paqad-ai 1.22.0 → 1.22.2

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # paqad-ai
 
+## 1.22.2
+
+### Patch Changes
+
+- [#177](https://github.com/Eliyce/paqad-ai/pull/177) [`ea8c367`](https://github.com/Eliyce/paqad-ai/commit/ea8c36722c84ac82c486e5dbaf9dad0cc9d9bac5) Thanks [@HLasani](https://github.com/HLasani)! - Fix the AI bill of materials on the dashboard.
+
+  Two problems made the BOM unreadable. First, `git status --short` parsing left-trimmed each line before slicing the status columns, which dropped the first character of every worktree-only changed path (`package.json` became `ackage.json`). That corrupted the BOM component names, their file digests, and the change-completeness gate messages. Second, the dashboard BOM panel only showed a file count, never the files themselves. The panel now lists every attested file with its SHA-256 digest, and shows a clear empty state when the latest verified change touched no files.
+
+- [#177](https://github.com/Eliyce/paqad-ai/pull/177) [`ea8c367`](https://github.com/Eliyce/paqad-ai/commit/ea8c36722c84ac82c486e5dbaf9dad0cc9d9bac5) Thanks [@HLasani](https://github.com/HLasani)! - Restore the executable bit on the installed runtime hooks and scripts.
+
+  The package is published with `changeset publish`, which packs the tarball with pnpm. pnpm normalises every file mode to `0644` and drops the executable bit (npm preserves it), so on an installed copy the host agent could not run any runtime hook: invoking `~/.paqad-ai/current/hooks/verification-completion.mjs` failed with "permission denied". The visible symptom was that the verification backstop never fired for onboarded projects, so the evidence ledger, receipts, AI-BOM, and the local dashboard data were never produced. A `postinstall` step now re-adds the executable bit on every install and update, with no action required from the user.
+
+## 1.22.1
+
+### Patch Changes
+
+- [#174](https://github.com/Eliyce/paqad-ai/pull/174) [`8ad856b`](https://github.com/Eliyce/paqad-ai/commit/8ad856b5c02d7a32ccc7113aa811f2777a5e3985) Thanks [@HLasani](https://github.com/HLasani)! - Collapse the in-chat narration contract in provider entry files to a one-line pointer ([#173](https://github.com/Eliyce/paqad-ai/issues/173)). The full voice spec stays in the canonical `.paqad/narration-contract.md`; the entry files (CLAUDE.md, AGENTS.md, and every adapter) now carry only the heading plus a pointer line, matching the Decision Pause Contract shape. `paqad refresh --providers` rewrites already-onboarded projects down to the pointer.
+
 ## 1.22.0
 
 ### Minor Changes

package/dist/cli/index.js

@@ -7486,72 +7486,6 @@ var TemplateEngine = class {
 // src/adapters/shared/narration-contract.ts
 init_esm_shims();
 
