@archpilotlabs/archpilot 0.2.3 → 0.2.4

package/CHANGELOG.md

@@ -0,0 +1,538 @@
+# Changelog
+
+## 0.2.4
+
+### Improved
+
+- Improved data-query-risk precision for bounded single-record lookups, query-builder evidence, and raw SQL detection.
+- Improved Java event architecture analysis so constructed event types are extracted from publisher calls without using `new` or lambda parameter names as event identities.
+- Improved authorization analysis so findings require credible executable authorization or permission-decision evidence.
+- Improved source-scope applicability for application-layering checks on integration-test, example, and fixture-style source.
+- Improved dependency evidence handling so explicitly governed example, test, and integration-test modules continue to contribute architecture-map and required-dependency evidence.
+- Improved Smart Init coverage for declared nested Maven reactor modules while continuing to exclude aggregator, BOM, distribution, benchmark, test-only, and source-light support artifacts from default governed components.
+- Improved Smart Init consistency for source-bearing Maven child modules and runnable example modules with equivalent structural evidence.
+- Improved Java and Spring library-stack selection so incidental Node or TypeScript tooling is not promoted over dominant JVM framework evidence.
+- Preserved explicit Node, Python, Go, and Kotlin library-stack selections when their ecosystem evidence is dominant.
+- Improved validation-report terminology for explicit root modules, component-backed contracts, and dependency summaries.
+- Added clearer Smart Init proposal reasons to CLI detection summaries.
+- Improved CLI initialization terminology and supported-stack normalization.
+
+### Fixed
+
+- Fixed method-name-only data-query-risk findings for business or helper methods without structural read-query evidence.
+- Fixed SQL-looking comments and documentation examples being treated as executable raw SQL.
+- Fixed false authorization findings caused by repository class names, imports, package declarations, or comments.
+- Fixed production-only repository-layer findings being emitted for confirmed non-production source.
+- Fixed false declared-dependency-not-used findings caused by source-scope filtering removing real dependency evidence.
+- Fixed dependency boundary enforcement so ordinary tests inside production modules do not create production dependency edges.
+- Fixed nested Maven reactor modules being omitted from automatically generated architecture models.
+
+### Notes
+
+- These changes reduce false positives without changing rule IDs, severities, score weights, or scoring caps.
+- Genuinely unbounded collection and relation reads remain reportable when no limit or pagination evidence is present.
+- Component-backed contracts remain valid dependency-validation boundaries even when no explicit root modules are configured.
+
+---
+
+## 0.2.3
+
+### Improved
+
+- Improved Maven and Spring component-role detection across complex multi-module repositories.
+- Improved executable application detection for Java varargs entrypoints, split launcher/application structures, composed Spring application annotations, and helper-mediated launch patterns.
+- Improved ownership of runnable evidence so it remains scoped to the Maven artifact where it is declared.
+- Improved validation performance for large multi-component repositories by preparing and reusing dependency ownership context.
+- Expanded regression coverage for Maven component classification, dependency ownership resolution, and component-backed module behavior.
+
+### Fixed
+
+- Fixed runnable Maven child applications being missed or incorrectly classified as libraries.
+- Fixed executable evidence leaking across Maven modules and promoting sibling libraries or parent aggregators to backend applications.
+- Fixed POM-only aggregators, plugin-management configuration, annotation declarations, utility programs, exporters, generators, and test launchers being treated as runnable backend applications.
+- Fixed structurally redundant component-backed fallback modules being treated as meaningful internal modules in generated architecture summaries.
+- Fixed resolved local imports under configured module roots being misclassified as external dependencies.
+- Fixed deployable component container paths such as `services/*` being mistaken for internal application service layers.
+
+### Notes
+
+- Component-backed fallback modules remain part of the canonical architecture map where required for validation, scoring, dependency analysis, reports, and history.
+- Existing architecture configurations remain backward compatible.
+- No validation rules were weakened.
