@geonosis/review 2.3.1 → 2.4.3

package/CHANGELOG.md

@@ -0,0 +1,110 @@
+# @geonosis/review
+
+## 2.4.3
+
+## 2.4.2
+
+## 2.4.1
+
+## 2.4.0
+
+## 2.3.1
+
+## 2.3.0
+
+### Patch Changes
+
+- 3dac9a7: **One documented spelling (#90).** Every README of a package the metapackage fronts now names
+  `geonosis <tool>` — the door that pins the whole toolchain at one version — beside the bare bin, and
+  a `tooling/` test holds it. `#230`'s stamp test lands with it: every flag `docs/orchestration.md`'s
+  adoption loop names has to carry the version it first ships in, because the loop once told a
+  consumer to run a flag the published version did not have.
+
+## 2.2.0
+
+## 2.1.0
+
+## 2.0.0
+
+## 1.4.0
+
+## 1.3.0
+
+### Minor Changes
+
+- 2d1d841: **`geonosis-review --help` answered "unknown option --help" at exit 2 (#66).** The README was the
+  only usage there was. `--help`/`-h` now print it at exit 0, and the unknown-option refusal points at
+  the flag that produces it.
+  
+  **It also answers `--print-config-shape` (#75)**, assembled from the same `KNOWN` set the reader refuses against, so the shape cannot drift from the check.
+
+## 1.2.0
+
+## 1.1.0
+
+## 1.0.1
+
+### Patch Changes
+
+- 1c2ee0b: **Every package ships its declarations and says where they are.** `@geonosis/visual-diff` and
+  `@geonosis/verify` emitted no `.d.ts` at all (TS7016 in a consumer: the comparator every visual test
+  calls became `any` at the one seam that decides whether a screenshot regressed), and no package
+  declared `types` — the nineteen that worked did so through the sibling-file fallback, which ends the
+  day `exports` gains a condition. Every export now carries a `types` condition beside `default`, every
+  manifest a `types` field, and `tooling/types.test.ts` holds all twenty-one to it after the build.
+  
+  `geonosis-verify-arch` prints a check once when its label is its id ("direction, orphan", not
+  "direction direction").
+
+## 1.0.0
+
+### Major Changes
+
+- b1157fc: `@geonosis/review`: the decision-only reviewer contract from Medusa's `reviewing-prs`, as a schema
+  and a deterministic applier. One `review-decision.json` (Zod, strict — an unknown key is refused,
+  never dropped); `apply` records it and does nothing else; `check --criteria <plan.md>` refuses a
+  decision that never looked at an EARS criterion the plan states. Two of Medusa's "Common Mistakes"
+  are mechanical here: an approval carrying a blocker, and a request-changes naming nothing to change.
+  It imports nothing of the kit — including the ledger, because a reviewer that can reach the ledger
+  is one call away from writing the tick it just judged. `review.runner` is `peer-session` or
+  `agent:<model>` (C13) and nothing in the package acts on it.
+- f60a869: **The six defects the 1.0.0 reviews filed, before the release: two of them about being installable
+  at all, three about refusing honestly, one about counting a finding twice.**
+  
+  `geonosis-review` read its command line OUTSIDE `main`'s try, so `--definitely-not-a-flag` reached
+  node uncaught: a stack trace and exit **1** — the one code the contract reserves for "the review was
+  read and REFUSED", so a caller branching on the code read a typo as a rejection. Parsing happens
+  inside now, every command-line mistake is 2 on one line, and the README's exit codes are a table
+  that says which is which (#50).
+  
+  `@geonosis/testbed`'s `bin` named `dist/cli.js`, the only bin in the kit that pointed at a build
+  output. `pnpm install` links bins BEFORE anything is built, so a fresh clone printed
+  `Failed to create bin … ENOENT` and had no `geonosis-testbed` — including the copy `@geonosis/cli`
+  spawns for its `testbed` door. It has a committed `bin/geonosis-testbed.mjs` shim like every other
+  package, and `tooling/bins.test.ts` holds every `bin` entry to a file git carries (#51).
+  
+  Two shims — `create-geonosis` and `geonosis-mcp` — were **committed at mode 644**. pnpm sets the
+  executable bit on the link it creates, so the mode was right everywhere except where it is kept, and
+  the flip only ever surfaced as an unrelated diff in somebody else's commit. Both are 755, and the
+  test reads the mode **git records**, which is the mode a clone gets (#52). Measured on this base:
+  `doctor` and `verify-arch`, the two the review named, were already executable.
+  
+  `geonosis-testbed matrix` crashed on a malformed `testbed.matrix`: a block spelling `majors` as
+  `postgres` reached the renderer, which read `.length` off `undefined` — a TypeError at exit 1 for a
+  config error one line long. `readDbMatrix` checks the block first and refuses with **2**, naming
+  every wrong key at once (a missing one and an unknown one are two findings, and being told one at a
+  time means editing the file twice). Hand-rolled, not Zod: this package has no runtime dependencies
+  and a test that keeps it that way (#45).
+  
+  `no-mock-db-in-integration` reported an imported handle **twice at one position**: an
+  ImportSpecifier's `imported` and its `local` are two nodes over the same span when nothing is
+  renamed. One report per place now — the corpus carries the fixture that shows it, and a finding
+  counted twice is a finding a ratchet counter banks twice (#46).
+  
+  `geonosis-ledger sync --write` refused a config that did not already carry the fragment
+  (`"boundaries": no such key`), so the command whose job is to write the config could not write the
+  first one and hand-authoring the generated shape was the way in. It creates the key now — in a
+  `turbo.json` with no `boundaries`, in a config that has never named `layer-walls`, in a package with
+  no `no-restricted-imports`, and the `rules` object itself if that is missing too — and still writes
+  only that fragment. A rule is grown as `["error", { … }]`, the severity being the one thing no
+  generator can read off the table (#34).

package/bin/geonosis-review.mjs

@@ -17,11 +17,25 @@ const newest = (dir) =>
       }, 0)
     : 0
 const src = join(here, '..', 'src')
-if (existsSync(src) && newest(src) > newest(join(here, '..', 'dist'))) {
-  process.stderr.write(
-    'geonosis-review: dist is older than src — run pnpm build before trusting this bin.\n',
-  )
-  process.exit(2)
+const dist = join(here, '..', 'dist')
+// `newest` answers 0 for a directory that is NOT THERE and for one that is merely old, so the
+// two conditions were one comparison and one sentence — and the staleness sentence was printed
+// over trees that had never been built at all, blocking a turn in a fresh git worktree, which
+// has no dist because dist is not committed (#357). Only the second is evidence of a mistake.
+if (existsSync(src)) {
+  const built = newest(dist)
+  if (built === 0) {
+    process.stderr.write(
+      'geonosis-review: this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.\n',
+    )
+    process.exit(2)
+  }
+  if (newest(src) > built) {
+    process.stderr.write(
+      'geonosis-review: dist is older than src — run pnpm build before trusting this bin.\n',
+    )
+    process.exit(2)
+  }
 }
 
 await import('../dist/review-cli.js')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/review",
-  "version": "2.3.1",
+  "version": "2.4.3",
   "types": "./dist/index.d.ts",
   "description": "The decision-only reviewer contract: a review's sole output is one JSON decision, validated and applied by a step that comments nowhere, approves nothing and cannot reach a forge.",
   "keywords": [
@@ -31,6 +31,7 @@
     }
   },
   "files": [
+    "CHANGELOG.md",
     "bin",
     "dist"
   ],