@metasession.co/devaudit-cli 0.3.8 → 0.3.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.8",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.9",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/scripts/upload-evidence.sh

@@ -54,6 +54,14 @@
 #                         Issue from: Project Settings → API Keys in
 #                         META-COMPLY's web UI.
 #
+# Large-file uploads (>=25MB):
+#   Files above 25MB use a presigned R2 upload flow (3-step: request URL →
+#   PUT to R2 → notify portal) instead of multipart POST. This requires
+#   the Portal to be configured with R2 evidence storage
+#   (R2_EVIDENCE_BUCKET and related env vars). If R2 is not configured,
+#   the Portal returns a clear error which is surfaced to the operator.
+#   #298 — the Portal response body is included in the error output.
+#
 # Examples:
 #   ./scripts/upload-evidence.sh meta-ats REQ-001 screenshot \
 #       compliance/evidence/REQ-001/screenshots/
@@ -345,9 +353,9 @@ upload_presigned() {
       echo -n "(portal did not return presigned URL, falling back to multipart) "
       return 255
     fi
-    rm -f "$resp_body"
     if [ "$curl_exit" -ne 0 ] || [ "$http_code" = "429" ] || { [ "$http_code" -ge 500 ] && [ "$http_code" -lt 600 ]; }; then
       if [ "$attempt" -lt "$PRESIGNED_MAX_ATTEMPTS" ]; then
+        rm -f "$resp_body"
         echo -n "(step 1: HTTP ${http_code}, retry in ${backoff}s) "
         sleep "$backoff"
         attempt=$((attempt + 1))
@@ -355,8 +363,20 @@ upload_presigned() {
         continue
       fi
     fi
-    # Non-retriable error (4xx other than 429).
-    echo -n "(step 1 failed: HTTP ${http_code}) "
+    # Non-retriable error (4xx other than 429) or exhausted retries.
+    # #298 — Surface the Portal response body so operators see WHY it
+    # failed (e.g. "Presigned uploads require R2 storage configuration")
+    # instead of just "HTTP 501". Include up to 500 chars of the body.
+    local err_excerpt=""
+    if [ -s "$resp_body" ]; then
+      err_excerpt=$(head -c 500 "$resp_body")
+    fi
+    rm -f "$resp_body"
+    echo -n "(step 1 failed: HTTP ${http_code}"
+    if [ -n "$err_excerpt" ]; then
+      echo -n " — ${err_excerpt}"
+    fi
+    echo ") "
     return 1
   done
 

package/sdlc/files/_common/scripts/derive-release-version.test.sh

@@ -275,6 +275,54 @@ make_fixture "$WORK/c21" "chore(release): reconcile REQ-089 close-out
 Release-Closeout: REQ-089"
 assert_eq "close-out marker -> empty version" "" "$(run_helper)"
 
+# Case 22 (#571 Gap 3): close-out marker with no REQ digits — must NOT
+# suppress the bare-date fallback. The regex requires REQ-[0-9]{3,} so
+# a malformed marker like "Release-Closeout: REQ-AB" should fall through
+# to the bare date.
+make_fixture "$WORK/c22" "chore(release): reconcile close-out
+
+Release-Closeout: REQ-AB"
+assert_eq "malformed close-out marker -> bare date $TODAY" "$TODAY" "$(run_helper)"
+
+# Case 23 (#571 Gap 3): close-out marker with extra whitespace — must
+# still suppress (regex allows leading whitespace after the colon).
+make_fixture "$WORK/c23" "chore(release): reconcile REQ-100 close-out
+
+Release-Closeout:    REQ-100"
+assert_eq "close-out marker with extra whitespace -> empty" "" "$(run_helper)"
+
+# Case 24 (#571 Gap 3): no ticket file, no RTM, no git tags, no close-out
+# marker — the ultimate fallback chain reaches the bare date. This tests
+# that every prior step's `exit 0` guard correctly falls through when
+# its condition is not met.
+make_fixture "$WORK/c24" "chore: misc cleanup with no compliance state"
+assert_eq "no compliance state at all -> bare date $TODAY" "$TODAY" "$(run_helper)"
+
+# Case 25 (#571 Gap 3): pending-releases dir exists but is empty — step 4
+# must not crash and must fall through to step 4-bis / bare date.
+make_fixture "$WORK/c25" "chore: devaudit update to 0.1.30"
+mkdir -p compliance/pending-releases
+assert_eq "empty pending-releases dir -> bare date $TODAY" "$TODAY" "$(run_helper)"
+
+# Case 26 (#571 Gap 3): RTM.md exists but has no IN PROGRESS rows —
+# step 4-bis must fall through to the bare date.
+make_fixture "$WORK/c26" "chore: devaudit update to 0.1.30"
+mkdir -p compliance
+cat > compliance/RTM.md <<'RTM'
+| REQ-ID  | Status        |
+| ------- | ------------- |
+| REQ-001 | RELEASED      |
+| REQ-002 | DRAFT         |
+RTM
+assert_eq "RTM with no IN PROGRESS -> bare date $TODAY" "$TODAY" "$(run_helper)"
+
+# Case 27 (#571 Gap 3): RTM.md exists but is empty (no rows at all) —
+# step 4-bis must not crash and must fall through.
+make_fixture "$WORK/c27" "chore: devaudit update to 0.1.30"
+mkdir -p compliance
+echo "# Requirements Traceability Matrix" > compliance/RTM.md
+assert_eq "empty RTM.md -> bare date $TODAY" "$TODAY" "$(run_helper)"
+
 echo ""
 echo "=== Summary: $PASS pass / $FAIL fail ==="
 

