mason-context 0.18.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.19.0 — 2026-09-17
+
+- Add automatic updates for new public standalone installations, with existing installations opting in through `mason updates enable`. Check at most daily for stable releases at least 24 hours old; leave npm, pinned versions, company mirrors, and CI under explicit control.
+- Verify automatic downloads against Sigstore-signed release metadata from the exact tagged publishing workflow, stage and health-check each bundle, and activate at a future MCP launch only after other Mason MCP servers exit. Keep update work and diagnostics out of hook and MCP protocol streams.
+- Add `mason updates` status, enable/disable and pin/unpin controls, `MASON_NO_AUTO_UPDATE=1`, persisted company mirror selection, and an offline `mason rollback` that restores and pins the previous installation. Retain `mason upgrade` for explicit immediate updates.
+- Track standalone processes before startup and reclaim unused update bundles while preserving current, rollback, staged, and running versions. Retain legacy or uncertain bundles conservatively.
+- Let linked Git worktrees inherit host activation from the primary checkout, with local setup and teardown taking precedence; keep audit evidence and observations local to each worktree.
+- Limit dependency-change advisories to documents containing dependency guidance, preserve committed evidence through local edits, and distinguish current findings from historical advisories awaiting review.
+
 ## 0.18.0 — 2026-09-16
 
 - Fix overlapping snapshot writes restoring old descriptions and deleted flows. Snapshot saves, verdicts, and partial writes share a per-checkout cross-process lock; reads, replacement, and consolidation cleanup stay within the protected operation.

package/README.md

@@ -34,6 +34,8 @@ irm https://github.com/adrianczuczka/mason/releases/latest/download/install.ps1
 
 No Node or npm required. Git is required. The installer configures PATH for Bash, Zsh, and Windows. [Platform details](docs/distribution.md) · [npm installation](docs/setup.md#unified-project-setup)
 
+New standard standalone installs update automatically in the background. Updates activate on a future MCP launch after existing Mason MCP servers exit. Run `mason updates` to inspect or change this preference. Existing installations require one manual upgrade and `mason updates enable`. [Update controls](docs/distribution.md#automatic-updates)
+
 Run this in your Git repository (open a new terminal if the installer asks):
 
 ```bash

package/dist/mason-audit.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+if (!import.meta.url.endsWith("/mason-runtime.js")) await import("./mason-runtime.js").then(m => m.registerRuntime());
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -1789,6 +1790,10 @@ var init_release_metadata = __esm({
 });
 
 // src/audit/checks/deps-changed.ts
+function hasDependencyContent(content) {
+  const text2 = content.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, "").replace(/<!--[\s\S]*?-->/g, "");
+  return /\b(?:dependenc(?:y|ies)|librar(?:y|ies)|frameworks?|tech(?:nology)? stack|prerequisites|requirements)\b/i.test(text2) || /\b(?:package\.json|build\.gradle(?:\.kts)?|settings\.gradle(?:\.kts)?|libs\.versions\.toml|Cargo\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)\b/i.test(text2) || /\b(?:node(?:\.js)?|npm|pnpm|yarn|bun|deno|python|ruby|rust|go|java|jdk|kotlin|gradle|swift|php|react|vue|angular|compose|ktor|room)\s*(?:version\s*)?[`*:=>~^v\s-]*\d+(?:\.\d+)*\b/i.test(text2) || /\b(?:npm|pnpm|yarn|pip3?|cargo|gem|composer)\s+(?:install|add|require)\b/i.test(text2);
+}
 function manifestPathspecs(doc) {
   const scope = documentScope(doc);
   if (scope === ".") return MANIFEST_PATHSPECS;
@@ -1815,6 +1820,19 @@ async function checkDepsChanged(ctx) {
         reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
       });
     }
+    let content = doc.content;
+    if (doc.dirty) {
+      try {
+        content = (await inspectionGit(
+          ["show", `${doc.lastCommit.hash}:${doc.path}`],
+          { cwd: ctx.root, maxBuffer: 10 * 1024 * 1024, timeout: 1e4 }
+        )).stdout;
+      } catch {
+        result.skipped.push({ check: "deps-changed", doc: doc.path, reason: `${doc.path}: committed dependency content is unavailable` });
+        continue;
+      }
+    }
+    if (!hasDependencyContent(content)) continue;
     const range = await commitsTouchingSince(
       ctx.root,
       doc.lastCommit.hash,
@@ -1860,6 +1878,7 @@ var init_deps_changed = __esm({
     init_docs();
     init_release_metadata();
     init_git();
+    init_inspection();
     init_checks();
     MANIFEST_COMMITS_CAP = 10;
     MANIFEST_PATHSPECS = [
@@ -2522,7 +2541,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       return {
         ...base,
         status: "review-required",
-        reason: "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+        reason: (now ? "The current check still reports this advisory. " : finding.type === "deps-changed" ? "The current check no longer reports this condition; the historical advisory remains awaiting assessment. " : "The current check no longer reports the original finding; retained evidence still requires assessment. ") + "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
       };
     }
     return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };