@diffci.com/diffci 0.1.3 → 0.1.4

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/@diffci.com/diffci.svg)](https://www.npmjs.com/package/@diffci.com/diffci)
 [![npm provenance](https://img.shields.io/badge/npm-provenance-blue)](https://docs.npmjs.com/generating-provenance-statements)
-[![GitHub Action](https://img.shields.io/badge/action-DiffCI%2FDiffCI.com%40v1-blue)](https://github.com/DiffCI/DiffCI.com)
+[![GitHub Action](https://img.shields.io/badge/action-DiffCI%2FDiffCI.com%40v0.1.4-blue)](https://github.com/DiffCI/DiffCI.com)
 
 DiffCI is a deterministic, change-aware CI planner: given a commit or PR, it builds a real TypeScript
 dependency graph, computes what's actually reachable from the changed files, and proposes which CI
@@ -20,7 +20,7 @@ npx @diffci.com/diffci@latest verify-workflow
 Or install it as a non-blocking GitHub Action:
 
 ```yaml
-- uses: DiffCI/DiffCI.com@v1
+- uses: DiffCI/DiffCI.com@v0.1.4
 ```
 
 The promise is deliberately narrow: DiffCI observes your CI and reports what it would have selected.
@@ -136,7 +136,7 @@ npm run research:sandbox:deploy
 DiffCI is intended to be installable as infrastructure, not only as a hosted shadow experiment:
 
 ```yaml
-- uses: DiffCI/DiffCI.com@v1
+- uses: DiffCI/DiffCI.com@v0.1.4
 ```
 
 ```bash

package/dist-client/src/client/workflow-guard.js

@@ -101,6 +101,10 @@ function commandText(run) {
     return run
         .split("\n")
         .map((line) => line.replace(/(^|\s)#.*$/, "$1").replace(/[a-z][a-z0-9+.-]*:\/\/\S+/gi, " "))
+        // A literal npm registry tag removal neither installs nor invokes the observer. Match the
+        // entire line, with only a literal `|| true` allowed, so appended observer commands and shell
+        // substitutions still take the conservative inspection path. Other script lines remain intact.
+        .filter((line) => !/^\s*npm(?:\.cmd)?\s+dist-tag\s+(?:rm|remove)\s+@?[\w./-]+\s+[\w.-]+(?:\s*\|\|\s*true)?\s*$/.test(line))
         .join("\n");
 }
 /**

package/dist-client/src/repo/graph.js

@@ -551,7 +551,13 @@ export async function buildDependencyGraph(options = {}) {
     const entryPointPaths = new Set(profile.entryPoints.map((e) => e.path));
     const vueSources = contributions.some((item) => item.id === "vue")
         ? files.filter((file) => /\.[cm]?[jt]sx?$/.test(file)).map((file) => join(repoPath, file)) : [];
-    let { program, options: compilerOptions, resolvedViaProjectReferences } = createProgram(repoPath, profile.sourceRoots, vueSources);
+    // Compiler include/exclude controls typechecking, not the runner's test universe. Parse every
+    // discovered JS/TS test so source changes can reach tests outside the compiler's root files.
+    // Adding those tests only as leaf nodes silently loses their dependency edges (ky, 2026-09-19).
+    const testSources = profile.testFilePaths
+        .filter((file) => /\.[cm]?[jt]sx?$/.test(file))
+        .map((file) => join(repoPath, file));
+    let { program, options: compilerOptions, resolvedViaProjectReferences } = createProgram(repoPath, profile.sourceRoots, [...vueSources, ...testSources]);
     let moduleResolutionCache = ts.createModuleResolutionCache(repoPath, (x) => x, compilerOptions);
     const sourceFiles = program
         .getSourceFiles()
@@ -690,21 +696,8 @@ export async function buildDependencyGraph(options = {}) {
         adapterBlockers.push("Unresolved Vue dependencies require full validation");
     }
     profile.adapterBlockers = [...adapterBlockers];
-    // Nested-package test visibility (2026-08-24, biomejs/biome finding): `internalSourcePaths` above is
-    // strictly the TS PROGRAM's own file list (createProgram()'s `include`/nested-tsconfig-merged
-    // fileNames) - so a package whose own tsconfig deliberately excludes its test directory (a real,
-    // common pattern; confirmed verbatim on biome: `packages/@biomejs/js-api/tsconfig.json` has
-    // `"exclude": ["./tests", "./dist"], "include": ["./src"]`) NEVER contributes those files to the
-    // program, so they never became graph nodes and `totalTestsInGraph` stayed 0 even though
-    // `profile.testFilePaths` (the separate, tsconfig-agnostic glob walk in analyzer.ts's discoverTests())
-    // already found them correctly. Source-ROOT discovery itself was already correct (the 2026-08-21
-    // zod/trpc fallback already lists `packages`/`crates` as roots for exactly this monorepo shape) - the
-    // gap was narrower: the graph never incorporated what that walk found. Fix: union in any test file
-    // discoverTests() found that the TS program's own file list missed, as an ADDITIONAL leaf node
-    // (isTest true; no import edges - we have no real resolution info for a file the type-checker was
-    // never asked to see, so dependency-graph traversal through it is honestly absent, not guessed at).
-    // This does NOT add Rust visibility of any kind - testFilePaths only ever contains files already
-    // matched by the JS/TS test-file patterns; a `.rs` test is never in it and stays "unknown" as before.
+    // Keep adapter-provided test identities visible as well. JS/TS tests are parsed above; their
+    // imports must not be replaced by disconnected leaf nodes merely because tsconfig excludes them.
     for (const testPath of profile.testFilePaths) {
         if (!internalSourcePaths.has(testPath) && !assetPaths.has(testPath))
             internalSourcePaths.add(testPath);

package/docs/distribution.md

@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: DiffCI/DiffCI.com@v1
+      - uses: DiffCI/DiffCI.com@v0.1.4
 ```
 
 For the strongest supply-chain posture, pin the Action to a full commit SHA. `npx @diffci.com/diffci@latest verify-workflow`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diffci.com/diffci",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "DiffCI - deterministic change-aware CI planning",
   "license": "AGPL-3.0-only",
   "repository": {