@devrouter/cli 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",
@@ -54,6 +54,8 @@
     "qualify:harness-journey": "./scripts/qualify-harness-journey.sh",
     "qualify:codex-journey": "DR_JOURNEY_HARNESS=codex ./scripts/qualify-harness-journey.sh",
     "qualify:non-node": "./scripts/qualify-non-node-consumer.sh",
+    "qualify:slow-dependency": "./scripts/qualify-slow-dependency-recovery.sh",
+    "qualify:killed-runtime": "./scripts/qualify-killed-runtime-recovery.sh",
     "test:process": "bash scripts/test-devrouter-process.sh",
     "check": "biome check .",
     "check:fix": "biome check --write .",

package/upgrade-prompts/0.1.1.md

@@ -0,0 +1,48 @@
+# Upgrade to devrouter 0.1.1
+
+This is a patch release on top of 0.1.0. It closes one way a managed environment
+could sit blocked without saying so: a start that admission refused on a fixed
+published host-port claim left the journal recording the intent as `running`
+while no runtime existed, so `devrouter status` reported a stable, drifting-free
+environment that could not progress.
+
+## What changed for a consumer
+
+- A managed `ensure` refused because a running container already holds a fixed
+  published host port now stays visible after the command exits. `devrouter
+  status` reports a `start-refused` attention reason with two recovery
+  commands: the read-only `devrouter doctor <repo>` check that names the
+  conflicting consumer binding and its holder, and the consumer-side fix
+  followed by `devrouter ensure <repo>`.
+- An explicit `devrouter stop <repo>` releases that intent and the reason, and a
+  later admitted ensure clears it. Nothing else about the refusal changed: the
+  start is still refused before any provider mutation, and live-worker,
+  unknown-ownership and surviving-resource checks still refuse fail-closed.
+- The release also carries `pnpm qualify:slow-dependency`, the developer
+  qualifier behind the Q06 dependency-recovery evidence. It is a repository
+  script and has no consumer-facing effect.
+
+## Task
+
+Use the published 0.1.1 CLI. Update the repository `devrouter.version` metadata
+only when consumer source changes are authorized, and refresh generated agent
+guidance only with its owner's authority. No schema, command, flag, environment
+or journal migration is needed, and the upgrade rewrites no runtime state.
+
+## Validation
+
+Verify the resolved executable and installed version, then run `devrouter
+doctor` for the checkout and confirm `global.cli-path` reports one
+authoritative install. Run `devrouter status` and confirm the reported intent,
+phase and attention reason agree with the runtime you observe. When the reported
+reason is `start-refused`, resolve the named binding as the owner of that
+port — the shared router is never the side to stop — and keep each lifecycle
+operation's own terminal evidence separate from a status block or progress line.
+
+## Report
+
+Report the release revision, the executable and installed version, the status
+block for any affected checkout, and the terminal result of any authorized
+lifecycle operation. Keep source and package validation separate from consumer
+readiness or recovery, and record unknown ownership or surviving resources as
+unresolved rather than as recovered.

package/upgrade-prompts/0.1.2.md

@@ -0,0 +1,57 @@
+# Upgrade to devrouter 0.1.2
+
+This is a patch release on top of 0.1.1. It carries the post-release reliability
+review corrections: truthful recovery guidance, a harness gate that honors its
+full wait budget and recognizes its own lifecycle commands in every supported
+invocation form, evidence-accurate hook wording, bounded cause-and-location
+diagnostics for unprovable capacity history, and a content-digest fence on
+capacity snapshot replacement.
+
+## What changed for a consumer
+
+- The recovery line a refused managed start prints now reads `devrouter doctor
+  --repo <checkout>` (single-quoted when the path needs it) instead of a
+  positional path that `doctor` never accepted. Stored guidance that quotes the
+  old form should be refreshed.
+- The harness gate (`devrouter harness gate`, wired as a PreToolUse hook) now
+  recognizes `devrouter` lifecycle commands as direct executables and through
+  the `npx`, `pnpm exec`, `npm exec` and `yarn` launchers, including
+  `env` and assignment prefixes. During a transition, `devrouter status`,
+  `stop` and `ensure` reach their own bounded checks instead of being deferred
+  or refused as unrelated calls. Unrelated calls still defer or refuse as
+  before.
+- A gated call under a budget now waits the whole budget: the gate observes once
+  more at the deadline instead of refusing early when the next poll interval
+  would overrun it.
+- Hook output no longer reports "environment settled" for passthrough,
+  unmanaged, invalid-payload or unavailable evidence; each decision says what it
+  actually observed.
+- `devrouter doctor` names the bounded cause and the exact journal entry when
+  capacity history is unprovable, and the network-capacity check names the
+  missing evidence inputs, so the operator can act without guessing.
+
+## Task
+
+Use the published 0.1.2 CLI. Refresh consumer-side guidance that quotes the old
+positional recovery command, and update the repository `devrouter.version`
+metadata only when consumer source changes are authorized. No schema, command,
+flag, environment or journal migration is needed, and the upgrade rewrites no
+runtime state.
+
+## Validation
+
+Verify the resolved executable and installed version with `devrouter -V`, then
+run `devrouter doctor --repo <checkout>` and confirm `global.cli-path`
+reports one authoritative install. For an environment whose harness hook uses
+`devrouter harness gate`, run one gated lifecycle command during a transition
+and confirm it reaches its own check. When `doctor` reports unprovable capacity
+history, follow the named cause-keyed recovery instead of deleting journal
+state.
+
+## Report
+
+Report the release revision, the executable and installed version, the doctor
+block for any affected checkout, and the terminal result of any authorized
+lifecycle operation. Keep source and package validation separate from consumer
+readiness or recovery, and record unknown ownership or surviving resources as
+unresolved rather than as recovered.