mason-context 0.19.1 → 0.19.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## Unreleased
+
+## 0.19.2 — 2026-09-29
+
+- Use operating-system trusted certificates in standalone Mason, preserving bundled and extra certificates, so company TLS certificates work for upgrades and other requests. Report GitHub release lookup failures with their underlying error code and certificate or network guidance.
+
+- Capture supported lessons immediately as proposals, keeping unimplemented remedies tentative and acceptance subject to explicit review.
+- Give assistants new or worsened audit findings during the task and show remaining findings at response completion. Keep the existing backlog quiet; explicit checks still report it in full.
+- Preserve notification history across restarts, ignore report-only changes, and retain overflow for later notices. Notices never force another agent turn.
+- Recover notification tracking from unreadable upgrade reports while preserving repair evidence. Deduplicate verification warnings per session.
+- Show uncommitted decision records and pending proposals in explicit status, with paths, ages, and oldest proposals first.
+
 ## 0.19.1 — 2026-09-25
 
 - Match supported dependency changes to named document passages; retain unmatched manifest recency as information without a review obligation. Preserve specific findings, original baselines and prior assessments, and label historical evidence explicitly.

package/dist/mason-audit.js

@@ -2479,8 +2479,30 @@ var init_findings = __esm({
   }
 });
 
-// src/automation/store.ts
+// src/automation/notifications.ts
 import { z as z5 } from "zod";
+var conditionSchema, notificationStateSchema;
+var init_notifications = __esm({
+  "src/automation/notifications.ts"() {
+    "use strict";
+    init_findings();
+    conditionSchema = z5.object({
+      level: z5.number(),
+      facts: z5.array(z5.string()),
+      magnitude: z5.number().optional()
+    });
+    notificationStateSchema = z5.object({
+      version: z5.literal(1),
+      baselineHead: z5.string(),
+      baseline: z5.record(conditionSchema),
+      delivered: z5.record(conditionSchema),
+      cleared: z5.array(z5.string())
+    });
+  }
+});
+
+// src/automation/store.ts
+import { z as z6 } from "zod";
 function withLock(root, directory, run, waitMs = 5e3) {
   return withStoreLock(root, directory, run, waitMs, "Automation");
 }
@@ -2489,29 +2511,28 @@ var init_store = __esm({
   "src/automation/store.ts"() {
     "use strict";
     init_store_lock();
-    hostSchema = z5.enum(["claude", "codex"]);
-    stateSchema = z5.object({
-      version: z5.literal(1),
-      root: z5.string(),
-      gitDir: z5.string(),
-      branch: z5.string(),
-      baselines: z5.array(z5.object({ path: z5.string(), at: z5.string(), event: z5.string(), fingerprint: z5.string() })).max(128),
-      sessions: z5.record(z5.object({
+    init_notifications();
+    hostSchema = z6.enum(["claude", "codex"]);
+    stateSchema = z6.object({
+      version: z6.literal(1),
+      root: z6.string(),
+      gitDir: z6.string(),
+      branch: z6.string(),
+      baselines: z6.array(z6.object({ path: z6.string(), at: z6.string(), event: z6.string(), fingerprint: z6.string() })).max(128),
+      sessions: z6.record(z6.object({
         host: hostSchema,
-        seen: z5.string().nullable(),
-        continued: z5.boolean(),
-        initialIssues: z5.array(z5.string()),
-        initialDocs: z5.record(z5.string().nullable()),
-        lastUsed: z5.string(),
-        mutationObserved: z5.boolean(),
-        pending: z5.record(z5.string()),
-        coverageGaps: z5.array(z5.string()),
-        events: z5.record(z5.object({ at: z5.string(), count: z5.number().int().positive() }))
+        lastUsed: z6.string(),
+        notifiedDiagnostics: z6.array(z6.string()).default([]),
+        pending: z6.record(z6.string()),
+        coverageGaps: z6.array(z6.string()),
+        events: z6.record(z6.object({ at: z6.string(), count: z6.number().int().positive() }))
       })),
-      updatedAt: z5.string(),
-      fingerprint: z5.string().nullable(),
-      latest: z5.string().nullable(),
-      analysis: z5.object({ id: z5.string(), fingerprint: z5.string(), completedAt: z5.number(), path: z5.string() }).optional()
+      updatedAt: z6.string(),
+      fingerprint: z6.string().nullable(),
+      latest: z6.string().nullable(),
+      notifications: notificationStateSchema.optional(),