+
+---
+
+## 0.2.2
+
+### Improved
+
+- Improved Smart Init accuracy across repository topology, stack, project-role, component, and module detection.
+- Improved classification of runnable frontend applications, reusable frontend packages, backend services, and libraries.
+- Improved handling of Maven aggregators, nested Maven modules, and content stored beneath JVM resource roots.
+- Improved source-scope classification so validation rules apply only to relevant production code.
+- Improved API design, application-layering, transaction/domain, dependency, and data-query-risk analysis.
+- Improved consistency across validation findings, reports, contracts, and architecture maps.
+
+### Fixed
+
+- Fixed reusable frontend packages being incorrectly classified as runnable applications.
+- Fixed resource-contained Maven files being promoted as independent Java or Spring components.
+- Fixed POM-only Maven aggregators being treated as governed runtime components.
+- Fixed module contracts generating public entrypoints that were not backed by existing source files.
+- Fixed false positives caused by test, generated, migration, infrastructure, frontend, and other non-applicable source files.
+- Fixed duplicate or misleading findings across multiple validation areas.
+- Fixed valid zero-edge dependency graphs being treated as incomplete or incorrect.
+- Fixed reporting inconsistencies between validation output and generated reports.
+
+### Notes
+
+- This release focuses on Smart Init and validation correctness across complex repositories and monorepos.
+- Component, module, contract, and finding detection now relies on more conservative structural evidence.
+- The changes reduce false positives without weakening deterministic architecture enforcement.
+- Existing architecture configurations remain backward compatible.
+
+---
+
+## 0.2.1
+
+### Improved
+
+- Significantly improved validation precision across application layering, domain modeling, transaction analysis, query-risk detection, event architecture, API contract drift, ADR coverage, and dependency governance.
+- Improved source-scope classification so frontend, test, e2e, generated, migration, CLI, plugin, and infrastructure files are evaluated only by rules that genuinely apply to them.
+- Improved transaction analysis to distinguish transaction ownership, participation, propagation, nested boundaries, and transaction infrastructure.
+- Improved query-risk analysis with better recognition of bounded, single-record, operational, and batch query patterns.
+- Improved event analysis to distinguish internal unmatched events from package-public extension events.
+- Improved API contract validation for GraphQL-first repositories, operational endpoints, dynamic routes, and production-only endpoint extraction.
+- Improved architecture drift and ADR reporting so partial coverage, coupling risks, and true boundary drift are described accurately.
+- Improved validation performance through shared source inventories, TypeScript AST caching, and per-run dependency import-resolution caching.
+- Improved finding normalization with stable scoring identities independent of user-facing message detail.
+- Improved component-oriented initialization so generated module identities, contracts, dependency rules, public entrypoints, and architecture maps remain consistent.
+- Expanded validation coverage across large TypeScript, Java, Go, and mixed-stack repositories.
+
+### Fixed
+
+- Fixed false architecture findings caused by frontend services, tests, e2e specifications, generated templates, example plugins, migrations, and infrastructure code being treated as production backend architecture.
+- Fixed repository-layer bypass warnings being emitted when no explicit repository or persistence boundary was established.
+- Fixed anemic-domain warnings caused by unrelated service logic, data records, translation entities, and non-production entities.
+- Fixed nested transaction warnings caused by broad method-name matching and transaction lifecycle infrastructure.
+- Fixed long-running transaction warnings being emitted for transaction wrapper and subscriber implementation code.
+- Fixed unbounded-query findings for bounded lookups, health checks, migrations, caches, schedulers, job queues, and indexing operations.
+- Fixed query-risk scoring regressions caused by detailed display messages creating separate score clusters.
+- Fixed public extension events being reported as dead or unhandled when exposed through package or module public entrypoints.
+- Fixed generic event publisher detection confusing unrelated `send`, `emit`, `publish`, and `dispatch` calls with architecture events.
+- Fixed declared dependency checks using inconsistent graph and validation edge classifications.
