constellai 0.3.6 → 0.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "constellai",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Constella — run autonomous AI agent-companies locally: real claude/codex agents, Goals → Specs → Issues → Plans, local models, GitHub & Telegram, all from one cosmic control plane.",
   "//name": "Published as `constellai` (the unscoped `constella` was taken). Ships BOTH a `constellai` and a `constella` bin (same launcher): `npx constellai` needs a bin matching the package name to run on Windows, and a global install also gives the short `constella` command.",
   "license": "MIT",
@@ -44,6 +44,7 @@
     "drizzle.config.mjs",
     "README.md",
     "LICENSE",
+    "THIRD_PARTY_LICENSES.md",
     "CHANGELOG.md"
   ],
   "publishConfig": {
@@ -97,12 +98,12 @@
     "constellai": "bin/constella.mjs"
   },
   "dependencies": {
-    "@playwright/test": "^1.61.0",
+    "@playwright/test": "^1.61.1",
     "@simplewebauthn/browser": "^13.3.0",
-    "@simplewebauthn/server": "^13.3.1",
+    "@simplewebauthn/server": "^13.3.2",
     "adm-zip": "^0.5.17",
     "archiver": "^8.0.0",
-    "better-auth": "^1.6.19",
+    "better-auth": "^1.6.22",
     "better-sqlite3": "^12.2.0",
     "chokidar": "^5.0.0",
     "drizzle-kit": "^0.31.10",
@@ -112,23 +113,23 @@
     "react-dom": "^19.2.7",
     "react-markdown": "^10.1.0",
     "remark-gfm": "^4.0.1",
-    "zod": "^3.25.76"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.3.1",
     "@types/adm-zip": "^0.5.8",
     "@types/archiver": "^8.0.0",
     "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^22.19.21",
+    "@types/node": "^26.0.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "eslint": "^10.5.0",
+    "eslint": "^10.6.0",
     "eslint-plugin-react": "^7.37.5",
     "postcss": "^8.5.15",
     "tailwindcss": "^4.3.1",
     "tsx": "^4.22.4",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.61.1"
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.62.0"
   },
   "//pnpm.overrides": "Force patched transitive build-tooling across the tree. postcss: Next bundles 8.4.31 (GHSA: XSS via unescaped </style>). esbuild: the vulnerable 0.18.20 (GHSA-67mh-4wv8-2f99, dev-server CORS) is pulled only by drizzle-kit's legacy @esbuild-kit/core-utils config loader — drizzle-kit's own work already uses esbuild 0.25.x, so bumping the legacy loader to >=0.25.0 patches the advisory; the loader's transform/build API usage is stable across 0.18→0.25.",
   "pnpm": {

package/scripts/publish-public.mjs

@@ -1,15 +1,16 @@
 #!/usr/bin/env node
 /**
- * Push the CLEAN, COMPILED-distribution tree to the PUBLIC repo (`public` remote = gabriel7silva/constella).
+ * Push the CLEAN, OPEN-SOURCE tree to the PUBLIC repo (`public` remote = gabriel7silva/constella).
  *
- * The public repo ships the *product*, not the source: docs, the launcher (bin/), runtime scripts,
- * the native skills library, config, and the generated DB migrations (drizzle/) — but **NO `src/`**
- * and **no committed build** (the compiled `.next` reaches users through the npm tarball, not git).
- * This script builds that filtered tree in a temporary git index, secret-scans exactly what it will
- * publish, and REFUSES on any finding. It never runs automatically.
+ * The public repo is now FULL SOURCE (open-source): `src/`, docs, the launcher (bin/), runtime scripts,
+ * the native skills library, config, and the generated DB migrations (drizzle/) — but NOT test config
+ * (e2e/tests/playwright) or the internal release guide (the per-locale PUBLISHING.md), and no committed build
+ * (the compiled `.next` reaches users through the npm tarball, not git). This script builds that filtered
+ * tree in a temporary git index, secret-scans exactly what it will publish, and REFUSES on any finding. It
+ * force-pushes a single clean root commit (dev history stays private). It never runs automatically.
  *
  *   node scripts/publish-public.mjs            # scan only (dry run)
- *   node scripts/publish-public.mjs --push     # scan, then force-push the clean tree to `public main`
+ *   node scripts/publish-public.mjs --push     # scan, then force-push the clean source tree to `public main`
  */
 import { execSync } from "node:child_process";
 import { readFileSync, statSync, mkdtempSync, existsSync, readdirSync } from "node:fs";
@@ -18,8 +19,12 @@ import { join } from "node:path";
 
 const PUSH = process.argv.includes("--push");
 
