@getripple/core 1.0.14-beta.0 → 1.0.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +69 -69
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,69 +1,69 @@
|
|
|
1
|
-
# @getripple/core Changelog
|
|
2
|
-
|
|
3
|
-
## [1.0.14] - 2026-07-21
|
|
4
|
-
|
|
5
|
-
### Fixed
|
|
6
|
-
- Detect changed symbols in files outside the approved boundary (`changedOutsideBoundarySymbols` previously only checked symbols inside already-allowed files, silently missing edits to unauthorized files entirely).
|
|
7
|
-
- Detect deletions of unapproved symbols during a staged/worktree check (previously invisible to the gate).
|
|
8
|
-
- Stamp and verify a tamper-evidence fingerprint on saved change intents, rejecting hand-edited `.ripple/intents/latest.json` files.
|
|
9
|
-
- Fix Windows quoting bug in cloud audit actor lookup (`git log --pretty=format:'%ae'` returned a literal-quoted string on cmd.exe).
|
|
10
|
-
- Fix risk evidence loss: contract-risk and file-risk evidence lines were deduplicated as plain strings, so two changed symbols/files sharing the same caller count, exported flag, or importer count would silently lose one entry's evidence.
|
|
11
|
-
- Recognize Python module-level assignments and decorator changes as tracked symbols (previously invisible to the staged-diff parser).
|
|
12
|
-
- Two-axis risk scoring: clean, boundary-respecting changes are capped at score 50 (LOW/MEDIUM); any real violation is floored at 51+ (HIGH/CRITICAL), so risk score now reliably discriminates authorized from unauthorized changes.
|
|
13
|
-
|
|
14
|
-
## [1.0.9] - 2026-06-13
|
|
15
|
-
|
|
16
|
-
### Changed
|
|
17
|
-
- Align core package documentation with Ripple's local authorization-gate positioning.
|
|
18
|
-
- Clarify the Trust Boundary Contract and Authorization Gate Contract while preserving the technical `GraphEngine` integration guidance.
|
|
19
|
-
- Update package metadata language for npm users building custom integrations.
|
|
20
|
-
|
|
21
|
-
## [1.0.8] - 2026-06-09
|
|
22
|
-
|
|
23
|
-
### Fixed
|
|
24
|
-
- Record `.ripple/history.json` events during cached `GraphEngine` scans so changed files still produce semantic history.
|
|
25
|
-
- Preserve architectural memory for changed symbols, imports, and calls through events such as `symbol_modified`, `symbol_created`, `symbol_deleted`, `import_added`, `import_removed`, `call_added`, and `call_removed`.
|
|
26
|
-
- Add regression coverage proving cached scans record history after a real file change.
|
|
27
|
-
|
|
28
|
-
### Validation
|
|
29
|
-
- Confirm real-repo graph and symbol discovery on a local clone of `sindresorhus/ky`, including high-impact files with broad importer counts.
|
|
30
|
-
|
|
31
|
-
## [1.0.7] - 2026-06-08
|
|
32
|
-
|
|
33
|
-
### Added
|
|
34
|
-
- Add structured risk summaries with level, score, summary, reasons, evidence, affected files/symbols, and required actions.
|
|
35
|
-
- Add graph-backed risk evidence from saved intents, boundary drift, blast radius, policy risk, public contracts, and verification targets.
|
|
36
|
-
- Add shared risk contracts used by CLI, MCP, and CI gate outputs.
|
|
37
|
-
|
|
38
|
-
### Changed
|
|
39
|
-
- Make gate evidence more explicit so downstream interfaces can explain why an agent may continue, must repair, or needs human review.
|
|
40
|
-
|
|
41
|
-
## [1.0.6] - 2026-06-07
|
|
42
|
-
|
|
43
|
-
### Fixed
|
|
44
|
-
- Report Git spawn failures with actionable messages when Node.js cannot launch `git`.
|
|
45
|
-
- Preserve the exact Git readiness failure in `ripple doctor` and readiness summaries.
|
|
46
|
-
|
|
47
|
-
## [1.0.5] - 2026-06-04
|
|
48
|
-
|
|
49
|
-
### Changed
|
|
50
|
-
- Refresh package README wording for npm users.
|
|
51
|
-
- Clarify that the core powers VS Code, CLI, and MCP, while most users should start with `@getripple/cli` or `@getripple/mcp`.
|
|
52
|
-
- Document JavaScript/TypeScript depth, basic Python support, and static-analysis limits more clearly.
|
|
53
|
-
|
|
54
|
-
## [1.0.4] - 2026-06-03
|
|
55
|
-
|
|
56
|
-
### Fixed
|
|
57
|
-
- Publishable package identity under `@getripple/core`.
|
|
58
|
-
- Release readiness checks for packed installs, package metadata, and shared engine entry points.
|
|
59
|
-
- Package-specific README and changelog included in the npm tarball.
|
|
60
|
-
|
|
61
|
-
## [1.0.3] - 2026-06-03
|
|
62
|
-
|
|
63
|
-
### Added
|
|
64
|
-
- Initial standalone package release of Ripple's core graph and workflow engine.
|
|
65
|
-
- `GraphEngine` APIs for scanning a local repo, planning context, focus summaries, blast radius, and recent history.
|
|
66
|
-
- Trust-boundary, policy, readiness, approval, audit, gate, and drift-repair summaries shared by CLI and MCP.
|
|
67
|
-
|
|
68
|
-
### Notes
|
|
69
|
-
- Public alpha. Prefer `@getripple/cli` for terminal use and `@getripple/mcp` for AI-agent integration.