+- Fixed component-oriented Smart Init generating dependency targets without corresponding contracts.
+- Fixed explicit empty module selections being rediscovered after initialization.
+- Fixed e2e symbols and operational endpoints being reported as OpenAPI contract drift.
+- Fixed dynamically configured GraphQL endpoints being reported as missing implementations.
+- Fixed AP-ADR-004 showing a broad pass while specific ADR requirements still failed.
+- Fixed high inbound dependency warnings being described as dependency-boundary drift.
+
+### Notes
+
+- This release focuses on validation accuracy, performance, generated-model consistency, and trustworthiness.
+- Valid dependency, transaction, query, API, and architecture findings continue to be reported when supported by explicit evidence.
+- Existing architecture configurations remain backward compatible.
+
+---
+
+## 0.2.0
+
+### Added
+
+- Component-aware architecture maps for exploring module relationships and dependency flows.
+- Expanded Smart Init architecture reasoning with confidence, detected evidence, and proposal explanations.
+- Additional regression coverage across Smart Init, architecture maps, and validation workflows.
+
+### Improved
+
+- Improved Smart Init detection and architecture proposals across diverse repositories.
+- Improved architecture modeling and module discovery for large and complex repositories.
+- Improved Architecture Health Score consistency across component-oriented and module-oriented architectures.
+- Improved validation accuracy through extensive testing against public repositories.
+- Improved generated reports and architecture-map stability for real-world projects.
+
+### Fixed
+
+- Fixed architecture-map filtering and component-selection inconsistencies in generated data.
+- Fixed Smart Init edge cases affecting project detection and proposal generation.
+- Fixed validation and reporting issues discovered through real-world repository testing.
+
+### Notes
+
+- This release matures architecture-map generation and Smart Init for real-world repositories.
+- Existing architecture configurations remain backward compatible.
+- No validation rules were weakened.
+
+---
+
+## 0.1.0
+
+### Added
+
+- Cross-stack deterministic architecture validation across major backend frameworks including Spring, NestJS, Express, FastAPI, ASP.NET, Laravel, and Go.
+- Expanded architecture governance coverage for API design, application layering, authorization, tenant isolation, transaction boundaries, data/query risk, domain model quality, event architecture, and dependency governance.
+- Framework-aware architecture detection using routes, dependency relationships, ORM usage, transaction APIs, authorization constructs, messaging infrastructure, and architecture configuration.
+- Richer Architecture Health Score explanations highlighting the largest contributors to score changes.
+
+### Improved
+
+- Significantly improved architecture validation accuracy across supported backend frameworks.
+- Improved deterministic architecture detection while reducing framework-specific false positives.
+- Improved dependency resolution across JavaScript/TypeScript, C#, Python, PHP, and Go projects.
+- Improved architecture findings with cleaner evidence and more actionable explanations.
+- Improved reporting with clearer score-contribution summaries.
+- Expanded regression coverage across supported backend frameworks.
+
+### Fixed
+
+- Fixed noisy finding metadata that could surface invalid evidence labels.
+- Fixed score-reporting inconsistencies by validating reporting paths against the canonical Architecture Health Score calculation.
+- Fixed cross-stack architecture detection edge cases affecting dependency, transaction, authorization, API design, event, and query analysis.
+
+### Notes
+
+- Architecture validation provides broad deterministic coverage while maintaining a conservative false-positive philosophy.
+- Validation relies on explicit architectural evidence rather than speculative code analysis.
+- Existing architecture configurations remain backward compatible.
+- No validation rules were weakened.
+
+---
+
+## 0.0.14
+
+### Added
+
+- Added richer Smart Init tooling detection across modern runtimes, build tooling, ORMs, and persistence frameworks.
+- Added proposal reasoning for framework, API, database, tooling, architecture style, and module-root recommendations.
+- Added regression coverage for Smart Init detection and proposal generation.