-// src/core/constants/paqad-voice.ts
-init_esm_shims();
-var PAQAD_STATUS_GLYPH = {
-  /** Passed, good, on track. */
-  good: "\u{1F7E2}",
-  /** Failed, blocking. */
-  failed: "\u{1F534}",
-  /** Inconclusive, needs a look, over-trust risk. */
-  needsLook: "\u{1F7E1}",
-  /** Not run, not applicable. */
-  skipped: "\u26AA"
-};
-var PAQAD_STATUS_LABEL = {
-  good: "good",
-  failed: "failed",
-  needsLook: "needs a look",
-  skipped: "skipped"
-};
-var PAQAD_VERDICT = {
-  pass: "Safe to merge",
-  fail: "Needs your attention",
-  inconclusive: "Inconclusive"
-};
-var PAQAD_FRAME_LEAD = "**\u25B8 paqad**";
-var PAQAD_FRAME_SEP = "\xB7";
-function paqadFrameLead(label) {
-  return `${PAQAD_FRAME_LEAD} ${PAQAD_FRAME_SEP} ${label}`;
-}
-function paqadGlyphLegend() {
-  return Object.keys(PAQAD_STATUS_GLYPH).map((kind) => `${PAQAD_STATUS_GLYPH[kind]} ${PAQAD_STATUS_LABEL[kind]}`).join(` ${PAQAD_FRAME_SEP} `);
-}
-var PAQAD_TERM_TRANSLATIONS = [
-  {
-    term: "classification",
-    plain: "I read your request and judged how risky it is."
-  },
-  {
-    term: "lane / routing",
-    plain: "I picked the path: a quick path for small changes, the full path (spec \u2192 build \u2192 verify) for risky ones."
-  },
-  {
-    term: "requirement derivation",
-    plain: "I worked out what this actually needs to do before building it."
-  },
-  {
-    term: "verification gates",
-    plain: "I ran the safety checks for you before calling this done."
-  },
-  {
-    term: "mutation testing",
-    plain: "I double-checked your tests actually catch bugs, not just run."
-  },
-  {
-    term: "quality ratchet",
-    plain: "I made sure nothing slipped below the quality bar you'd already set."
-  },
-  {
-    term: "traceability",
-    plain: "I tied each requirement to the test that proves it."
-  },
-  {
-    term: "decision pause",
-    plain: "I hit a real choice that's yours to make, so I stopped to ask."
-  }
-];
-
 // src/adapters/shared/provider-entry-contract.ts
 init_esm_shims();
 
@@ -7605,27 +7539,6 @@ var POINTER_BODY2 = "See `.paqad/narration-contract.md` for the full voice spec,
 function buildNarrationContractSection() {
   return `${HEADING}
 
-paqad runs the orchestration behind your agent: it classifies the request, routes it to a lane, derives the requirements, runs the verification gates, and holds the quality ratchet. Make that work visible so the developer feels the layer working for them. Speak as paqad \u2014 first person, addressed to the developer \u2014 not as the model narrating itself.
-
-Speak only at substantive transitions, never on every line:
-
-- **Handshake (once per session):** name paqad and frame it as the layer in charge. This is the one full-name anchor.
-- **On a real decision:** when you classify, pick a lane, derive requirements, or run/skip a gate. One compact line \u2014 the proactive choice you made, not an echo of the prompt.
-- **On a verdict:** when verification, mutation, or the quality ratchet produces a result, especially a problem you caught. Honest and plain.
-- **On a pause:** when the Decision Pause Contract fires.
-
-Voice: first person, framing the work as done on the developer's behalf ("checked for you", "caught this before it shipped"). Translate every internal term to plain language \u2014 no jargon. Be honest on bad outcomes: never dress up a failure, and surface caught problems as prominently as green checks so trust stays calibrated, never inflated. Name "paqad" about once per session plus once per genuinely valuable verdict; everywhere else let the status frame below carry the recognition.
-
-Format \u2014 a markdown status block. Rely on markdown structure (headings, bold, blockquotes, task lists, emoji), never ANSI colour, and keep every line legible with the glyphs stripped:
-
-\`\`\`
-${paqadFrameLead("<short label>")}
-> One plain sentence, on the developer's behalf.
-> - \u{1F7E2} a status line \u2014 the words carry the meaning, the glyph only reinforces it
-\`\`\`
-
-Status glyphs carry fixed, reserved meaning, reused from the paqad evidence comment: ${paqadGlyphLegend()}.
-
 ${POINTER_BODY2}`;
 }
 function extractNarrationContractSection(content) {
@@ -24579,6 +24492,71 @@ function writeDecisionPauseContractDocument(projectRoot) {
 init_esm_shims();
 init_paths();
 import { join as join80 } from "path";
+
+// src/core/constants/paqad-voice.ts
+init_esm_shims();
+var PAQAD_STATUS_GLYPH = {
+  /** Passed, good, on track. */
+  good: "\u{1F7E2}",
+  /** Failed, blocking. */
+  failed: "\u{1F534}",
+  /** Inconclusive, needs a look, over-trust risk. */
+  needsLook: "\u{1F7E1}",
+  /** Not run, not applicable. */
+  skipped: "\u26AA"
+};
+var PAQAD_STATUS_LABEL = {
+  good: "good",
+  failed: "failed",
+  needsLook: "needs a look",
+  skipped: "skipped"
+};
+var PAQAD_VERDICT = {
+  pass: "Safe to merge",
+  fail: "Needs your attention",
+  inconclusive: "Inconclusive"
+};
+var PAQAD_FRAME_LEAD = "**\u25B8 paqad**";
+var PAQAD_FRAME_SEP = "\xB7";
+function paqadFrameLead(label) {
+  return `${PAQAD_FRAME_LEAD} ${PAQAD_FRAME_SEP} ${label}`;
+}
+var PAQAD_TERM_TRANSLATIONS = [
+  {
+    term: "classification",
+    plain: "I read your request and judged how risky it is."
+  },
+  {
+    term: "lane / routing",
+    plain: "I picked the path: a quick path for small changes, the full path (spec \u2192 build \u2192 verify) for risky ones."
+  },
+  {
+    term: "requirement derivation",
+    plain: "I worked out what this actually needs to do before building it."
+  },
+  {
+    term: "verification gates",
+    plain: "I ran the safety checks for you before calling this done."
+  },
+  {
+    term: "mutation testing",
+    plain: "I double-checked your tests actually catch bugs, not just run."
+  },
+  {
+    term: "quality ratchet",
+    plain: "I made sure nothing slipped below the quality bar you'd already set."
+  },
+  {
+    term: "traceability",
+    plain: "I tied each requirement to the test that proves it."
+  },
+  {
+    term: "decision pause",
+    plain: "I hit a real choice that's yours to make, so I stopped to ask."
+  }
+];
+
+// src/onboarding/narration-contract-writer.ts
 function buildNarrationContractDocument() {
   const glyphRows = Object.keys(PAQAD_STATUS_GLYPH).map((kind) => `| ${PAQAD_STATUS_GLYPH[kind]} | ${PAQAD_STATUS_LABEL[kind]} |`).join("\n");
   const translationRows = PAQAD_TERM_TRANSLATIONS.map((t) => `| ${t.term} | ${t.plain} |`).join(
@@ -24590,7 +24568,7 @@ function buildNarrationContractDocument() {
 
