faf-taf-git 2.4.1 → 2.4.2

package/CHANGELOG.md

@@ -1,5 +1,5 @@
 <!-- faf: faf-taf-git | TypeScript | cli | A Test Receipt Printer for git -->
-<!-- faf: doc=changelog | latest=v2.4.1 | canonical=project.faf | family=TAF -->
+<!-- faf: doc=changelog | latest=v2.4.2 | canonical=project.faf | family=TAF -->
 
 # Changelog
 
@@ -8,6 +8,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.2] - 2026-10-30
+
+undici 6.29.1 in the Action bundle (security), and the npm package ships only the CLI: 34 kB instead of 1.0 MB.
+
+### Security
+- **undici 6.28.1 → 6.29.1** in the lockfile and the rebuilt Action bundle (`dist/index.js`). Clears 5 Dependabot alerts (TLS certificate check bypass, denial of service). undici comes in through `@actions/core`; faf-taf-git makes no HTTP requests itself, so the risk was low, but the bundle no longer carries a known-vulnerable copy.
+
+### Changed
+- **The npm package ships only the CLI:** a `files` list in package.json. 1.0 MB → 34 kB packed, 94 → 48 files. Out: `src/`, `tests/`, `.github/`, dev configs, and the GitHub Action bundle (`dist/index.js`), which workflows run from the git tag, never from npm. The Action itself is unchanged.
+
 ## [2.4.1] - 2026-10-30
 
 `faf-taf-git --version` answers, and the descriptions say tamper-evident, not "cannot be gamed".

package/README.md

@@ -76,7 +76,7 @@ jobs:
 
       - name: Print the receipt
         if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
-        uses: Wolfe-Jam/faf-taf-git@v2.4.1
+        uses: Wolfe-Jam/faf-taf-git@v2.4.2
         with:
           test-output-file: test-output.txt
           target-branch: taf-receipts

package/package.json

@@ -1,11 +1,24 @@
 {
   "name": "faf-taf-git",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "A Test Receipt Printer for git. Every CI run prints a receipt to .taf — append-only, timestamped, kept in git. Proof over time.",
   "main": "dist/cli.js",
   "bin": {
     "faf-taf-git": "dist/cli.js"
   },
+  "files": [
+    "dist/**/*",
+    "!dist/index.js",
+    "!dist/index.js.map",
+    "!dist/bundle",
+    "!dist/sourcemap-register.js",
+    "!dist/licenses.txt",
+    "README.md",
+    "RECEIPT-FORMAT.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "project.faf"
+  ],
   "scripts": {
     "build": "tsc && ncc build src/index.ts -o dist --source-map --license licenses.txt",
     "test": "jest"

package/project.faf

@@ -29,8 +29,8 @@ human_context:
   what: "A Test Receipt Printer for git. Every CI run prints a receipt to .taf: append-only, timestamped, kept in git. Proof over time."
   why: Test results vanish when CI logs expire. Receipts stay in git, so anyone can look back and check whether main was green before a release.
   where: https://github.com/Wolfe-Jam/faf-taf-git
-  when: v2.4.1 (2026-10-30), --version fix; v2.4.0 (2026-10-29) JUnit XML parser; live since v1.0.0 (2025-10-27)
-  how: "Run tests, save the output (or a JUnit XML report), then `uses: Wolfe-Jam/faf-taf-git@v2.4.1` with `target-branch: taf-receipts`. Anywhere else: `npx faf-taf-git --file test-output.txt --commit`. The taf-receipts branch only grows: never rewrite it."
+  when: v2.4.2 (2026-10-30), undici security fix + CLI-only npm package; v2.4.1 --version fix; v2.4.0 (2026-10-29) JUnit XML parser; live since v1.0.0 (2025-10-27)
+  how: "Run tests, save the output (or a JUnit XML report), then `uses: Wolfe-Jam/faf-taf-git@v2.4.2` with `target-branch: taf-receipts`. Anywhere else: `npx faf-taf-git --file test-output.txt --commit`. The taf-receipts branch only grows: never rewrite it."
 monorepo:
   packages_count: slotignored
   build_orchestrator: slotignored

