@theokit/sdk-tools 0.27.4 → 0.27.6

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## 0.27.6
+
+### Patch Changes
+
+- [#724](https://github.com/usetheokit/theokit-sdk/pull/724) [`d58f5ef`](https://github.com/usetheokit/theokit-sdk/commit/d58f5efbc911ffa429082688a53b36fad659e305) Thanks [@usetheodev](https://github.com/usetheodev)! - The optional `simple-git` peer range moves from `^3.0.0` to `^4.0.1`. Every 3.x release up to
+  3.36.0 is covered by published advisories (GHSA-x6jw-m9v5-85vh, GHSA-g4wm-2vf7-vfgr,
+  GHSA-858h-whjf-mvg5): Git configuration includes and abbreviated long options can lead to command
+  execution. 4.0.1 is the first release that fixes all of them.
+  
+  No tool in this package imports `simple-git`. `createGitDiffTool` and `createGitStatusTool` run
+  `git` as a child process, so their behaviour does not change. A project that still has
+  `simple-git` 3.x installed gets an unmet-peer warning and nothing else.
+
+## 0.27.5
+
+### Patch Changes
+
+- [#664](https://github.com/usetheokit/theokit-sdk/pull/664) [`d18d0d8`](https://github.com/usetheokit/theokit-sdk/commit/d18d0d8237ee26315b6693947bd2a476a1e004b0) Thanks [@usetheodev](https://github.com/usetheodev)! - A V4A patch opening with `*** Begin Patch ***` now gets an error that names the near miss.
+  
+  The message was `Invalid patch: missing '*** Begin Patch'`. That is true about the exact match and
+  misleading about the text on screen: the symmetric form CONTAINS the string it says is missing, so a
+  writer greps for an absent line while the defect is three characters at the end of a line already
+  there.
+  
+  Measured on a live run: a model wrote the symmetric form by analogy with the `*** Add File: …`
+  headers this format also uses, spent three attempts against the old message, and abandoned the step.
+  The analogy is the reason the mistake is common — every other marker in V4A carries a trailing
+  token, and this one does not.
+  
+  The variant is **not** accepted. V4A is parsed by other tools, and widening it here would make a
+  patch this runtime writes unreadable elsewhere. The error teaches the exact spelling instead: it
+  quotes the offending line back and says which part to drop.
+  
+  Detection is a near-miss test — a line that starts with the marker and is not equal to it — so it
+  also covers `*** Begin Patch v2` and any other trailing suffix, not the one spelling that prompted
+  it. A patch with no marker at all keeps the original message.
+
 ## 0.27.4
 
 ## 0.27.4-next.1

package/dist/index.cjs

@@ -33,11 +33,19 @@ var V4APatchError = class extends Error {
     this.name = "V4APatchError";
   }
 };
+function missingBeginMessage(lines) {
+  const nearMiss = lines.find((l) => {
+    const t = l.trim();
+    return t !== BEGIN && t.startsWith(BEGIN);
+  });
+  if (nearMiss === void 0) return `Invalid patch: missing '${BEGIN}'`;
+  return `Invalid patch: the opening marker must be exactly '${BEGIN}', and this patch has '${nearMiss.trim()}'. Drop everything after '${BEGIN}' on that line \u2014 the trailing '***' belongs to no marker in this format.`;
+}
 function parseV4A(patch) {
   const lines = patch.split("\n").map((l) => l.endsWith("\r") ? l.slice(0, -1) : l);
   let i = 0;
   while (i < lines.length && lines[i].trim() !== BEGIN) i++;
-  if (i >= lines.length) throw new V4APatchError("Invalid patch: missing '*** Begin Patch'");
+  if (i >= lines.length) throw new V4APatchError(missingBeginMessage(lines));
   i++;
   const hunks = [];
   while (i < lines.length) {