 paqad runs the orchestration behind the coding agent \u2014 classifying the request, routing it to a lane, deriving requirements, running the verification gates, holding the quality ratchet, writing the evidence ledger. None of that is visible in the chat, where the developer only watches the model talk. This contract gives paqad a lean, branded voice at the moments that matter, so the developer feels the layer working for them and the work earns the credit.
 
-This is the canonical, full spec. A lean copy of the operative rules is rendered into every provider entry file so the agent has them in context every turn; the complete detail lives here.
+This is the canonical, full spec. Every provider entry file carries a one-line pointer to this document; the complete detail lives here.
 
 ## When paqad speaks (cadence)
 
@@ -27122,18 +27100,21 @@ async function readGitStatusFiles(projectRoot) {
       return [];
     }
     return normalizePaths(
-      result.stdout.split("\n").map((line) => line.trim()).filter(Boolean).map(parseGitStatusPath).filter((value) => value !== null)
+      result.stdout.split("\n").map(parseGitStatusPath).filter((value) => value !== null)
     );
   } catch {
     return [];
   }
 }
 function parseGitStatusPath(line) {
-  const trimmed = line.trim();
-  if (trimmed.length < 4) {
+  const stripped = line.replace(/\r$/, "");
+  if (stripped.length < 4) {
+    return null;
+  }
+  const payload = stripped.slice(3).trim();
+  if (payload.length === 0) {
     return null;
   }
-  const payload = trimmed.slice(3).trim();
   if (payload.includes(" -> ")) {
     return (
       /* v8 ignore next */
@@ -35055,7 +35036,7 @@ init_esm_shims();
 init_esm_shims();
 
 // src/index.ts
-var VERSION = "1.22.0";
+var VERSION = "1.22.2";
 
 // src/cli/commands/audit.ts
 init_esm_shims();