package/.faf-dna

@@ -1,95 +0,0 @@
-{
-  "birthCertificate": {
-    "born": "2025-10-28T01:26:05.692Z",
-    "birthDNA": 22,
-    "birthDNASource": "CLAUDE.md",
-    "projectDNA": "1785d1ac1c20876b",
-    "authenticated": false,
-    "certificate": "FAF-2025-FAFTAFAC-TMZU"
-  },
-  "versions": [
-    {
-      "version": "v1.0.0",
-      "timestamp": "2025-10-28T01:26:05.693Z",
-      "score": 22,
-      "changes": [
-        "Initial context from CLAUDE.md"
-      ],
-      "approved": false,
-      "growth": 0,
-      "growthRate": 0
-    },
-    {
-      "version": "v1.0.1",
-      "timestamp": "2025-10-28T01:26:05.721Z",
-      "score": 50,
-      "changes": [
-        "Initial .faf generation from project"
-      ],
-      "approved": false,
-      "growth": 28,
-      "growthRate": 28
-    }
-  ],
-  "current": {
-    "version": "v1.0.1",
-    "score": 50,
-    "approved": false,
-    "lastSync": "2025-10-28T01:26:05.721Z"
-  },
-  "recovery": {
-    "claudeMD": "/Users/wolfejam/FAF/faf-taf-action/CLAUDE.md",
-    "lastBackup": "2025-10-28T01:26:05.693Z",
-    "syncStatus": "active",
-    "autoRecover": true
-  },
-  "growth": {
-    "totalGrowth": 28,
-    "daysActive": 0,
-    "averageDailyGrowth": 28,
-    "bestDay": {
-      "date": "2025-10-28T01:26:05.721Z",
-      "growth": 28
-    },
-    "bestWeek": {
-      "start": "2025-10-28T01:26:05.693Z",
-      "growth": 0
-    },
-    "milestones": [
-      {
-        "type": "birth",
-        "score": 22,
-        "date": "2025-10-28T01:26:05.693Z",
-        "version": "v1.0.0",
-        "label": "Birth",
-        "emoji": "🐣"
-      },
-      {
-        "type": "doubled",
-        "score": 50,
-        "date": "2025-10-28T01:26:05.721Z",
-        "version": "v1.0.1",
-        "label": "Doubled",
-        "emoji": "2️⃣"
-      },
-      {
-        "type": "peak",
-        "score": 50,
-        "date": "2025-10-28T01:26:05.721Z",
-        "version": "v1.0.1",
-        "label": "Peak",
-        "emoji": "🏔️"
-      },
-      {
-        "type": "current",
-        "score": 50,
-        "date": "2025-10-28T01:26:05.721Z",
-        "version": "v1.0.1",
-        "label": "Current",
-        "emoji": "📍"
-      }
-    ]
-  },
-  "lastModified": "2025-10-28T01:26:05.721Z",
-  "format": "faf-dna-v1"
-}

package/.fafignore

@@ -1,41 +0,0 @@
-# .fafignore - Exclude files/directories from .faf context
-# Similar to .gitignore syntax
-# Lines starting with # are comments
-
-# Dependencies and build outputs
-node_modules/
-dist/
-build/
-coverage/
-
-# Python environments
-__pycache__/
-venv/
-.venv/
-
-# IDE and system files
-.vscode/
-.idea/
-.DS_Store
-
-# Sensitive files
-.env
-.env.*
-*.key
-*.pem
-
-# Logs and temporary files
-*.log
-logs/
-tmp/
-temp/
-
-# Large media files
-*.jpg
-*.png
-*.mp4
-*.pdf
-
-# Custom exclusions (add your own below)
-# example: my-large-data-folder/
-# example: *.generated.ts

package/.github/dependabot.yml

@@ -1,10 +0,0 @@
-version: 2
-updates:
-  # Keeps workflow `uses:` pins current (e.g. Wolfe-Jam/faf-taf-git) so they
-  # don't drift behind new releases. Security alerts don't need this file.
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    commit-message:
-      prefix: "ci"

package/.github/workflows/ci.yml

@@ -1,53 +0,0 @@
-name: CAR Pipeline
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-jobs:
-  car:
-    name: Claim → Audit → Receipt
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: '24.x'
-
-      - name: Install dependencies
-        run: npm ci
-
-      # ── C: CLAIM ──────────────────────────────────
-      - name: 'C: Validate project.faf (Claim)'
-        run: |
-          if [ ! -f project.faf ]; then
-            echo "::error::No project.faf found. Run 'faf init' to create one."
-            exit 1
-          fi
-          node -e "require('yaml').parse(require('fs').readFileSync('project.faf','utf-8')); console.log('project.faf: valid YAML')"
-          echo "Claim validated"
-
-      # ── A: AUDIT ──────────────────────────────────
-      - name: Build
-        run: npm run build
-
-      - name: 'A: Run tests (Audit)'
-        run: npm test 2>&1 | tee test-output.txt
-
-      # ── R: RECEIPT ────────────────────────────────
-      - name: 'R: Generate TAF Receipt'
-        if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main'
-        uses: Wolfe-Jam/faf-taf-git@v2.3.1
-        with:
-          test-output-file: test-output.txt
-          auto-commit: 'true'
-          commit-message: 'chore(taf): update receipt [skip ci]'
-          target-branch: taf-receipts

package/.github/workflows/claude-code-review.yml

@@ -1,36 +0,0 @@
-name: Claude Code Review
-
-on:
-  pull_request:
-    types: [opened, synchronize, ready_for_review, reopened]
-
-jobs:
-  claude-review:
-    # A Dependabot PR cannot read this repo's Actions secrets — GitHub withholds
-    # them from bot-authored runs — so the action fails its own env validation
-    # and the PR carries a red that says nothing about the change it proposes.
-    # Receipt (faf-cli, 2026-09-23): the last 8 human PRs all passed this
-    # workflow and both Dependabot PRs failed on that error alone. A dependency
-    # bump is Dependabot's diff to justify, not Claude's.
-    if: github.actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      issues: read
-      id-token: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code Review
-        id: claude-review
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
-          plugins: 'code-review@claude-code-plugins'
-          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'