+      agentNotifications: notificationStateSchema.optional(),
+      analysis: z6.object({ id: z6.string(), fingerprint: z6.string(), completedAt: z6.number(), path: z6.string() }).optional()
     });
   }
 });
@@ -2533,7 +2554,7 @@ __export(repair_exports, {
 import fs10 from "fs/promises";
 import path20 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function recheckable(finding) {
   return !("confidence" in finding) && finding.resolution === "recheck" && ["deleted-reference", "dead-command", "new-module"].includes(finding.type) && ["missing-path", "missing-script", "unmentioned-dir"].includes(finding.evidence.kind);
 }
@@ -2604,7 +2625,7 @@ async function withRepairSession(root, options, run, validate, cachedAudit) {
 }
 async function prepareOriginal(rootDir, checks, options, session) {
   const root = await fs10.realpath(rootDir);
-  const selected = z6.array(checkSchema).nonempty().parse(checks);
+  const selected = z7.array(checkSchema).nonempty().parse(checks);
   const report = await (session ? session.audit(selected) : stableAudit(root, selected, options));
   if (!report) throw new Error("No context files found to prepare a repair.");
   if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
@@ -2761,42 +2782,42 @@ var init_repair = __esm({
     init_findings();
     init_advisory_review();
     init_findings();
-    count2 = z6.number().int().nonnegative();
-    reportSchema = z6.object({
-      version: z6.literal(1),
-      root: z6.string(),
-      gitAvailable: z6.literal(true),
+    count2 = z7.number().int().nonnegative();
+    reportSchema = z7.object({
+      version: z7.literal(1),
+      root: z7.string(),
+      gitAvailable: z7.literal(true),
       headHash: commitSchema.shape.hash,
-      checksRun: z6.array(checkSchema).nonempty(),
-      docs: z6.array(z6.object({
-        path: z6.string().refine((value) => normalizeRepoPath(value) === value),
-        scope: z6.string().optional(),
-        kind: z6.enum(["instructions", "readme", "guide"]).optional(),
+      checksRun: z7.array(checkSchema).nonempty(),
+      docs: z7.array(z7.object({
+        path: z7.string().refine((value) => normalizeRepoPath(value) === value),
+        scope: z7.string().optional(),
+        kind: z7.enum(["instructions", "readme", "guide"]).optional(),
         lastCommit: commitSchema.nullable(),
-        dirty: z6.boolean(),
+        dirty: z7.boolean(),
         lineCount: count2
       })).nonempty(),
-      decisionsChecked: z6.boolean(),
-      clean: z6.boolean(),
-      excludedChecks: z6.array(z6.object({ check: checkSchema, doc: z6.string() })).optional(),
-      issues: z6.array(issueSchema),
-      advisories: z6.array(advisorySchema),
-      suppressedAdvisories: z6.array(advisorySchema).optional(),
-      skippedChecks: z6.array(z6.object({ check: z6.string(), reason: z6.string(), doc: z6.string().optional() }))
+      decisionsChecked: z7.boolean(),
+      clean: z7.boolean(),
+      excludedChecks: z7.array(z7.object({ check: checkSchema, doc: z7.string() })).optional(),
+      issues: z7.array(issueSchema),
+      advisories: z7.array(advisorySchema),
+      suppressedAdvisories: z7.array(advisorySchema).optional(),
+      skippedChecks: z7.array(z7.object({ check: z7.string(), reason: z7.string(), doc: z7.string().optional() }))
     });
-    baselineSchema = z6.object({
-      kind: z6.literal("mason-audit-repair"),
-      version: z6.literal(1),
-      createdAt: z6.string().datetime(),
+    baselineSchema = z7.object({
+      kind: z7.literal("mason-audit-repair"),
+      version: z7.literal(1),
+      createdAt: z7.string().datetime(),
       report: reportSchema,
-      digest: z6.string().regex(/^[a-f0-9]{64}$/)
+      digest: z7.string().regex(/^[a-f0-9]{64}$/)
     });
-    repairFindingSchema = z6.object({
-      id: z6.string(),
-      original: z6.union([issueSchema, advisorySchema]),
-      status: z6.enum(["resolved", "unresolved", "review-required", "unverified"]),
-      reason: z6.string(),
-      current: z6.union([issueSchema, advisorySchema]).optional(),
+    repairFindingSchema = z7.object({
+      id: z7.string(),
+      original: z7.union([issueSchema, advisorySchema]),
+      status: z7.enum(["resolved", "unresolved", "review-required", "unverified"]),
+      reason: z7.string(),
+      current: z7.union([issueSchema, advisorySchema]).optional(),
       review: reviewSummarySchema.optional()
     });
   }
@@ -2804,7 +2825,7 @@ var init_repair = __esm({
 
