contract-driven-delivery 2.0.7 → 2.0.9

package/CHANGELOG.md

@@ -1,5 +1,118 @@
 # Changelog
 
+## [2.0.9] - 2026-05-04
+
+Bug-fix patch. Discovered when verifying a real consumer repo (TODOLIST)
+after a successful 2.0.8 upgrade: the user's committed
+`specs/context/project-map.md` listed local kit-generated backup directories
+(`.cdd/.refresh-backup/...`, `.cdd/migrate-backup/...`), which then never
+matched fresh-clone digests — `cdd-kit doctor` reported "inputs changed"
+forever even when nothing was wrong.
+
+### Fixed
+
+- **`cdd-kit context-scan` excludes kit runtime artifacts AND common
+  transient cache directories at any depth**:
+  - `DEFAULT_FORBIDDEN` (path-prefix list) now includes
+    `.cdd/.refresh-backup`, `.cdd/migrate-backup`, `.cdd/runtime`.
+  - New `FORBIDDEN_DIRECTORY_NAMES` (basename-anywhere list) catches
+    Python (`__pycache__`, `.pytest_cache`, `.mypy_cache`, `.ruff_cache`,
+    `.tox`), JS/TS framework caches (`.next`, `.nuxt`, `.svelte-kit`,
+    `.parcel-cache`, `.turbo`, `.nyc_output`), generic build/coverage
+    (`coverage`, `htmlcov`, `.cache`), virtualenvs (`venv`, `.venv`),
+    nested `node_modules`, and IDE noise (`.idea`, `.vscode`, `.DS_Store`).
+  - Mirrors `code-map`'s `BUILTIN_EXCLUDE` so the two indexes ignore the
+    same noise. Previously context-scan only had 8 path-prefix entries
+    (`.claude / .git / node_modules / dist / build / assets / specs/archive /
+    specs/changes`), so locally-generated caches polluted the project-map
+    tree section and broke `inputs-digest` determinism for fresh clones.
+
+### Added
+
+- **`cdd-kit refresh`** auto-appends `.cdd/.refresh-backup/` to `.gitignore`
+  the first time it overwrites a template (idempotent — no duplicate
+  entries on subsequent runs). Logs the action so users know what changed.
+- **`cdd-kit migrate`** auto-appends `.cdd/migrate-backup/` to `.gitignore`
+  with identical idempotent semantics.
+
+### Migration
+
+If you already committed a polluted `specs/context/project-map.md` (signs:
+the tree section contains paths under `.cdd/.refresh-backup/` or
+`.cdd/migrate-backup/`, doctor reports "inputs changed" after a successful
+refresh), recover with:
+
+```bash
+echo ".cdd/.refresh-backup/" >> .gitignore
+rm -rf .cdd/.refresh-backup
+cdd-kit context-scan
+git add .gitignore specs/context/
+git commit -m "fix: exclude cdd-kit refresh-backup from context-scan"
+```
+
+Future refreshes will handle the gitignore entry automatically.
+
+## [2.0.8] - 2026-05-04
+
+Adds `cdd-kit refresh` — a one-shot complete upgrade command. The previous
+upgrade flow (`update --yes` + `upgrade --yes`) only touched `~/.claude/`
+and added missing project files; kit-shipped templates that the user already
+had on disk were never refreshed, leaving them stale across releases.
+
+### Added
+
+- **`cdd-kit refresh [--yes]`**: composes `update` + `upgrade` and adds
+  force-refresh for kit-owned templates with automatic timestamped backup.
+  Six steps, each independently skippable:
+  1. `~/.claude/agents` and `~/.claude/skills/contract-driven-delivery`
+     (delegates to `cdd-kit update`)
+  2. Add missing project files (delegates to `cdd-kit upgrade`)
+  3. **Force-refresh kit templates** with backup to
+     `.cdd/.refresh-backup/<timestamp>/`. Targets:
+     `specs/templates/`, `tests/templates/`, `ci-templates/`,
+     `.github/workflows/contract-driven-gates.yml`.
+  4. Re-install pre-commit hook if `.cdd/.hooks-installed` marker exists.
+  5. Resync `.cdd/model-policy.json` roles map from
+     `~/.claude/agents/<name>.md` `model:` frontmatter (drift detector).
+  6. Regenerate `.cdd/code-map.yml`.
+
+  Flags to skip individual steps: `--no-templates`, `--no-hooks`,
+  `--no-code-map`, `--no-update`, `--no-upgrade`. Default is dry-run; pass
+  `--yes` to apply.
+
+- **`.cdd/.hooks-installed` marker**: written by `cdd-kit init --hooks`.
+  Travels in the repo. Lets `cdd-kit refresh` know whether to re-install
+  the pre-commit hook on every refresh — so the hook stays in sync with
+  the latest kit version automatically.
+
+### Fixed
+
+- **Pre-commit hook extension list**: `installCodeMapHook` now triggers
+  on `.py / .js / .jsx / .mjs / .cjs / .ts / .tsx / .vue` (was: `.py / .js / .vue`).
+  Mirrors `BUILTIN_INCLUDE` and the 2.0.7 qa-reviewer fix.
+
+### Boundaries (locked)
+
+`cdd-kit refresh` will **never** touch:
+- `contracts/`, `specs/changes/`, `specs/archive/`
+- `src/`, `tests/*` (except `tests/templates/`)
+- `.cdd/code-map-config.yml`, `.cdd/context-policy.json`
+- `CLAUDE.md`, `AGENTS.md`, `CODEX.md`
+- `package.json`, `.git/` (except `.git/hooks/pre-commit` when marker exists),
+  `node_modules/`, `dist/`, `build/`
+
+### Migration
+
+Existing 2.0.x projects: `npm install -g contract-driven-delivery@latest`
+then `cdd-kit refresh --yes`. The first refresh will surface any drift
+that accumulated across 2.0.3 → 2.0.7 — backups land in
+`.cdd/.refresh-backup/<timestamp>/` so rolling back any specific change
+is a single `cp` away.
+
+To use the auto-refreshing pre-commit hook on every push:
+1. `cdd-kit init --hooks` (writes the marker)
+2. From now on, `cdd-kit refresh --yes` will re-install the hook every time.
+
 ## [2.0.7] - 2026-05-04
 
 Comprehensive cross-consistency audit fixes. Targets the #1 root cause of