agy-powerline 1.7.0 → 1.8.0

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.8.0] - 2026-10-25
+
+### Added
+
+- Each GitHub release has its signed SLSA provenance attached as `agy-powerline-<version>.intoto.jsonl`, next to the `.sigstore.json` attestations
+- GOVERNANCE.md (roles, how decisions are made, continuity), ROADMAP.md (plans to October 2027) and SECURITY-REVIEW.md (the first security review and its findings); SECURITY.md says how vulnerability reports are handled and credited and gives the project's assurance case
+
+### Changed
+
+- The README screenshots and agy-powerline.com's images are smaller files, and the home page fetches its hero artwork first
+
+### Fixed
+
+- agy-powerline.com's sitemap lists the screenshots at the addresses the site serves them from
+
 ## [1.7.0] - 2026-10-24
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agy-powerline",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "agy statusline for Google Antigravity CLI: live Gemini, Claude/GPT and Argon quota pacing, git, themes and an interactive TUI configurator",
   "bin": {
     "agy-powerline": "src/index.js"

package/src/cli/bundle.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 // Builds the installed statusline.js: the runtime script and the library

package/src/cli/caps.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const {

package/src/cli/config-guard.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const { readConfigFile, getConfigPath } = require("../lib/shared");

package/src/cli/configure.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const readline = require("readline");

package/src/cli/doctor.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/cli/export.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/cli/gradient.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const {

package/src/cli/import.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/cli/init.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/cli/layout.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const {

package/src/cli/preset.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const {

package/src/cli/repo-url.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const { repository } = require("../../package.json");

package/src/cli/report.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/cli/theme.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const {

package/src/cli/tui-style.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 // Building blocks for the configure TUI: wordmark, tabs, panels, keycaps and

package/src/cli/uninstall.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/index.js

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/lib/catalog.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 // description: one sentence, shown in the configure details panel.

package/src/lib/colors.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const CSI = "\x1b[";

package/src/lib/config-check.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const { defaultConfig, canonicalThemeId, LAYOUTS } = require("./shared");

package/src/lib/config.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/lib/exec.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");
@@ -28,7 +31,9 @@ function getCacheFilePath() {
   } catch {
     // Fallback
   }
-  // Per-user name so other accounts on a shared machine cannot pre-create it.
+  // Per-user name so accounts don't share one cache. Another account could
+  // still guess and pre-create it in a shared /tmp, so the runtime never comes
+  // here: exec widgets only run from a config file in the install dir above.
   let user = "user";
   try {
     user = os.userInfo().username.replace(/[^A-Za-z0-9_.-]/g, "_") || user;

package/src/lib/fit.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const { charWidth, visibleWidth } = require("./formatters");

package/src/lib/formatters.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const os = require("os");

package/src/lib/git.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/lib/i18n.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 // The bar's own words: widget tags, captions and units. Payload text (model,

package/src/lib/layouts/lines.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const {

package/src/lib/layouts/pills.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const {

package/src/lib/log.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 // Local problem log. It records crashes, exceptions and warnings so a user can

package/src/lib/mock-data.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 function sampleData() {

package/src/lib/paths.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/lib/payload-dump.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 // Debug payload dumps (AGY_POWERLINE_DEBUG / --dump-payload). Instead of a raw

package/src/lib/powerline.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 // Powerline glyphs are stored as hex code points ("E0B4") so the config file

package/src/lib/prompt.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const readline = require("readline");

package/src/lib/run.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const { spawn } = require("child_process");

package/src/lib/session.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const fs = require("fs");

package/src/lib/shared.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const {

package/src/lib/themes.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const { parseColor, parseGradientStops, luminance } = require("./colors");

package/src/lib/usage.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 // Tokens used today and over the last 7 days, for the tokensToday and

package/src/lib/widget-options.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const {

package/src/lib/widget-style.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const { parseColor } = require("./colors");

package/src/runtime/statusline.js

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 agy-powerline contributors
+
 "use strict";
 
 const path = require("path");