@chrok/braid 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 0.2.1 — 2026-10-04
+
+### Maintenance
+
+- Upgrade the Pi validation target to 1.0.1 and refresh the workspace lockfile
+  so Pi's minimatch resolves the patched brace-expansion 5.0.12. Add a separate
+  dependency-security check covering development dependencies and reporting
+  scanner failures explicitly
+  ([#38](https://github.com/Epsirom/braid/pull/38)) — @Epsirom.
+
+No Braid API or runtime behavior changes. Pi 1.0.1 is the tested host version;
+updating Braid does not upgrade a separately installed Pi host.
+
+### New Contributors
+
+No first-time human contributors in this release.
+
+[Full comparison](https://github.com/Epsirom/braid/compare/v0.2.0...v0.2.1).
+
 ## 0.2.0 — 2026-10-02
 
 ### Features and breaking changes

package/CONTRIBUTING.md

@@ -34,6 +34,15 @@ checkout. That last check needs registry access for Pi dependencies but never
 calls a model. `npm test` is the fast core-only loop; `npm run test:pi` tests Pi.
 `npm run bench` measures the scheduler without a provider.
 
+Run `npm run audit:dependencies` after `npm ci` to scan the complete dependency
+tree, including development dependencies. The separate Dependency security
+workflow runs this on pull requests, pushes to main, and weekly. The command
+exits 1 for vulnerabilities and 2 for scanner failures or incomplete reports;
+both fail the workflow, with details in its log and a separate result summary.
+This registry-backed check is separate from `verify` so deterministic tests do
+not depend on audit service availability. See [dependency security](SECURITY.md#dependency-security)
+for the known Pi shrinkwrap issue and the required upgrade verification.
+
 ## Changes and reviews
 
 Submit changes to `main` through a pull request, including maintainer changes.

package/README.md

@@ -102,7 +102,7 @@ before running a custom adapter against a repository.
 
 ## Install in Pi
 
-With Pi 0.87.1 and Node.js 22.19+:
+With Pi 1.0.1 and Node.js 22.19+:
 
 ```sh
 pi install npm:@chrok/pi-braid
@@ -110,7 +110,7 @@ pi install npm:@chrok/pi-braid
 
 Run `/reload`, ask Pi to analyze a task with Braid, and open `/braid` to inspect
 the job. npm installs the exact matching core dependency; no checkout is needed
-for published versions. To try 0.2 before publication, follow the
+for published versions. To try the current source checkout, follow the
 [local Pi installation guide](integrations/pi/README.md#install-this-local-checkout-in-pi).
 
 ![Braid Pi flow panel with an offline example](docs/assets/pi-panel.svg)

package/SECURITY.md

@@ -13,6 +13,32 @@ advisory where appropriate. There is no response-time guarantee or bounty progra
 Only the latest released 0.x minor series receives fixes; older series should
 upgrade. Before the first release, report issues against the current main branch.
 
+## Dependency security
+
+Audit the development tree as well as runtime dependencies with
+`npm ci` followed by `npm run audit:dependencies`. Scanner errors are incomplete
+results and fail the check; they must not be treated as zero vulnerabilities.
+
+The Pi development dependencies are pinned together to 1.0.1. Its
+[published npm tarball](https://registry.npmjs.org/@earendil-works/pi-coding-agent/-/pi-coding-agent-1.0.1.tgz)
+removes `npm-shrinkwrap.json` and directly pins `brace-expansion` 5.0.12, fixing
+[GHSA-q2hr-2g5m-vwhr](https://github.com/advisories/GHSA-q2hr-2g5m-vwhr) and related
+advisories tracked in [issue #37](https://github.com/Epsirom/braid/issues/37).
+The regenerated Braid lockfile resolves Pi's `minimatch 10.2.6` to
+`brace-expansion 5.0.12` after a clean `npm ci`, verified on 2026-10-03.
+
+An upstream release does not update an existing Braid lockfile or installation.
+When upgrading Pi, inspect the published package (including any shrinkwrap),
+update the Pi development dependencies together, regenerate the root lockfile,
+and inspect `npm ls brace-expansion --all` after a clean `npm ci`. Confirm the
+version resolved by Pi's installed minimatch, run `npm run verify`, and review
+`npm run audit:dependencies` before declaring a dependency issue fixed.
+
+These Braid lockfile entries are development dependencies. This does not
+establish exposure in a separately installed Pi host; inspect that host's actual
+dependency tree independently. A production-only audit of this repository cannot
+answer that question.
+
 ## Trust boundaries
 
 - Braid isolates invocation context; it is not a process or filesystem sandbox.

package/docs/compatibility.md

@@ -3,7 +3,7 @@
 | Surface | Supported / tested contract |
 | --- | --- |
 | Core runtime | Node.js 22+, ESM imports, TypeScript declarations, no runtime dependencies |
-| Pi package | Node.js 22.19+, Pi 0.87.1 is the pinned validation target |
+| Pi package | Node.js 22.19+, Pi 1.0.1 is the pinned validation target |
 | CI | Core minimum Node 22.0; both packages on Node 22.19 and 24 on Linux, macOS, Windows |
 | OpenAI-compatible runner | Chat Completions text and function-tool calls; decisions and merge/integrate nodes require tool calling |
 | Browsers / CommonJS | No supported browser build or CommonJS entry point in 0.2 |
@@ -14,7 +14,7 @@ that every provider advertising OpenAI compatibility supports its tool schema.
 Run a small opt-in live test with your chosen provider before relying on it.
 
 Pi's upstream packaging guide requires `*` peer dependencies for packages the
-host provides. Braid follows that convention and pins dev dependencies to 0.87.1.
+host provides. Braid follows that convention and pins dev dependencies to 1.0.1.
 The wildcard is a loader/distribution convention, **not a claim that every Pi
 version works**. Test the whole Pi suite before updating the supported target.
 The offline host compatibility test loads the extension into a real Pi session
@@ -23,7 +23,7 @@ exactly one automatic continuation per node/job reminder delivered during
 `agent_settled`, including retrieval of a node output while its job still runs.
 This covers the Pi 0.86/0.87 transcript and settling changes without provider
 credentials or network model calls. Version 0.1.0 was originally validated with
-Pi 0.85.1; the current checkout's pinned validation target is 0.87.1.
+Pi 0.85.1; the current checkout's pinned validation target is 1.0.1.
 The Pi npm package declares an exact dependency on the matching `@chrok/braid`
 release. npm installs the core automatically; Pi does not bundle another copy of
 its runtime and does not need a source checkout.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrok/braid",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "license": "MIT",
   "description": "TypeScript runtime for LLM agent graphs with bounded loops, live updates, and isolated Git worktrees",
   "type": "module",
@@ -33,6 +33,7 @@
     "build": "node scripts/build.mjs",
     "check": "tsc --noEmit",
     "test": "tsx --test test/*.test.ts test/*.test.mjs",
+    "audit:dependencies": "node scripts/audit-dependencies.mjs",
     "demo": "tsx examples/basic.ts",
     "check:pi": "npm run build && npm run check --workspace @chrok/pi-braid",
     "test:pi": "npm run build && npm test --workspace @chrok/pi-braid",