 // src/audit/advisory-review.ts
 import fs11 from "fs/promises";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
   if (raw === null) return null;
@@ -3023,41 +3044,41 @@ var init_advisory_review = __esm({
     init_decisions();
     init_drift2();
     git2 = async (root, ...args) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args[0]) ? inspectionGit : execGit)(args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
-    hashSchema = z7.string().regex(/^[a-f0-9]{64}$/);
-    commitSchema2 = z7.string().regex(/^[a-f0-9]{40,64}$/);
-    evidenceSchema2 = z7.object({
+    hashSchema = z8.string().regex(/^[a-f0-9]{64}$/);
+    commitSchema2 = z8.string().regex(/^[a-f0-9]{40,64}$/);
+    evidenceSchema2 = z8.object({
       head: commitSchema2,
       fingerprint: hashSchema,
-      scope: z7.array(z7.string()).min(1).max(1e3),
-      tree: z7.string().max(2 * 1024 * 1024),
+      scope: z8.array(z8.string()).min(1).max(1e3),
+      tree: z8.string().max(2 * 1024 * 1024),
       lastScopeCommit: commitSchema2,
-      paths: z7.array(z7.object({ path: z7.string(), exists: z7.boolean() })).max(1e3)
+      paths: z8.array(z8.object({ path: z8.string(), exists: z8.boolean() })).max(1e3)
     });
-    dismissalReasonSchema = z7.enum(["no-dependency-claims", "unrelated-manifest-change"]);
-    eventSchema2 = z7.object({
-      at: z7.string().datetime(),
-      reviewer: z7.string().trim().min(1).max(200).optional(),
-      note: z7.string().trim().min(1).max(2500),
-      outcome: z7.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
+    dismissalReasonSchema = z8.enum(["no-dependency-claims", "unrelated-manifest-change"]);
+    eventSchema2 = z8.object({
+      at: z8.string().datetime(),
+      reviewer: z8.string().trim().min(1).max(200).optional(),
+      note: z8.string().trim().min(1).max(2500),
+      outcome: z8.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
       reasonCode: dismissalReasonSchema.optional(),
       finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
       evidence: evidenceSchema2
     });
-    recordSchema = z7.object({ version: z7.literal(1), id: hashSchema, events: z7.array(eventSchema2).min(1).max(200), digest: hashSchema });
-    reviewSummarySchema = z7.object({
+    recordSchema = z8.object({ version: z8.literal(1), id: hashSchema, events: z8.array(eventSchema2).min(1).max(200), digest: hashSchema });
+    reviewSummarySchema = z8.object({
       id: hashSchema,
-      status: z7.enum(["current", "reopened", "deferred", "unverified"]),
-      reason: z7.string(),
-      recordPath: z7.string().optional(),
-      reviewer: z7.string().optional(),
-      note: z7.string().optional(),
-      outcome: z7.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
-      reviewedHead: z7.string().optional()
+      status: z8.enum(["current", "reopened", "deferred", "unverified"]),
+      reason: z8.string(),
+      recordPath: z8.string().optional(),
+      reviewer: z8.string().optional(),
+      note: z8.string().optional(),
+      outcome: z8.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
+      reviewedHead: z8.string().optional()
     });
-    advisoryReviewRequest = z7.object({
-      baselinePath: z7.string().min(1),
+    advisoryReviewRequest = z8.object({
+      baselinePath: z8.string().min(1),
       findingId: hashSchema,
-      action: z7.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
+      action: z8.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
       reasonCode: dismissalReasonSchema.optional(),
       reviewer: eventSchema2.shape.reviewer.optional(),
       note: eventSchema2.shape.note.optional(),