@carllee1983/dbcli 9.1.0 → 9.1.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "9.1.0",
+  "version": "9.1.2",
   "description": "Database CLI skill and command reference for AI agents.",
   "author": {
     "name": "Carl Lee",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "9.1.0",
+  "version": "9.1.2",
   "description": "Database CLI skill and command reference for AI agents",
   "author": {
     "name": "Carl Lee",

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "dbcli-agent",
   "displayName": "dbcli Agent",
   "description": "Database CLI skill and command reference for AI agents.",
-  "version": "9.1.0",
+  "version": "9.1.2",
   "author": {
     "name": "Carl Lee",
     "url": "https://github.com/CarlLee1983"

package/CHANGELOG.md

@@ -5,6 +5,100 @@ All notable changes to dbcli are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [9.1.2] - 2026-10-01
+
+一個開發依賴的安全公告、工作規格協定從 ForgeFlow 換成 Warrant，以及三個讓測試與建置
+不再依賴執行順序或在磁碟上留下東西的修正。
+
+版本為 **9.1.2**。沒有任何指令、旗標、engine 或輸出改變。npm 套件唯一的差別是不再
+附帶 `.agents/skills/story-development/SKILL.md`——那是 dbcli 自己開發流程用的
+skill，不是給使用者的。
+
+### Changed
+
+- **工作規格改用 Warrant，ForgeFlow 的機制整套移除。** Story 從一個裝著
+  `story.md`／`acceptance.md`／`task.md` 的目錄，變成一個只有 Goal、Out of Scope、
+  Acceptance Criteria 三節的 `specs/stories/<slug>.md`；核准由人 commit 或在當次
+  session 明確指派，完成由 `make verify` 證明。ForgeFlow 留下的每一個決定都是在維護
+  協定本身而不是 dbcli：adoption marker、範本、上游 contract job、`Story:` trailer
+  對帳與 handoff 結構要彼此一致，代價是 `make verify` 裡的一道門、CI 的第二次
+  checkout、三支 checker 加上它們的函式庫與測試。這些都刪掉而不是停用，連同
+  `story-development` skill——它隨 `.agents/` 一起打包，所以已安裝的套件裡會少掉
+  它。ForgePilot 仍是控制面，`DBCLI-*` 舊目錄原封保留為歷史紀錄。決定記在
+  ADR-0040，取代 ADR-0025、0027、0029、0031、0032 與 0036。
+
+- **`assets/ui-template.html` 改為建置產物，不再進版控。** 每次 `bun run build` 都會
+  重新產生並覆寫它，`prepublishOnly` 也在每次發佈前重建，所以 commit 裡那份從來不是
+  使用者拿到的那份，只會跟建置結果漂移——每跑一次 `make verify` 就把 worktree 弄髒。
+  現在它和 `dist/` 一樣列在 `.gitignore`，由 `build:determinism` 檢查兩次建置產出
+  相同位元組，而每個會渲染 HTML 的測試自己建置所需的東西，不再靠前面的測試檔先建好。
+  發佈出去的 template 仍由 `prepublishOnly` 建置，內容不變。決定記在 ADR-0041。
+
+### Fixed
+
+- **Skill Author Integration Kit 的測試不再依賴執行順序。** 它以套件名
+  （`@carllee1983/dbcli/core`）import，解析到的是未進版控的 `dist/core.mjs`；靜態
+  import 只在更早的測試檔已建好 `dist/` 時才載入得了，CI 先跑它就在載入模組時失敗。
+  改為在 `beforeAll` 建置後動態 import。
+
+- **測試套件不再在 OS 暫存目錄留下東西。** 一次完整測試會在 `TMPDIR` 留下約 130 個
