@kitschpatrol/chagent 0.2.0 → 0.3.0

package/dist/bin/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as version, S as maxTimeoutMinutes, b as defaultModels, i as generateChangelog, l as agentNames, n as previewChangelog, r as reviewChangelog, s as writeChangelog, t as assertReviewTerminal, u as efforts, x as defaults, y as setLogger } from "../review-BwgeC2dB.js";
-import { n as assertAmendable, t as amendRelease } from "../lib-DTp3sA-Q.js";
+import { C as version, S as maxTimeoutMinutes, b as defaultModels, i as generateChangelog, l as agentNames, n as previewChangelog, r as reviewChangelog, s as writeChangelog, t as assertReviewTerminal, u as efforts, x as defaults, y as setLogger } from "../review-ClBbl31P.js";
+import { n as assertAmendable, t as amendRelease } from "../lib-advgvAk1.js";
 import { t as createProgressLine } from "../progress-DQtRnH1N.js";
 import { createLogger } from "lognow";
 import path from "node:path";

package/dist/lib/bumpp.js

@@ -1,4 +1,4 @@
-import { g as git, i as generateChangelog, m as localDate, r as reviewChangelog, s as writeChangelog, t as assertReviewTerminal } from "../review-BwgeC2dB.js";
+import { g as git, i as generateChangelog, m as localDate, r as reviewChangelog, s as writeChangelog, t as assertReviewTerminal } from "../review-ClBbl31P.js";
 import { t as createProgressLine } from "../progress-DQtRnH1N.js";
 
 // src/lib/bumpp.ts

package/dist/lib/index.js

@@ -1,4 +1,4 @@
-import { a as defineConfig, c as createAgent, i as generateChangelog, n as previewChangelog, o as loadConfig, r as reviewChangelog, s as writeChangelog, y as setLogger } from "../review-BwgeC2dB.js";
-import { t as amendRelease } from "../lib-DTp3sA-Q.js";
+import { a as defineConfig, c as createAgent, i as generateChangelog, n as previewChangelog, o as loadConfig, r as reviewChangelog, s as writeChangelog, y as setLogger } from "../review-ClBbl31P.js";
+import { t as amendRelease } from "../lib-advgvAk1.js";
 
 export { amendRelease, createAgent, defineConfig, generateChangelog, loadConfig, previewChangelog, reviewChangelog, setLogger, writeChangelog };

package/dist/{lib-DTp3sA-Q.js → lib-advgvAk1.js}

@@ -1,4 +1,4 @@
-import { _ as isAncestor, d as LOCKFILE_PATH, f as inspectRepository, g as git, h as manifestAt, p as isVersionOnlyChange, s as writeChangelog, v as runCommand } from "./review-BwgeC2dB.js";
+import { _ as isAncestor, d as LOCKFILE_PATH, f as inspectRepository, g as git, h as manifestAt, p as isVersionOnlyChange, s as writeChangelog, v as runCommand } from "./review-ClBbl31P.js";
 import path from "node:path";
 import { realpath } from "node:fs/promises";
 

package/dist/{review-BwgeC2dB.js → review-ClBbl31P.js}

@@ -15,7 +15,7 @@ import { isCancel, select } from "@clack/prompts";
 
 // package.json
 var name = "@kitschpatrol/chagent";
-var version = "0.2.0";
+var version = "0.3.0";
 var engines = { "node": "^24.16.0 || >=26.3.0" };
 
 // src/lib/defaults.ts
@@ -229,8 +229,11 @@ async function readBlobs(root, objects) {
 }
 
 // src/lib/repository.ts
-/** Matches package manager lockfile paths. */
-const LOCKFILE_PATH = /(?:^|\/)(?:pnpm-lock\.yaml|package-lock\.json|yarn\.lock|bun\.lockb?)$/v;
+/**
+* Matches package manager lockfile paths. Excludes npm-shrinkwrap.json, which
+* is published and constrains consumers.
+*/
+const LOCKFILE_PATH = /(?:^|\/)(?:pnpm-lock\.yaml|package-lock\.json|yarn\.lock|bun\.lockb?|deno\.lock|uv\.lock|poetry\.lock|pdm\.lock|Pipfile\.lock|Cargo\.lock|Gemfile\.lock|composer\.lock|go\.sum)$/v;
 const TAG_DECORATION = "tag: refs/tags/";
 const GITHUB_REMOTE = /github\.com[:\/]([^\/]+\/[^\/]+?)(?:\.git)?$/v;
 const manifestSchema$1 = z.object({
@@ -628,7 +631,11 @@ runtime compatibility, installation and distribution, documentation and examples
 dependencies, builds, tests, CI, and release tooling. Include meaningful maintenance
 even when it is the only change in a release. Group routine runtime dependency
 updates into a useful entry, and group development dependency/tooling refreshes
-instead of listing every version. Identify important packages or migrations when
+instead of listing every version. A dependency change is a change to a declared
+requirement, such as a version range in a manifest, workspace catalog, or
+override. Lockfiles only record resolved versions: omit refreshed resolutions and
+transitive updates that appear only in a lockfile, even when the same commit
+changes other files. Identify important packages or migrations when
 the evidence supports them. Classify dependency and tooling changes by their
 actual impact: fixing runtime compatibility for consumers is Fixed, while fixing
 compatibility of contributor tooling alone is Maintenance. Documentation
@@ -703,8 +710,9 @@ Before returning, check coverage across behavior/API, compatibility, dependencie
 documentation, build/test/CI, and distribution. Do not drop a change just because
 its commit is called chore, docs, build, or dependency updates. Return an empty
 changes array only when the evidence is entirely release-version bookkeeping,
-generated artifacts, formatting noise, or changes already covered by existing
-entries. Do not pad the result with unsupported changes.`;
+lockfile-only resolution changes, generated artifacts, formatting noise, or
+changes already covered by existing entries. Do not pad the result with
+unsupported changes.`;
 /** Invalidates cached drafts whenever the instructions change. */
 const instructionVersion = hash(instructions);
 
