deprecated-tracker 2.5.0 → 2.6.0

package/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 All notable changes to the "Deprecated Tracker" extension will be documented in this file.
 
+## Release channels
+
+One version number covers three artifacts — the VS Code extension, the same
+extension on Open VSX, and the `deprecated-tracker` CLI on npm — and their
+published version lists are **not identical**. Nothing has ever been
+unpublished; the gaps are releases that had nothing to ship for that artifact.
+
+- **npm** carries `2.2.0`, `2.3.0`, `2.3.1`, `2.5.0`. The CLI's first release to
+  the registry was `2.2.0`. `2.4.0` and `2.4.1` are absent because neither
+  changed the CLI — publishing a byte-identical CLI under a new number would say
+  something changed when nothing had.
+- **Open VSX** carries `1.0.0`, `1.2.0`, `1.5.0`, `2.3.0`, `2.3.1`, `2.5.0`, `2.5.1`.
+- **The VS Code Marketplace** carries the extension releases.
+
+If a version is missing from the channel you are looking at, the entry below
+tells you which artifact it changed. A release that touches only one artifact is
+noted as such in its own section.
+
+## [2.6.0]
+
+### Added
+
+- **The CLI reports the three-way split the results panel is built around.** Every deprecated declaration is one of three things and each is a different job: something still calls it and the tag says what to use instead (*documented*), something still calls it and the tag says nothing (*bare*), or nothing calls it any more (*unused* — deletable today). The text report now states the counts under its headline, and `--format json` carries them as `summary`. It counts declarations rather than items, so it deliberately does not sum to `total`.
+- **`items[].declaration` in the JSON report.** Usages now name the declaration they came from — its symbol, file and line. Previously the JSON had no link between a call site and the declaration it reached, so a consumer could only group by name, which silently merges two different symbols that happen to share one. The MCP tools return both new fields as well, so an agent reads the same shape.
+- **The help opens with a command you can paste.** `npx deprecated-tracker .` is the first line, ahead of the synopsis, and the description says what the tool reports rather than only how it exits.
+
+Both JSON additions are new fields. No existing field changed name, type or meaning, and `kind` still reports exactly what it did.
+
+## [2.5.1]
+
+*Extension only — the CLI is unchanged, so this version is not published to npm.*
+
+### Fixed
+
+- **The results panel flashed its collapsible regions on open.** Five elements in `main.html` were hidden with a `style="display: none;"` attribute, and the panel's CSP is `style-src {{cspSource}}` with no `'unsafe-inline'`, so the browser dropped every one of them. Each was hidden only because a script later assigned `.style.display`, which left an empty hero, an empty filter-chip row, the keyboard hint and the entire ignore view painting for a frame before the first render corrected them. Three of the five arrived with the 2.5.0 redesign. They are now hidden by class — the stylesheet holds `display: none` and a `.show` rule restores the exact display value each element had — which is the same pattern the AI prompt modal has used since 1.5.0, when this mechanism last caused a visible bug.
+
+- **The ignore manager rendered unstyled at its edges.** Its tab strip sat flush against the panel edge, because the inset for that markup was only ever applied to the standalone panels that hang the tabs off `.container` — `.ignore-view`, which hosts the same markup in the results panel, has no padding of its own despite a comment claiming otherwise. Separately, the four "nothing here yet" rows appeared as tall blank bands with their text stranded mid-panel: they are `<li>` elements carrying `.empty-state`, which is the results table's full-panel treatment of 64px padding and centred text. Both are now correct, and the stylesheet no longer carries rules for two element ids that stopped existing when the standalone ignore panel was removed.
+- **The settings and requirements panels reset when you switched tabs.** 2.5.0 fixed this for three panels, one of which was the standalone ignore panel that has since been removed, leaving two of the four remaining panels still tearing down their webview on hide and reloading it on reveal. Settings had `retainContextWhenHidden: false` set explicitly: the settings themselves are written on `change` so nothing saved was ever at risk, but the tag filter box, a partly filled add/edit tag modal and the scroll position were all lost. Requirements is read-only and lost only its scroll position. Both now retain context.
+
+### Internal
+
+- **The extension is published to both registries by one command.** `npm run publish-extension` builds the package and pushes the *same* `.vsix` to the VS Code Marketplace and to Open VSX. Previously only the npm CLI had a publish script and both extension registries were manual, separate steps — which is the whole reason Open VSX is missing `2.0.x`–`2.2.x` and all of `2.4.x`. It refuses to start unless both `VSCE_PAT` and `OVSX_PAT` are present, so a half-finished release cannot leave the two registries on different versions, and it publishes one artifact to both rather than building twice, so they cannot carry different bytes under one version number.
+- **The `.vsix` no longer carries a second, unreachable copy of every webview script and stylesheet.** `.vscodeignore` re-included all of `src/webview/assets`, so each script and stylesheet shipped twice. Only the `out/` copy is ever loaded — every `scriptUri` and `styleUri` is built from that directory and `localResourceRoots` is restricted to it, so the `src/` copy could not have been loaded even if a URI had pointed at it. The `.html` templates stay, because both `loadTemplate` implementations fall back to them. 141,804 bytes smaller.
+- **The standalone ignore panel is gone.** Ignore management moved inside the results panel some releases ago and the separate panel has had no production caller since, but `src/webview/index.ts` re-exported it, which was enough to keep it compiling, covered by tests and maintained — the 2.5.0 redesign added `retainContextWhenHidden` and a tab icon to a class nothing could open. Removing it, its two webview assets and the tests that existed only to cover them drops roughly 1,250 lines. Coverage stays at 100%.
+- **`copy-assets` prunes its output directory before copying.** It created the destination if missing and then copied over it, so a file deleted from `src/webview/assets` survived in `out/` until the directory was cleared by hand. Because `.vscodeignore` re-includes `out/src/webview/assets/**`, a locally built `.vsix` kept shipping assets the source no longer had. CI was never affected — it always starts from a clean checkout.
+
 ## [2.5.0]
 
 ### Changed

package/docs/CLI.md

@@ -154,15 +154,19 @@ npx deprecated-tracker --files src/a.ts src/b.ts --format json
 {
   "passed": false,
   "total": 1,
+  "summary": { "documented": 1, "bare": 0, "unused": 0 },
   "items": [
     { "name": "oldApi", "kind": "usage", "file": "src/a.ts",
-      "line": 12, "character": 10, "reason": "Use newApi instead" }
+      "line": 12, "character": 10, "reason": "Use newApi instead",
+      "declaration": { "name": "oldApi", "file": "src/api.ts", "line": 4 } }
   ]
 }
 ```
 
 - **Unstaged edits are covered.** A file with no staged hunks is read as entirely changed, so everything in it is reported — nothing needs staging or committing first.
 - **`items[].reason`** carries the `@deprecated` text, usually the replacement instruction. That is the field to act on.
+- **`items[].declaration`** is where the deprecated symbol is declared, and is present on usages only. It is the identity to group call sites by: two different symbols can share a name, so matching on `name` alone merges them.
+- **`summary`** counts *declarations*, not items, so it does not sum to `total`. A declaration is `documented` when something still calls it and the tag says what to use instead, `bare` when something still calls it and the tag says nothing, and `unused` when nothing calls it any more — which is the one that is deletable today. The same three-way split the extension's results panel is organised around, and it is derivable from `items` alone if you would rather compute it yourself.
 - **Exit code is the verdict, not an error:** `1` means findings. An agent that treats any non-zero exit as a crash will misread it.
 - Drop `--files` and pass a path to scan the whole project; add `--fail-on-any` to ignore the baseline.