@jelou/cli 1.76.0 → 1.77.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jelou/cli",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "description": "Build AI agents on the Jelou platform — from your terminal or your AI editor.",
   "author": "Jelou Inc. (https://jelou.ai)",
   "license": "SEE LICENSE IN LICENSE",
@@ -23,11 +23,11 @@
     "THIRD_PARTY_NOTICES.md"
   ],
   "optionalDependencies": {
-    "@jelou/cli-darwin-arm64": "1.76.0",
-    "@jelou/cli-darwin-x64": "1.76.0",
-    "@jelou/cli-linux-x64": "1.76.0",
-    "@jelou/cli-linux-arm64": "1.76.0",
-    "@jelou/cli-win32-x64": "1.76.0"
+    "@jelou/cli-darwin-arm64": "1.77.0",
+    "@jelou/cli-darwin-x64": "1.77.0",
+    "@jelou/cli-linux-x64": "1.77.0",
+    "@jelou/cli-linux-arm64": "1.77.0",
+    "@jelou/cli-win32-x64": "1.77.0"
   },
   "keywords": [
     "jelou",
@@ -58,41 +58,33 @@
   "jelou": {
     "minVersion": "1.73.0",
     "release_notes": {
-      "version": "1.76.0",
+      "version": "1.77.0",
       "date": "2026-07-28",
-      "headline": "Workflow audits separate scanner facts from model judgment, and 64% of false findings are gone.",
+      "headline": "The workflow audit skill now reads and judges your bot itself, and hands back work items you can assign — grouped by security, integrity, UX, cost and maintainability.",
       "highlights": [
         {
-          "type": "new",
-          "text": "`--review-packet` / `--review <file>` — the audit writes a facts-only digest of a workflow for an agent to read, then merges its verdicts back into the report. Model verdicts are reported and scored but never change the exit code."
+          "type": "improved",
+          "text": "The audit skill reads every workflow and the routing between them instead of running a fixed rule list. On a real bank project those rules produced 130 false findings out of 203 by demanding an error branch the platform does not emit, and missed a live API key, a dead confirmation screen, and a validation that let `-100` through as `100`."
         },
         {
-          "type": "new",
-          "text": "A 9-dimension score for the bot. A dimension nothing assessed reports `—` instead of full marks, so a scan-only run says \"28/100 over 60 assessed points\" rather than claiming a clean bill of health."
+          "type": "improved",
+          "text": "Findings arrive as work items with a referenceable id — `S1` security, `I1` integrity, `U1` UX, `C1` cost, `M1` maintainability — numbered by severity, so `S1` is your project's worst security problem."
         },
         {
-          "type": "new",
-          "text": "The audit reads the channel — it flags WhatsApp-only nodes wired on another channel, message types the channel cannot render, and channels with no runtime support. If the snapshot names no channel, it stays quiet rather than guessing."
+          "type": "improved",
+          "text": "Every item shows the exact text from your workflow and the replacement text you can paste, not a description of what to change. Credentials are quoted by field with the value redacted."
         },
         {
-          "type": "new",
-          "text": "Two new security checks: injection through a database query, and a hardcoded encryption key in a `CODE` node. On a real bot an AES master key was invisible to every previous rule."
+          "type": "improved",
+          "text": "Cost items come with the arithmetic: characters counted from your prompt, the model price from `jelou models show`, and conversation volume from `jelou logs conversations list`, with every assumption stated so you can redo the math with your own numbers."
         },
         {
-          "type": "fixed",
-          "text": "The audit stopped demanding an error branch named `error` when the platform emits `failed`. On a real 14-workflow bot that alone was **130 of 203 findings — 64% noise**. An AI step that merely set a language also stopped being told to split its instructions into separate pillars (22 more false findings)."
-        },
-        {
-          "type": "fixed",
-          "text": "The review packet no longer carries credentials. Tokens, URLs with passwords and raw prompt text were handed to the model verbatim while the report redacted the same values."
-        },
-        {
-          "type": "fixed",
-          "text": "A workflow id taken from a snapshot can no longer write outside `--out-dir`, and a model's verdict can no longer flip the exit code."
+          "type": "improved",
+          "text": "The audit reports what it actually opened — workflows, nodes, and what it could not assess. A dimension it did not check scores `—`, never full marks."
         },
         {
           "type": "heads_up",
-          "text": "Four keyword rules are gone — AI disclosure, unscoped AI, restricted content and PII consent. Each fired on good copy that happened to contain a listed word and went silent on the same defect rephrased. All four were advisory and never gated CI; the questions they asked are review lens questions now."
+          "text": "The audit no longer returns an exit code and cannot gate a pipeline. It produces a judgment, not a build status. If you were shelling out to the skill's `bin/workflow-audit`, that binary is gone; run the audit through your agent and read `.jelou/audit/report.md` instead."
         }
       ]
     }