@clear-capabilities/agentic-security-scanner 0.178.0 → 0.179.0

package/CHANGELOG.md

@@ -9,6 +9,17 @@
 > make the history less accurate, not more.
 
 
+## 0.179.0 - Faster releases: checks run at commit time, and the release gate stops repeating itself
+
+Release tooling only. No scanner behavior changed. The last full release took 68 minutes: push 15.5, hosted CI wait 14.5, local release gate 25, hosted release workflow 8, npm 4.5. Two changes cut the local share, and nothing the hosted gate proves was removed.
+
+- **Background gate warm-up.** `.githooks/post-commit` starts `scripts/gate-warm.mjs --start`: a detached, low-priority run of the same pre-push gate (`pre-push-gate.mjs --force`) for the commit just made, recording passes in the same signed verdict cache, so `git push` reuses them. `npm run gate:status` (exit 0 passed, 1 failed, 2 running, 3 nothing usable for HEAD) and `npm run gate:wait` show or await it. It is not a second gate: an amend, rebase, edit or different Node changes the cache key and the push runs the gate in full. It does not start in CI, during a rebase, merge, cherry-pick or bisect, or with `AGENTIC_SECURITY_NO_GATE_WARM=1`.
+- **Commit-time preparation.** `.githooks/pre-commit` runs `scripts/pre-commit-prepare.mjs`: it rebuilds `scanner/dist` and stages it when a build input is staged (the bundle embeds `package.json`), and regenerates the generated docs tables when a docs page is staged. A partial commit of build inputs is refused. `--no-verify` and `AGENTIC_SECURITY_NO_PRECOMMIT=1` skip it.
+- **`ship` uses both.** Before pushing it asks for the background verdict: a recorded failure stops it at once with the check names, a running warm-up is awaited, a pass lets the push reuse it.
+- **The local release gate no longer repeats what the pre-push gate proved.** When the released commit has the PR head's identical tree and the push output recorded `pre-push gate PASSED` for exactly that head, `verify` runs every check except the ten the pre-push gate already ran (`PROVEN_BY_PRE_PUSH` in `scripts/ship/lib.mjs`). The publish blockers (changelog entry, dependency currency, remote CI, version, scorecard), the full release closure and the time and memory gates still run locally. Otherwise the whole gate runs. The hosted release workflow still runs every check with the cache off and its publish job needs all of them.
+
+Measured effect is not yet known: this release is the first to use them. The expected saving is about 20 of the 25 local-gate minutes, plus the push wait when the warm-up has finished.
+
 ## 0.178.0 - Autonomous Security Assurance: documentation repositioning
 
 Documentation and documentation tooling only. No scanner behavior changed, no benchmark claim was added, and no capability was promoted to GA.

package/dist/{d175c127fee48e80d04c.json → 711e5445a9cfc412086b.json}

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.178.0",
+  "version": "0.179.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -130,7 +130,7 @@
     "verification:conformance:check": "node ../scripts/verification-conformance-check.mjs",
     "verification:conformance:static": "node ../scripts/verification-conformance-check.mjs --static",
     "verification:replay-example": "node ../scripts/verification-replay-example.mjs",
-    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/docs-positioning.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js",
+    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/gate-warm.test.js test/docs-positioning.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/premortem.test.js test/context-intelligence/git-diff-candidates.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
@@ -242,6 +242,10 @@
     "scorecard:check": "node ../scripts/scorecard-check.mjs",
     "release:check": "node ../scripts/release-check.mjs",
     "release:check:fast": "node ../scripts/release-check.mjs --fast",
+    "gate:warm": "node ../scripts/gate-warm.mjs --start",
+    "gate:status": "node ../scripts/gate-warm.mjs --status",
+    "gate:wait": "node ../scripts/gate-warm.mjs --wait",
+    "precommit:prepare": "node ../scripts/pre-commit-prepare.mjs",
     "gate:prepush": "node ../scripts/pre-push-gate.mjs",
     "gate:trace": "node ../scripts/gate-trace-reads.mjs",
     "gate:prepush:install": "node ../scripts/pre-push-gate.mjs --install-hook",