package/.github/workflows/claude.yml

@@ -1,39 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
-      id-token: write
-      actions: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          additional_permissions: |
-            actions: read

package/.github/workflows/homebrew.yml

@@ -1,19 +0,0 @@
-name: Update Homebrew
-on:
-  push:
-    tags: ["v*"]
-
-jobs:
-  homebrew:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Update Homebrew formula
-        run: |
-          VERSION="${GITHUB_REF#refs/tags/v}"
-          gh workflow run update-formula.yml \
-            -R Wolfe-Jam/homebrew-faf \
-            -f formula=faf-taf-git \
-            -f version=$VERSION \
-            -f npm_package=faf-taf-git
-        env:
-          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

package/.taf

@@ -1,98 +0,0 @@
-format_version: 1.0.0
-project: faf-taf-git
-created: 2025-10-28T01:26:12.944Z
-last_updated: 2026-02-19T05:56:11.741Z
-faf_associated: true
-faf_location: project.faf
-faf_score: 65
-test_history:
-  - timestamp: 2025-10-28T01:28:38.600Z
-    result: PASSED
-    tests:
-      total: 7
-      passed: 7
-      failed: 0
-  - timestamp: 2025-10-28T01:40:23.935Z
-    result: PASSED
-    tests:
-      total: 7
-      passed: 7
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T02:24:34.363Z
-    result: PASSED
-    tests:
-      total: 38
-      passed: 38
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T02:45:42.500Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T03:07:37.867Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T03:11:02.179Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T03:24:05.159Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T03:28:51.125Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T05:59:46.851Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T06:24:51.475Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T06:37:15.943Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-18T20:33:40.820Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions
-  - timestamp: 2026-02-19T05:56:11.741Z
-    result: PASSED
-    tests:
-      total: 55
-      passed: 55
-      failed: 0
-    trigger: github-actions

package/CLAUDE.md

@@ -1,30 +0,0 @@
-<!-- faf:start -->
-<!-- faf: faf-taf-git | TypeScript | cli | A Test Receipt Printer for git. Every CI run prints a receipt to .taf: append-only, timestamped, kept in git. Proof over time. -->
-<!-- faf: claim=project.faf | family=FAF -->
-
-# CLAUDE.md — faf-taf-git
-
-## What This Is
-
-A Test Receipt Printer for git. Every CI run prints a receipt to .taf: append-only, timestamped, kept in git. Proof over time.
-
-## Stack
-
-- **Language:** TypeScript
-- **Hosting:** npm registry + GitHub Actions Marketplace
-- **Build:** TypeScript (tsc)
-- **CI/CD:** GitHub Actions
-
-## Context
-
-- **Who:** Maintainers and teams who want proof their tests kept passing on main, and the reviewers, auditors and AI agents who check it
-- **What:** A Test Receipt Printer for git. Every CI run prints a receipt to .taf: append-only, timestamped, kept in git. Proof over time.
-- **Why:** Test results vanish when CI logs expire. Receipts stay in git, so anyone can look back and check whether main was green before a release.
-- **Where:** https://github.com/Wolfe-Jam/faf-taf-git
-- **When:** v2.4.1 (2026-10-30), --version fix; v2.4.0 (2026-10-29) JUnit XML parser; live since v1.0.0 (2025-10-27)
-- **How:** Run tests, save the output (or a JUnit XML report), then `uses: Wolfe-Jam/faf-taf-git@v2.4.1` with `target-branch: taf-receipts`. Anywhere else: `npx faf-taf-git --file test-output.txt --commit`. The taf-receipts branch only grows: never rewrite it.
-
----
-
-*STATUS: SYNC ACTIVE — 2026-10-30T04:26:00.762Z*
-<!-- faf:end -->

package/CODE_OF_CONDUCT.md

@@ -1,21 +0,0 @@
-# Code of Conduct
-
-This project adopts the [Contributor Covenant, v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/) as its code of conduct. The full text of that covenant governs behavior in this project and its community spaces.
-
-## Summary
-
-- We commit to maintaining a respectful, harassment-free environment for everyone who participates, regardless of background.
-- Participation includes contributing code, opening issues, reviewing pull requests, and interacting in any official channel.
-- The Contributor Covenant defines the full scope, expected conduct, and enforcement guidelines. See the link above for the complete text.
-
-## Reporting
-
-If you observe conduct that violates this Code of Conduct, please email **team@faf.one**. Reports are handled confidentially. Maintainers will review, respond, and take appropriate action consistent with the Contributor Covenant's enforcement guidelines.
-
-## Scope
-
-This Code of Conduct applies to all project spaces — the repository, issues, pull requests, discussions, and any public communication channels operated by the project. It also applies when representing the project in other forums.
-
-## Attribution
-
-This Code of Conduct adopts the [Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/), available under the CC BY 4.0 license.