+
+### Improved
+
+- Improved Smart Init detection summaries with clearer primary stack, additional signals, API hints, database hints, tooling/data hints, confidence, evidence, and proposal reasons.
+- Improved project-kind detection to reduce noisy backend/library and backend/frontend classifications.
+- Improved CLI terminology around Smart Init, setup readiness, architecture health, and detected architecture signals.
+- Improved supported-stack smoke coverage so adapter detection, initialization, and validation/setup outcomes are reported separately.
+
+### Fixed
+
+- Fixed unsupported Kotlin Spring and Rust values being exposed as current initialization choices.
+- Fixed `archpilot init --yes` fixture and workspace resolution so it initializes the intended project instead of walking up into the repository workspace.
+
+### Notes
+
+- Kotlin/Spring projects continue to be handled through the Spring adapter when Spring Boot evidence is present.
+- Rust remains internal and backward-compatible metadata, but is not exposed as a current Smart Init stack choice.
+- Bun, Deno, Vite, ORM, and database technologies remain supporting tooling or data hints rather than primary architecture stack adapters.
+- Existing architecture configurations remain backward compatible.
+- No validation rules were weakened.
+
+---
+
+## 0.0.13
+
+### Added
+
+- Deterministic architecture-layering validation for controller, service, repository, and package responsibility drift.
+- Deterministic authorization-consistency validation across supported backend architectures.
+- Deterministic tenant-isolation validation for multi-tenant applications.
+- Expanded architecture-governance coverage across boundaries, dependency direction, contracts, and architecture hygiene.
+
+### Improved
+
+- Improved architecture-governance accuracy across supported backend projects.
+- Improved architecture modeling and dependency analysis used by validation and reporting.
+- Improved governance-upload compatibility between CLI-generated artifacts and ArchPilot Cloud.
+- Improved generated module, component, and resource inventory data.
+
+### Fixed
+
+- Fixed component-aware findings losing source and target component metadata.
+- Fixed governance uploads not honoring configured Cloud endpoints in certain scenarios.
+- Fixed documentation referencing outdated token and upload configuration patterns.
+
+### Notes
+
+- This release expands deterministic architecture-governance coverage and Cloud artifact compatibility.
+- Existing repositories remain backward compatible.
+- No validation rules were weakened.
+
+---
+
+## 0.0.12
+
+### Added
+
+- Expanded architecture-proposal customization during initialization.
+- Deterministic application-layering validation for controller, service, repository, and package responsibility drift.
+- Deterministic authorization-consistency and tenant-isolation validation for supported backend projects.
+
+### Improved
+
+- Improved Smart Init proposals across supported repository structures.
+- Improved architecture-module discovery and classification.
+- Improved separation between architecture modules, components, resources, technical layers, and shared infrastructure.
+- Improved multi-component and monorepo initialization.
+- Improved architecture-modeling accuracy for complex repositories.
+
+### Fixed
+
+- Fixed Smart Init scenarios where repositories could not be initialized successfully.
+- Fixed architecture modules being incorrectly inferred from component and service folders.
+- Fixed architecture-module persistence during initialization.
+- Fixed module-root handling during Smart Init.
+- Fixed initialization falling back to technical folders after explicit architecture choices.
+
+### Notes
+
+- Components, resources, and architecture modules are modeled independently.
+- Existing architecture configurations remain backward compatible.
+- No validation rules were weakened.
+
+---
+
+## 0.0.11
+
+### Added
+
+- Backend and frontend stack overrides during Smart Init.
+- Primary database selection during initialization.
+- Additional detected databases and data stores represented as architecture resources and hints.
+- Expanded Smart Init regression coverage across supported stacks.
+
+### Improved
+
+- Improved Smart Init proposals across supported backend and frontend stacks.
+- Improved architecture-module candidate classification and governance modeling.
+- Improved separation between architecture modules, technical layers, and shared infrastructure.
+- Improved handling of explicit architecture-module selection.