+  目錄與檔案：每個測試都呼叫的 seed helper、`beforeAll`／`beforeEach` 建了卻沒有對應
+  刪除的目錄、只還原 `HOME` 的 `finally`，以及直接寫進 `tmpdir()` 的設定檔。每個會
+  外洩的檔案現在都以 repo 既有的寫法清掉自己建的東西；從空的 `TMPDIR` 開始跑，只剩
+  第三方的 node-jiti 快取。
+
+### Security
+
+- **`brace-expansion` 的 override 提高到 `^5.0.12`。** `bun run audit` 在
+  `brace-expansion@5.0.9` 回報三個漏洞（兩個 high、一個 moderate）：
+  GHSA-qhr7-859c-m2p7、GHSA-6j4f-fj2g-mc7p、GHSA-q2hr-2g5m-vwhr。它經由 eslint 與
+  typescript-eslint 的 minimatch 引入，只存在於開發依賴，不在發佈的套件裡；提高既有的
+  override 就全部清掉。
+
+## [9.1.1] - 2026-09-15
+
+一個使用者回報的查詢缺陷（#197），一條會把人導向無效權限階的拒絕訊息，以及兩個
+會對同一個 commit 給出兩種答案、或只會叫「東西變了」的測試門檻。
+
+版本為 **9.1.1**。沒有新增指令、旗標或 engine；沒有任何一處拒絕先前被接受的輸入。
+唯一改變輸出的是拒絕訊息裡的 `required:` 欄位與它的句子——那個值先前是錯的，照它
+去要權限會被再拒一次，所以修正它不是相容性變更，是讓它開始為真。
+
+### Fixed
+
+- **snippet 裡重複使用同一個具名參數，在 MySQL / MariaDB / SQLite 上不再炸。**
+  `rewriteToBind()` 對每一次 `:name` 出現輸出一個 placeholder，但 bind values 是由
+  去重後的名稱清單映射出來的。PostgreSQL 重用 `$1`，一個值對一個索引本來就對；`?`
+  沒有索引可以重用，所以 placeholder 數量跟著出現次數走、values 數量跟著相異名稱數
+  走，兩者在有重複參數時必然對不上，MariaDB 以 `ER_WRONG_ARGUMENTS` 拒絕整條
+  statement。
+
+  實務影響是「參數為 0 就查全部、否則查單一」這類條件在 snippet 裡寫不出來，只能
+  繞道 CTE 讓參數只出現一次。`--dry-run` 看得到 SQL 與 bind values 不匹配，但不會
+  報錯，所以問題要到真的執行才炸。非 PostgreSQL 引擎現在每一次出現送一個值，
+  PostgreSQL 的去重行為不變。（#197）
+
+- **拒絕訊息指向的權限階，現在是真的會通過的那一階。** 無法分類的語句（`REPLACE
+  INTO`、`PRAGMA`、`VACUUM`、`REINDEX` 等）在 `query-only` 下被拒時宣稱需要
+  `read-write`，但沒有任何一階授予未知語句，取得 read-write 之後會再被拒一次。訊息
+  與 `required:` 欄位現在都說 `admin`，en 與 zh-TW 同步。判決完全沒變：本來拒絕的仍
+  然拒絕，本來允許的仍然允許。（DBCLI-037）
+
+### Changed
+
+- **capability catalog 的輸出改由契約守住，不再由 sha256 守住。** 三份渲染
+  （JSON／text／Markdown）的凍結雜湊換成結構性斷言：文件在釘住的 schema 版本下
+  parse 得過、三份渲染列出同一組 capability、每個 capability 指的 command 是 CLI 真的
+  帶得動的。catalog 是從 engine 矩陣推導出來的（ADR-0022），所以每次矩陣變動都會
+  移動那三個雜湊，而修法永遠是把現在的值抄回去——連續三次之後，它報告的是 diff
+  本來就說了的事。決定與被否決的選項記在 ADR-0039。使用者可見的輸出沒有變。
+  （DBCLI-038）
+
+- **驗證 artifact 的秘密洩漏檢查改成逐欄檢查。** 原本在整份文件裡搜尋連線 port 的
+  四位數字，而 artifact 帶一個隨機後綴的 id，後綴湊出那四位數字時測試會紅——什麼都
+  沒洩漏，重跑就過。改為解析後逐欄走訪並指名帶著 port 的欄位；判準仍是包含而非
+  相等，藏在連線字串裡的 port 照樣抓得到。（DBCLI-039）
+
 ## [9.1.0] - 2026-09-11
 
 ForgeFlow Story DBCLI-014 到 DBCLI-036 在 `v9.0.0` 之後交付。其中只有最後三張

package/README.md

@@ -1722,28 +1722,20 @@ below: `package.json` and `src/` never mention them, `.forgepilot/` is
 gitignored local state, and a clone without any of them runs `make verify`
 normally.
 