package/sdlc/files/_common/scripts/extract-release-metadata.test.sh

@@ -273,6 +273,91 @@ assert_eq "RTM issue title fallback without ticket" "Issue title from RTM" "$REL
 assert_empty "Summary empty without ticket" "$RELEASE_SUMMARY"
 echo ""
 
+# --- Test 12 (#571 Gap 3): No ticket, no RTM, no gh CLI — all fallbacks empty ---
+echo "--- Test 12: All fallbacks unreachable ---"
+make_fixture "$WORK/test12"
+source "$HELPER"
+extract_release_metadata "REQ-999"
+assert_empty "Title empty when no ticket, no RTM, no gh" "$RELEASE_TITLE"
+assert_empty "Summary empty when no ticket" "$RELEASE_SUMMARY"
+echo ""
+
+# --- Test 13 (#571 Gap 3): Ticket exists but has no **Requirement:** line,
+# no H1, and no ## Summary — all extraction targets are unreachable ---
+echo "--- Test 13: Ticket with no extractable content ---"
+make_fixture "$WORK/test13"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-012.md" <<'TICKET'
+Some prose without any standard headings.
+
+Just a paragraph.
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-012"
+assert_empty "Title empty when no Requirement line or H1" "$RELEASE_TITLE"
+assert_empty "Summary empty when no ## Summary section" "$RELEASE_SUMMARY"
+echo ""
+
+# --- Test 14 (#571 Gap 3): RTM row exists but has no issue number,
+# so the gh CLI fallback is unreachable. Title should be empty. ---
+echo "--- Test 14: RTM row without issue number ---"
+make_fixture "$WORK/test14"
+cat > compliance/RTM.md <<'RTM'
+| REQ-ID  | Issue | Risk | Evidence | Status |
+| ------- | ----- | ---- | -------- | ------ |
+| REQ-013 |       | LOW  | n/a      | DRAFT  |
+RTM
+source "$HELPER"
+extract_release_metadata "REQ-013"
+assert_empty "Title empty when RTM row has no issue number" "$RELEASE_TITLE"
+echo ""
+
+# --- Test 15 (#571 Gap 3): gh CLI exists but issue lookup fails —
+# must fall through to H1 fallback, not error out ---
+echo "--- Test 15: gh CLI fails, falls through to H1 ---"
+make_fixture "$WORK/test15"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-014.md" <<'TICKET'
+# Fix critical payment bug
+
+## Summary
+Fixes the payment redirect issue.
+TICKET
+cat > compliance/RTM.md <<'RTM'
+| REQ-ID  | Issue | Risk | Evidence | Status |
+| ------- | ----- | ---- | -------- | ------ |
+| REQ-014 | #999  | LOW  | n/a      | DRAFT  |
+RTM
+mkdir -p bin
+cat > bin/gh <<'GH'
+#!/usr/bin/env bash
+# Simulate gh CLI failing (e.g. rate limited, issue not found)
+exit 1
+GH
+chmod +x bin/gh
+PATH="$PWD/bin:$PATH"
+source "$HELPER"
+extract_release_metadata "REQ-014"
+assert_eq "H1 fallback when gh CLI fails" "Fix critical payment bug" "$RELEASE_TITLE"
+echo ""
+
+# --- Test 16 (#571 Gap 3): Summary section exists but is only whitespace ---
+echo "--- Test 16: Whitespace-only summary is cleared ---"
+make_fixture "$WORK/test16"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-015.md" <<'TICKET'
+**Requirement:** REQ-015 — Feature fifteen
+
+## Summary
+
+## Changes
+- Change A
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-015"
+assert_eq "Title extracted" "Feature fifteen" "$RELEASE_TITLE"
+assert_empty "Whitespace-only summary cleared" "$RELEASE_SUMMARY"
+echo ""
+
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="
 exit $FAIL