|
|
1
|
+
# @getripple/core Changelog
|
|
2
|
+
|
|
3
|
+
## [1.0.14] - 2026-07-21
|
|
4
|
+
|
|
5
|
+
### Fixed
|
|
6
|
+
- Detect changed symbols in files outside the approved boundary (`changedOutsideBoundarySymbols` previously only checked symbols inside already-allowed files, silently missing edits to unauthorized files entirely).
|
|
7
|
+
- Detect deletions of unapproved symbols during a staged/worktree check (previously invisible to the gate).
|
|
8
|
+
- Stamp and verify a tamper-evidence fingerprint on saved change intents, rejecting hand-edited `.ripple/intents/latest.json` files.
|
|
9
|
+
- Fix Windows quoting bug in cloud audit actor lookup (`git log --pretty=format:'%ae'` returned a literal-quoted string on cmd.exe).
|
|
10
|
+
- Fix risk evidence loss: contract-risk and file-risk evidence lines were deduplicated as plain strings, so two changed symbols/files sharing the same caller count, exported flag, or importer count would silently lose one entry's evidence.
|
|
11
|
+
- Recognize Python module-level assignments and decorator changes as tracked symbols (previously invisible to the staged-diff parser).
|
|
12
|
+
- Two-axis risk scoring: clean, boundary-respecting changes are capped at score 50 (LOW/MEDIUM); any real violation is floored at 51+ (HIGH/CRITICAL), so risk score now reliably discriminates authorized from unauthorized changes.
|
|
13
|
+
|
|
14
|
+
## [1.0.9] - 2026-06-13
|
|
15
|
+
|
|
16
|
+
### Changed
|
|
17
|
+
- Align core package documentation with Ripple's local authorization-gate positioning.
|
|
18
|
+
- Clarify the Trust Boundary Contract and Authorization Gate Contract while preserving the technical `GraphEngine` integration guidance.
|
|
19
|
+
- Update package metadata language for npm users building custom integrations.
|
|
20
|
+
|
|
21
|
+
## [1.0.8] - 2026-06-09
|
|
22
|
+
|
|
23
|
+
### Fixed
|
|
24
|
+
- Record `.ripple/history.json` events during cached `GraphEngine` scans so changed files still produce semantic history.
|
|
25
|
+
- Preserve architectural memory for changed symbols, imports, and calls through events such as `symbol_modified`, `symbol_created`, `symbol_deleted`, `import_added`, `import_removed`, `call_added`, and `call_removed`.
|
|
26
|
+
- Add regression coverage proving cached scans record history after a real file change.
|
|
27
|
+
|
|
28
|
+
### Validation
|
|
29
|
+
- Confirm real-repo graph and symbol discovery on a local clone of `sindresorhus/ky`, including high-impact files with broad importer counts.
|
|
30
|
+
|
|
31
|
+
## [1.0.7] - 2026-06-08
|
|
32
|
+
|
|
33
|
+
### Added
|
|
34
|
+
- Add structured risk summaries with level, score, summary, reasons, evidence, affected files/symbols, and required actions.
|
|
35
|
+
- Add graph-backed risk evidence from saved intents, boundary drift, blast radius, policy risk, public contracts, and verification targets.
|
|
36
|
+
- Add shared risk contracts used by CLI, MCP, and CI gate outputs.
|
|
37
|
+
|
|
38
|
+
### Changed
|
|
39
|
+
- Make gate evidence more explicit so downstream interfaces can explain why an agent may continue, must repair, or needs human review.
|
|
40
|
+
|
|
41
|
+
## [1.0.6] - 2026-06-07
|
|
42
|
+
|
|
43
|
+
### Fixed
|
|
44
|
+
- Report Git spawn failures with actionable messages when Node.js cannot launch `git`.
|
|
45
|
+
- Preserve the exact Git readiness failure in `ripple doctor` and readiness summaries.
|
|
46
|
+
|
|
47
|
+
## [1.0.5] - 2026-06-04
|
|
48
|
+
|
|
49
|
+
### Changed
|
|
50
|
+
- Refresh package README wording for npm users.
|
|
51
|
+
- Clarify that the core powers VS Code, CLI, and MCP, while most users should start with `@getripple/cli` or `@getripple/mcp`.
|
|
52
|
+
- Document JavaScript/TypeScript depth, basic Python support, and static-analysis limits more clearly.
|
|
53
|
+
|
|
54
|
+
## [1.0.4] - 2026-06-03
|
|
55
|
+
|
|
56
|
+
### Fixed
|
|
57
|
+
- Publishable package identity under `@getripple/core`.
|
|
58
|
+
- Release readiness checks for packed installs, package metadata, and shared engine entry points.
|
|
59
|
+
- Package-specific README and changelog included in the npm tarball.
|
|
60
|
+
|
|
61
|
+
## [1.0.3] - 2026-06-03
|
|
62
|
+
|
|
63
|
+
### Added
|
|
64
|
+
- Initial standalone package release of Ripple's core graph and workflow engine.
|
|
65
|
+
- `GraphEngine` APIs for scanning a local repo, planning context, focus summaries, blast radius, and recent history.
|
|
66
|
+
- Trust-boundary, policy, readiness, approval, audit, gate, and drift-repair summaries shared by CLI and MCP.
|
|
67
|
+
|
|
68
|
+
### Notes
|
|
69
|
+
- Public alpha. Prefer `@getripple/cli` for terminal use and `@getripple/mcp` for AI-agent integration.
|
package/package.json
CHANGED