73751b4b28a9aaa26"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:51:31.689Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"Exact CLI/ops/changelog 2026.10.4 and development pins; canonical launcher unchanged; isolated lookup-loop suite 8/8. Clean npm ci and serialized release:check PASS 309/309, zero skips, unchanged coverage and privacy gate passed; both audit scopes 0, no open alerts. Packed own-tracker npx/bunx read-only commands pass (108 create + 1 update export preview, sync planned 1 / wouldSync 0 / skipped 1), no GitHub writes; scratch removed. Health exits 0 with stale_in_progress_items:2 advisory and no gate-failing findings, correcting the earlier zero-warning text. CodeRabbit and Greptile substantive reviews find no new actionable issues; other required reviews unavailable/pending. Leave item and PR open."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:51:31.689Z"}],"before_hash":"3bf3fb5518f01cf94173ba43b9201f200903e8f63bf9a48a613a4562b968e218","after_hash":"9fad513c388f7f4de48cfd8b0bbf6cf958ce73149d21cf6cc1968f6d709bb671","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"ef14000ff3460cc79a7296b7e111483c50e64c9d840fa7c99b0df44f61e61738"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:51:32.498Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"59daee2cb1c27c169a02145c","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:51:32.498Z"}],"before_hash":"9fad513c388f7f4de48cfd8b0bbf6cf958ce73149d21cf6cc1968f6d709bb671","after_hash":"3b6f2979acbfab890a2691c15e6f264fa0e14bb1059bfc1ae4ede47a15f919de","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b0135ebdcae8b7ea856b424154082e5e7c266d9298b5b50a828b6f9de2e0e728"} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f6112f7..82dc660 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,13 +28,13 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: languages: javascript-typescript # These packages are analyzed from source without a compiled build. build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: category: "/language:javascript-typescript" diff --git a/package-lock.json b/package-lock.json index f4663f8..af85a4d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,11 +9,11 @@ "version": "2026.10.4", "license": "MIT", "devDependencies": { - "@types/node": "^26.6.2", - "@unbrained/pm-cli": "2026.9.26", - "pm-changelog": "2026.9.25", - "pm-ops": "2026.9.28", - "typescript": "^7.0.2" + "@types/node": "26.6.4", + "@unbrained/pm-cli": "2026.10.4", + "pm-changelog": "2026.10.4", + "pm-ops": "2026.10.4", + "typescript": "7.0.2" }, "engines": { "node": ">=22.18.0" @@ -35,44 +35,6 @@ "node": ">=18.0.0" } }, - "node_modules/@nodelib/fs.scandir": { - "version": "2.1.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz", - "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "2.0.5", - "run-parallel": "^1.1.9" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.stat": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz", - "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.walk": { - "version": "1.2.8", - "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz", - "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.scandir": "2.1.5", - "fastq": "^1.6.0" - }, - "engines": { - "node": ">= 8" - } - }, "node_modules/@opentelemetry/api": { "version": "1.9.1", "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz", @@ -319,9 +281,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz", - "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==", + "version": "26.6.4", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.4.tgz", + "integrity": "sha512-ldVPDCzj7fsaGZrLB0NuHuTvJcsNasysBAqMolr/cgxrLd1xbqxIr3XJiPnHHJUCxj5sNF1vnRj9aWnrVh5Jcg==", "dev": true, "license": "MIT", "dependencies": { @@ -669,9 +631,9 @@ } }, "node_modules/@unbrained/pm-cli": { - "version": "2026.9.26", - "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.9.26.tgz", - "integrity": "sha512-uO/3ub2SfOwBbpd7rxDNUXDYdVzOdHOGx4spPzmvhfAoJlyfRQI81u73GIkmqjFzMOUXhESHITPteKCQT7tolA==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.10.4.tgz", + "integrity": "sha512-NZLdiUSUKIRcFiMj9lG0L5UubA9G33fq5WzB1JzJjTTlYxYCVjrFFOCV2rtxYTaYTCzX9o/6V/A4fDx6N3mm/w==", "dev": true, "license": "MIT", "dependencies": { @@ -679,10 +641,10 @@ "@toon-format/toon": "^4.1.1", "@types/node": ">=22", "commander": "^15.0.0", - "fast-glob": "^3.3.3", "fast-json-patch": "^3.1.1", "npm-package-arg": "^13.0.2", "tar": "7.5.22", + "tinyglobby": "^0.2.17", "yaml": "^2.9.1" }, "bin": { @@ -695,19 +657,6 @@ "node": ">=22.18.0" } }, - "node_modules/braces": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", - "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==", - "dev": true, - "license": "MIT", - "dependencies": { - "fill-range": "^7.1.