@@ -1315,12 +1323,13 @@ const GENERATED_DIRECTORY = /^(?:build|changelog|coverage|dist)(?:\/|$)/iv;
 const GENERATED_ANYWHERE = /(?:^|\/)(?:changelog(?:\.md)?$|node_modules(?:\/|$))/iv;
 /**
 * Generated output lives at the top of a package, so `packages/build` and
-* `src/dist` remain source.
+* `src/dist` remain source. Lockfiles record resolved versions, not declared
+* dependency ranges.
 */
 function ignored(file, packages) {
 	const owner = packages.findLast(({ directory }) => file.startsWith(`${directory}/`));
 	const relative = owner === void 0 ? file : file.slice(owner.directory.length + 1);
-	return GENERATED_ANYWHERE.test(file) || GENERATED_DIRECTORY.test(relative);
+	return LOCKFILE_PATH.test(file) || GENERATED_ANYWHERE.test(file) || GENERATED_DIRECTORY.test(relative);
 }
 async function scopes(repository, pkg, ref) {
 	if (pkg.directory === ".") return ["."];
@@ -1349,11 +1358,7 @@ function manifestObjects(files, before, after) {
 	return files.flatMap((file) => isManifest(file) ? [`${before}:${file}`, `${after}:${file}`] : []);
 }
 function hasSourceChanges(files, commit, blobs) {
-	for (const file of files) {
-		if (LOCKFILE_PATH.test(file)) continue;
-		if (!isManifest(file) || !isVersionOnlyEdit(blobs.get(`${commit}^:${file}`), blobs.get(`${commit}:${file}`))) return true;
-	}
-	return files.length > 0 && files.every((file) => LOCKFILE_PATH.test(file));
+	return files.some((file) => !isManifest(file) || !isVersionOnlyEdit(blobs.get(`${commit}^:${file}`), blobs.get(`${commit}:${file}`)));
 }
 /** Read commits and their changed files from one process. */
 async function commitsInRange(root, range, paths) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitschpatrol/chagent",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Changelog agent. CLI tool and TypeScript library to generate and update changelogs with a little help from your LLMs.",
   "keywords": [
     "changelog",

package/readme.md

@@ -284,7 +284,7 @@ Chagent reads reachable version tags and commit history regardless of the projec
 
 GitHub enrichment uses release dates and commit-associated PR information. PR lookups batch unique commits across all requested releases and packages; each release receives only its associated PRs. **GitHub release-note bodies are never generation inputs.** Changelog files and generated build output are excluded from source evidence. Existing changelog prose is supplied only to preserve edits and avoid duplicate entries.
 
-The agent chooses which historical source files, public interfaces, documentation, and build configuration to inspect. It reads Git snapshots at the supplied release refs instead of treating current or uncommitted files as historical evidence. `maxInputChars` bounds the starting context supplied to agents; it does not restrict which repository files they can investigate. Requests prioritize release boundaries and existing human entries, then fit optional starting evidence into the remaining budget. An individual release's existing entries are never truncated. `timeout` sets the minutes each agent session may run. Lockfile maintenance retains its commit intent, while pure npm version-bump bookkeeping is excluded.
+The agent chooses which historical source files, public interfaces, documentation, and build configuration to inspect. It reads Git snapshots at the supplied release refs instead of treating current or uncommitted files as historical evidence. `maxInputChars` bounds the starting context supplied to agents; it does not restrict which repository files they can investigate. Requests prioritize release boundaries and existing human entries, then fit optional starting evidence into the remaining budget. An individual release's existing entries are never truncated. `timeout` sets the minutes each agent session may run. Dependency entries reflect declared version ranges; lockfile-only resolution changes and pure npm version-bump bookkeeping are excluded.
 
 Agents return structured changes with evidence references. Stray whitespace and list markers in descriptions are normalized. A response that still fails validation gets one correction request; a second failure stops the run before anything is written or cached. Application code owns the header, release boundaries, Markdown insertion, and Git writes. Agents run in the repository: Codex uses a read-only sandbox with approval requests disabled; Claude exposes read/search and Bash tools in [`dontAsk` mode](https://code.claude.com/docs/en/permissions), which allows read-only commands and denies actions requiring permission. Customizations are disabled for these invocations. Only chagent writes the reviewed changelog. Repository content is sent to the selected agent service using your existing account.