+- Improved initialization for multi-module repositories.
+
+### Fixed
+
+- Fixed Spring initialization scenarios that could prevent successful Smart Init completion.
+- Fixed framework and implementation folders being incorrectly promoted to governed architecture modules.
+- Fixed validation and contract generation falling back to technical folders.
+- Fixed explicit empty module selections being replaced by fallback discovery.
+- Fixed module candidate refresh behavior when modifying module roots.
+- Fixed architecture-module persistence between Smart Init and generated output.
+
+### Notes
+
+- Explicit architecture-module selections remain the source of truth after initialization.
+- Existing architecture configurations remain backward compatible.
+- No validation rules were weakened.
+
+---
+
+## 0.0.10
+
+### Added
+
+- Hardened GitHub Actions workflow generation across supported package managers.
+- Added workflow validation coverage for pnpm, npm, Yarn 4, and fallback package-manager scenarios.
+- Added package-manager-aware workflow generation with lockfile-sensitive caching.
+- Added workflow assertions for action allowlists and setup ordering.
+
+### Improved
+
+- Generated pnpm workflows now use Corepack-based setup.
+- Generated workflows initialize package managers before dependency caching.
+- Improved workflow reliability on clean GitHub Actions runners.
+- Improved package-manager detection using `packageManager` metadata with stable fallbacks.
+
+### Fixed
+
+- Fixed generated pnpm workflows failing because pnpm was unavailable during `actions/setup-node` cache initialization.
+- Fixed workflow generator dependency on external pnpm setup actions.
+
+### Notes
+
+- Existing generated workflows may need to be regenerated to use the latest setup behavior.
+- Workflow generation supports deterministic package-manager setup across pnpm, npm, and supported Yarn configurations.
+- No validation scoring or rule behavior changed.
+
+---
+
+## 0.0.9
+
+### Improved
+
+- Improved architecture validation accuracy for monorepos and multi-package workspaces.
+- Improved handling of package-based imports across CLI output and generated reports.
+- Improved Architecture Health Score reliability for dependency-governance scenarios.
+- Improved recognition of public versus internal package APIs.
+- Improved validation stability for package exports and workspace aliases.
+
+### Fixed
+
+- Fixed false dependency violations in monorepo and workspace package structures.
+- Fixed findings caused by package subpath imports.
+- Fixed valid package imports being treated as private or forbidden.
+- Fixed cascaded dependency findings incorrectly reducing Architecture Health Scores.
+- Fixed inconsistent behavior between local development and packaged environments.
+- Fixed noisy dependency-governance edge cases.
+
+### Notes
+
+- Validation behavior better aligns with package public API definitions.
+- No validation rules were weakened.
+- Existing repositories remain backward compatible.
+
+---
+
+## 0.0.8
+
+### Added
+
+- Inventory-first architecture model with components and resources as first-class concepts.
+- Cross-component dependency awareness in validation findings and summaries.
+- Architecture inventory coverage insights.
+- Guided setup recovery through generation of missing configuration and contracts.
+
+### Improved
+
+- Improved first-run initialization clarity.
+- Added a clear distinction between setup gaps and architecture violations.
+- Improved consistency between Smart Init output and validation expectations.
+- Improved visibility into contracts, configuration, modules, and inventory completeness.
+- Improved multi-component repository handling.
+
+### Fixed
+
+- Fixed setup gaps appearing as generic architecture errors.
+- Fixed missing contracts and configuration not being clearly actionable.
+- Fixed generated artifacts not being reflected immediately in subsequent validation.
+
+### Notes
+
+- Inventory is a core part of the architecture model.
+- Setup gaps are separated from architecture violations.
+- No core validation rules or scoring logic changed.
+- Existing repositories remain backward compatible.
+
+---
+
+## 0.0.7
+
+### Added
+
+- Component-aware architecture summaries.
+- Component-level grouping of findings.
+- Cross-component dependency insights.