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/chownr": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz", @@ -760,23 +709,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fast-glob": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz", - "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "^2.0.2", - "@nodelib/fs.walk": "^1.2.3", - "glob-parent": "^5.1.2", - "merge2": "^1.3.0", - "micromatch": "^4.0.8" - }, - "engines": { - "node": ">=8.6.0" - } - }, "node_modules/fast-json-patch": { "version": "3.1.1", "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz", @@ -784,42 +716,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fastq": { - "version": "1.20.1", - "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz", - "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==", - "dev": true, - "license": "ISC", - "dependencies": { - "reusify": "^1.0.4" - } - }, - "node_modules/fill-range": { - "version": "7.1.1", - "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz", - "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==", - "dev": true, - "license": "MIT", - "dependencies": { - "to-regex-range": "^5.0.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/glob-parent": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", - "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", - "dev": true, - "license": "ISC", - "dependencies": { - "is-glob": "^4.0.1" - }, - "engines": { - "node": ">= 6" - } - }, "node_modules/hosted-git-info": { "version": "9.0.3", "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.3.tgz", @@ -848,39 +744,6 @@ "node": ">=18" } }, - "node_modules/is-extglob": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz", - "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-glob": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz", - "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==", - "dev": true, - "license": "MIT", - "dependencies": { - "is-extglob": "^2.1.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-number": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz", - "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.12.0" - } - }, "node_modules/lru-cache": { "version": "11.5.2", "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz", @@ -891,30 +754,6 @@ "node": "20 || >=22" } }, - "node_modules/merge2": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz", - "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/micromatch": { - "version": "4.0.8", - "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz", - "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==", - "dev": true, - "license": "MIT", - "dependencies": { - "braces": "^3.0.3", - "picomatch": "^2.3.1" - }, - "engines": { - "node": ">=8.6" - } - }, "node_modules/minipass": { "version": "7.1.3", "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz", @@ -968,23 +807,10 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/picomatch": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", - "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8.6" - }, - "funding": { - "url": "https://github.com/sponsors/jonschlinkert" - } - }, "node_modules/pm-changelog": { - "version": "2026.9.25", - "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.25.tgz", - "integrity": "sha512-j2l97jlJIfuMiB7KDi7oIr9MWxdQvqnDx/JwE3pxC31fDw3MywnSmaTcE9/gV6sVlZbQkOSxnxooHzDwRo+1+g==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.10.4.tgz", + "integrity": "sha512-YJJHJYv2i+olzGVF+qdab3wWG6auiRVIvf7TZD4ZdUhE/8lIawf3aYOOZZVJHogN8xP8rNUlVV9Lc1OXKLlQ7w==", "dev": true, "license": "MIT", "bin": { @@ -998,9 +824,9 @@ } }, "node_modules/pm-ops": { - "version": "2026.9.28", - "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.9.28.tgz", - "integrity": "sha512-MjsVk6uGYz8X3OxVuBHuBUEjcoUb3ubqSCG/hWvYOlj8AI8gbc3IPsIUGfDECH6WYP63B8hYjvc6Ahv3DdbIyQ==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.10.4.tgz", + "integrity": "sha512-/6ehQBNwKquIol3EUW1r4pZSXKaohHc1gXJUSk7cqQwkVJOSlP8cCcHzNFH76/6O9hG04Eb5KAH90vFkhTxfMQ==", "dev": true, "license": "MIT", "dependencies": { @@ -1046,27 +872,6 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/queue-microtask": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz", - "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT" - }, "node_modules/require-in-the-middle": { "version": "8.0.1", "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz", @@ -1081,41 +886,6 @@ "node": ">=9.3.0 || >=8.10.0 <9.0.0" } }, - "node_modules/reusify": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz", - "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==", - "dev": true, - "license": "MIT", - "engines": { - "iojs": ">=1.0.0", - "node": ">=0.10.0" - } - }, - "node_modules/run-parallel": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz", - "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT", - "dependencies": { - "queue-microtask": "^1.2.2" - } - }, "node_modules/semver": { "version": "7.8.5", "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", @@ -1146,17 +916,52 @@ "node": ">=18" } }, - "node_modules/to-regex-range": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", - "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==", + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", "dev": true, "license": "MIT", "dependencies": { - "is-number": "^7.0.0" + "fdir": "^6.5.0", + "picomatch": "^4.0.4" + }, + "engines": { + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" + } + }, + "node_modules/tinyglobby/node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, + "node_modules/tinyglobby/node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", + "dev": true, + "license": "MIT", "engines": { - "node": ">=8.0" + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" } }, "node_modules/typescript": { diff --git a/package.json b/package.json index a42ce1c..2ef3597 100644 --- a/package.json +++ b/package.json @@ -44,11 +44,11 @@ "@unbrained/pm-cli": ">=2026.8.20" }, "devDependencies": { - "@types/node": "^26.6.2", - "@unbrained/pm-cli": "2026.9.26", - "pm-changelog": "2026.9.25", - "pm-ops": "2026.9.28", - "typescript": "^7.0.2" + "@types/node": "26.6.4", + "@unbrained/pm-cli": "2026.10.4", + "pm-changelog": "2026.10.4", + "pm-ops": "2026.10.4", + "typescript": "7.0.2" }, "keywords": [ "github", diff --git a/scripts/prepare-merge-driver.ts b/scripts/prepare-merge-driver.ts index 728ece4..f6f49f0 100644 --- a/scripts/prepare-merge-driver.ts +++ b/scripts/prepare-merge-driver.ts @@ -31,8 +31,12 @@ try { // the original error is rethrown. A probe that finds no package.json is not // yet proof of absence: a broken install can leave `node_modules/pm-ops` (a // directory or a dangling link) with no package.json in any ancestor Node - // searches. Such an entry also counts as present. Node returns null paths - // only for built-in modules; pm-ops/package.json is a package specifier. + // searches. Such an entry also counts as present. Keep Node's global paths + // too: the installer resolution above can use them, so an absent local + // package alone cannot prove absence. An unreadable or malformed lookup path + // leaves presence uncertain and must fail closed with the original error. + // Node returns null paths only for built-in modules; pm-ops/package.json is + // a package specifier. let packagePresent = true; try { resolver.resolve("pm-ops/package.json"); @@ -40,7 +44,16 @@ try { packagePresent = !(probe instanceof Error && "code" in probe && probe.code === "MODULE_NOT_FOUND") || resolver.resolve.paths("pm-ops/package.json")!.some( - (directory) => lstatSync(join(directory, "pm-ops"), { throwIfNoEntry: false }) !== undefined, + (directory) => { + try { + return lstatSync(join(directory, "pm-ops"), { throwIfNoEntry: false }) !== undefined; + } catch { + // throwIfNoEntry:false only suppresses ENOENT, not EACCES, EPERM, + // ENOTDIR, or ELOOP. Do not replace the installer diagnostic or + // treat an inconclusive presence check as an omit-dev install. + return true; + } + }, ); } if (packagePresent) throw error; diff --git a/test/prepare-merge-driver.test.ts b/test/prepare-merge-driver.test.ts index 2040808..87621fd 100644 --- a/test/prepare-merge-driver.test.ts +++ b/test/prepare-merge-driver.test.ts @@ -69,7 +69,7 @@ function stubPm(name: string, status: number, body = ""): string { /** Run the launcher as npm's `prepare` hook would: as the entry point, from `cwd`, with `path` as PATH. */ function prepare(cwd: string, path: string): SpawnSyncReturns { - return spawnSync(process.execPath, [launcher], { cwd, encoding: "utf8", env: { ...process.env, PATH: path } }); + return spawnSync(process.execPath, [launcher], { cwd, encoding: "utf8", env: { ...process.env, PATH: path, NODE_PATH: "" } }); } /** The merge drivers registered in a checkout's LOCAL Git config, by name. */ @@ -120,6 +120,21 @@ test("a pm-ops too old to export the launcher entry fails the install", posixOnl assert.match(result.stderr, /ERR_PACKAGE_PATH_NOT_EXPORTED/); }); +test("a looping lookup path preserves the original installer error", () => { + const directory = checkout("lookup-loop", "absent"); + const lookup = join(directory, "lookup"); + symlinkSync(lookup, lookup, "junction"); + const result = spawnSync(process.execPath, [launcher], { + cwd: directory, + encoding: "utf8", + env: { ...process.env, PATH: hostPath, NODE_PATH: lookup }, + }); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /Cannot find module 'pm-ops\/merge-driver\/prepare'/); + assert.doesNotMatch(result.stderr, /skipping merge-driver install|ELOOP|lstat/); + assert.deepEqual(registeredDrivers(directory), []); +}); + test("a failing pm merge install fails the install with the same status", posixOnly, () => { const result = prepare(checkout("failing-pm", "pinned"), stubPm("failing-pm", 7)); assert.equal(result.status, 7, result.stderr);