cctally 1.6.1 → 1.6.3

package/CHANGELOG.md

@@ -5,6 +5,16 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.6.3] - 2026-05-12
+
+### Fixed
+- npm tarball for v1.6.2 was built by the public-repo GHA workflow from a pre-fix tree (the workflow fired on a tag push that briefly pointed at the wrong commit before the cut was redone). The published v1.6.2 npm package therefore lacks `bin/_lib_share_templates.py` even though the GH release page, brew formula, and public repo all carry the correct fixed commit. v1.6.3 republishes the same v1.6.2 content under a fresh version so `cctally update` and fresh `npm install -g cctally` resolve to a working build. npm `cctally@1.6.2` will be deprecated post-publish; brew users on v1.6.2 are unaffected (brew builds from the GH archive which points at the corrected commit).
+
+## [1.6.2] - 2026-05-12
+
+### Fixed
+- v1.6.1's `package.json` `files[]` edit was a necessary but incomplete fix for the dashboard share GUI on npm installs: `bin/_lib_share_templates.py` also needed to be promoted to public in `.mirror-allowlist`, where it was lingering as `unmatched` from a stale "private kernel adjunct" classification dating to share-v2 implementation. The npm-publish GHA workflow runs from the public clone, so a file the mirror filters out never reaches the tarball regardless of `files[]`. v1.6.2 promotes the module and removes the stale comment block; v1.6.1's CLI `--format` fix is unchanged. The `tests/test_package_files.py` guard now ALSO asserts every `files[]` path classifies as `public` against `.mirror-allowlist`, so a future runtime-sibling promotion that updates only one of the two layers can't ship.
+
 ## [1.6.1] - 2026-05-12
 
 ### Fixed