+- Improved visibility into multi-component repositories.
+
+### Improved
+
+- Improved multi-component detection for monorepos and multi-service repositories.
+- Improved handling of multiple frontend, backend, service, and library components.
+- Improved Smart Init consistency across CLI-generated configuration and reports.
+- Improved nested-workspace and mixed-stack handling.
+
+### Fixed
+
+- Fixed dependency classification in legacy single-project setups.
+- Fixed local relative imports being treated as external dependencies.
+- Fixed module attribution across multi-package workspaces.
+- Fixed noisy dependency findings in monorepo structures.
+
+### Notes
+
+- `archpilot init` supports the multi-component architecture model.
+- Existing repositories remain backward compatible.
+- No scoring or rule behavior changed.
+
+---
+
+## 0.0.6
+
+### Added
+
+- Multi-component architecture detection for monorepos and multi-service repositories.
+- Component-level modeling across applications, services, workers, and shared libraries.
+- Architecture-resource awareness for APIs, databases, and system dependencies.
+- Dedicated multi-component Smart Init smoke coverage.
+
+### Improved
+
+- Smart Init preserves multiple frontend and backend components without collapsing them into a single stack.
+- Improved proposal generation for mixed-stack monorepos.
+- Improved component-boundary detection for nested workspaces.
+- Improved handling of services, workers, and shared packages.
+
+### Fixed
+
+- Fixed non-code folders such as documentation, reports, and fixtures being promoted as components.
+- Fixed repository-level defaults when no backend or service component exists.
+- Fixed noisy module attribution in multi-package workspaces.
+
+### Notes
+
+- Multi-component support remains backward compatible with single-project repositories.
+- Local validation remains local-first. Cloud receives uploaded governance artifacts rather than source code.
+
+---
+
+## 0.0.5
+
+### Added
+
+- Expanded supported-stack coverage across backend, frontend, platform, and infrastructure stacks.
+- Added hierarchical module discovery for clearer internal architecture boundaries.
+- Added independent and potential-orphan module classification.
+
+### Improved
+
+- Improved workspace-package dependency resolution for monorepos.
+- Improved dependency-graph accuracy for nested module structures.
+- Improved architecture-map metadata for hierarchy-aware modules.
+- Improved module classification and dependency insights.
+
+### Fixed
+
+- Fixed dependency findings caused by package subpath imports.
+- Fixed orphan warnings for valid standalone modules.
+- Fixed nested-module dependency noise and false cycle detection.
+
+---
+
+## 0.0.4
+
+### Added
+
+- Added supported-stack detection for Express.js.
+- Added supported-stack detection for Laravel.
+- Added supported-stack detection for Ruby on Rails.
+- Added supported-stack detection for Kotlin.
+
+### Improved
+
+- Improved Spring and Spring Boot detection, including Kotlin Spring projects.
+- Improved Vue stack selection and feature discovery.
+- Improved Java and Spring module discovery for conventional package layouts.
+- Improved Smart Init stack detection across supported frameworks.
+- Added broader supported-stack documentation.
+
+### Notes
+
+- Supported-stack smoke coverage spans 25 fixtures.
+- Deterministic local validation remains local-first and CI-ready.
+- No cloud source-code scanning is required.
+
+---
+
+## 0.0.3
+
+### Added
+
+- Added Django Smart Init detection.
+- Added Flask Smart Init detection.
+
+### Improved
+
+- Improved Python framework-detection precedence.
+- Smart Init recognizes Django and Flask project signals.
+
+### Positioning
+
+- Updated package messaging around architecture guardrails for AI-native software development.

package/README.md

@@ -317,5 +317,6 @@ Proprietary. See LICENSE file for details.
 
 - Website: https://archpilot.org
 - Documentation: https://archpilot.org/docs
+- [Changelog](https://github.com/archpilotlabs/archpilot-vscode/blob/main/packages/cli/CHANGELOG.md)
 
 ---