-### How work is specified and reviewed: ForgeFlow
-
-Each unit of work is a Story under `specs/stories/`, made of a `story.md` (the
-intent boundary) and an `acceptance.md` (the criteria). That shape is not a
-local convention — it is upstream ForgeFlowV2's contract. The adopted version
-and revision are pinned in `specs/.forgeflow-adoption`, and the CI
-`forgeflow-contract` job clones **that exact revision** and runs upstream's own
-checkers against this repository (`bun run forgeflow:contract`, which needs
-`FORGEFLOW_ROOT`). The contract is executed by upstream's code rather than
-reimplemented here, because two implementations of one contract diverge on a
-schedule nobody controls (ADR-0027).
-
-A Story declaring itself security sensitive must enumerate its trust-boundary
-fields and a security fixture matrix, and **every cell must be an exact value**
-rather than prose. That rule catches more than wording: clearing the last of it
-turned up three fixture rows that asserted nothing at all, and one row
-describing a mechanism that does not exist.
-
-The exemption list in `scripts/lib/forgeflow-contract.ts` is a ratchet that may
-shrink and never grow. It is currently empty, so any finding at all fails the
-gate; adding an entry back requires lowering — never raising — the two counts
-beside it, which a test enforces.
+### How work is specified: Warrant
+
+Each unit of work is a Story: one file, `specs/stories/<slug>.md`, with exactly
+three sections — Goal, Out of Scope, and Acceptance Criteria. A Story is
+approved only when a human commits it to the default branch or explicitly
+assigns it in the current session; an agent never approves its own. The
+contract agents follow is the `## Warrant` section of `AGENTS.md`, and
+`specs/stories/README.md` describes the format. The `DBCLI-*` directories under
+`specs/stories/` are legacy records from an earlier protocol, not pending work.
+
+Warrant defines what a Story must contain and what counts as evidence: every
+acceptance criterion needs a reproducible observation, and the requirements,
+criteria, and scope stay as the human approved them. ForgePilot and
+`make verify` decide when it is done.
 
 ### When work is done: ForgePilot and `make verify`
 
@@ -1761,35 +1753,16 @@ no completion command — only a human can approve.
 
 A decision that is hard to reverse, surprising without context, or the result of
 a real trade-off gets a record in `docs/adr/`, named `ADR-<digits>-<slug>.md`
-with its status as a `* Status:` bullet rather than front matter. That shape
-exists so a Story's `Decision:` field resolves to it mechanically (ADR-0029).
-Open questions live there as `status: proposed`; undecided is a state that has
-to be storable.
+with its status as a `* Status:` bullet rather than front matter. A record that
+is replaced stays in `docs/adr/` with `* Status: superseded` and a
+`* Superseded by:` bullet naming its successor. Open questions live there as
+`status: proposed`; undecided is a state that has to be storable.
 
 Prefer closing a record with a falsification condition — one sentence saying
 when the decision would no longer hold — naming the files it depends on in
 backticks. Tooling reads the boundary list from those backticks, so the marker
 is load-bearing rather than decorative.
 
-### The principle behind all of it
-
-Every gate here is a variation on one lesson: **a declaration nothing compares
-to anything is not a control.** Delivery claims in the handoff are reconciled
-against commit trailers; the adopted ForgeFlow version is reconciled against
-every place that restates it; the ForgeFlow contract itself is run against a
-pinned upstream revision.
-
-The lesson has a limit, and finding it cost a decision. A Story's `## Authority`
-was briefly reconciled against the fact of its delivery, on the reasoning that
-reaching `main` requires commits on a pushed branch (ADR-0030). It does — but
-`completed_stories` records that a Story was delivered, not **who** performed
-each operation, and the normal flow here is an agent that is granted `modify` and
-a local `commit` handing its branch to a human who pushes and merges. The gate
-refused that flow by name, so the rule was removed (ADR-0031). Whether an
-Authority declaration is true is a question this repository cannot observe and
-Human Review can; a gate that guesses at it is worse than an unchecked
-declaration, because its verdict looks like evidence.
-
 ---
 
 ## License