-// Tracked paths that must NEVER reach the public repo (the whole point: no source, no test config).
-const EXCLUDE = ["src", "playwright.config.ts", "e2e", "tests"];
+// Tracked paths that must NEVER reach the public repo: test config + the INTERNAL release guide (it names the
+// private dev backup remote). `src/` is now PUBLISHED (open-source) — only these stay private.
+const EXCLUDE = [
+  "playwright.config.ts", "e2e", "tests",
+  "docs/en/PUBLISHING.md", "docs/pt/PUBLISHING.md", // internal release guide (names the private dev remote)
+];
 
 // Mirror of src/server/git-scan.ts — sensitive filenames + high-confidence inline secret patterns.
 const SENSITIVE_FILE = /(^|\/)(\.env(\.[\w.-]+)?|id_[rd]sa\w*|.*\.(pem|key|p12|pfx|keystore|jks|ppk|asc)|credentials?\.json|service[-_]?account[\w.-]*\.json|.*\.(sql|dump|bak|sqlite3?|db)|npm-debug\.log|.*\.local)$/i;
@@ -90,19 +95,19 @@ for (const f of publishFiles) {
     }
   }
 }
-// Belt-and-suspenders: make sure no src/ slipped into the publish set.
-const leaked = publishFiles.filter((f) => f === "src" || f.startsWith("src/"));
-if (leaked.length) findings.push(`src/ leaked into the public tree (${leaked.length} file(s)) — aborting`);
+// Belt-and-suspenders: make sure the internal release guide never slips through.
+const leaked = publishFiles.filter((f) => /(^|\/)PUBLISHING\.md$/.test(f));
+if (leaked.length) findings.push(`internal PUBLISHING.md leaked into the public tree (${leaked.join(", ")}) — aborting`);
 
 if (findings.length) {
-  console.error(`\n✖ Refusing to publish — ${findings.length} potential secret/sensitive/source finding(s):`);
+  console.error(`\n✖ Refusing to publish — ${findings.length} potential secret/sensitive finding(s):`);
   for (const x of findings.slice(0, 30)) console.error("  - " + x);
   process.exit(1);
 }
-console.log(`✓ Clean: ${publishFiles.length} files to publish (no src/, no secrets). Migrations: ${publishFiles.filter((f) => f.startsWith("drizzle/")).length} file(s).`);
+console.log(`✓ Clean: ${publishFiles.length} files to publish (full source, no secrets). Migrations: ${publishFiles.filter((f) => f.startsWith("drizzle/")).length} file(s).`);
 
 if (!PUSH) {
-  console.log("\nDry run. To publish the clean compiled tree to the public repo, run:");
+  console.log("\nDry run. To publish the clean source tree to the public repo, run:");
   console.log("  node scripts/publish-public.mjs --push");
   process.exit(0);
 }
@@ -116,7 +121,7 @@ execSync("git read-tree HEAD", { env, stdio: "inherit" });
 for (const p of EXCLUDE) execSync(`git rm -r --cached --ignore-unmatch -- "${p}"`, { env, stdio: "ignore" });
 if (existsSync("drizzle")) execSync("git add -f -- drizzle", { env, stdio: "inherit" });
 const tree = execSync("git write-tree", { env }).toString().trim();
-const commit = execSync(`git commit-tree ${tree} -m "Constella — compiled distribution (docs, launcher, migrations; no source)"`, { env }).toString().trim();
+const commit = execSync(`git commit-tree ${tree} -m "Constella — public source release (open-source mirror; no test config / build)"`, { env }).toString().trim();
 
 console.log(`Pushing clean tree (${commit.slice(0, 9)}) to \`public\` (gabriel7silva/constella)…`);
 // Fully-qualify the destination ref: pushing a bare commit object to `main` fails on an empty remote