paqad-ai 1.22.1 → 1.22.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # paqad-ai
 
+## 1.22.2
+
+### Patch Changes
+
+- [#177](https://github.com/Eliyce/paqad-ai/pull/177) [`ea8c367`](https://github.com/Eliyce/paqad-ai/commit/ea8c36722c84ac82c486e5dbaf9dad0cc9d9bac5) Thanks [@HLasani](https://github.com/HLasani)! - Fix the AI bill of materials on the dashboard.
+
+  Two problems made the BOM unreadable. First, `git status --short` parsing left-trimmed each line before slicing the status columns, which dropped the first character of every worktree-only changed path (`package.json` became `ackage.json`). That corrupted the BOM component names, their file digests, and the change-completeness gate messages. Second, the dashboard BOM panel only showed a file count, never the files themselves. The panel now lists every attested file with its SHA-256 digest, and shows a clear empty state when the latest verified change touched no files.
+
+- [#177](https://github.com/Eliyce/paqad-ai/pull/177) [`ea8c367`](https://github.com/Eliyce/paqad-ai/commit/ea8c36722c84ac82c486e5dbaf9dad0cc9d9bac5) Thanks [@HLasani](https://github.com/HLasani)! - Restore the executable bit on the installed runtime hooks and scripts.
+
+  The package is published with `changeset publish`, which packs the tarball with pnpm. pnpm normalises every file mode to `0644` and drops the executable bit (npm preserves it), so on an installed copy the host agent could not run any runtime hook: invoking `~/.paqad-ai/current/hooks/verification-completion.mjs` failed with "permission denied". The visible symptom was that the verification backstop never fired for onboarded projects, so the evidence ledger, receipts, AI-BOM, and the local dashboard data were never produced. A `postinstall` step now re-adds the executable bit on every install and update, with no action required from the user.
+
 ## 1.22.1
 
 ### Patch Changes

package/dist/cli/index.js

@@ -27100,18 +27100,21 @@ async function readGitStatusFiles(projectRoot) {
       return [];
     }
     return normalizePaths(
-      result.stdout.split("\n").map((line) => line.trim()).filter(Boolean).map(parseGitStatusPath).filter((value) => value !== null)
+      result.stdout.split("\n").map(parseGitStatusPath).filter((value) => value !== null)
     );
   } catch {
     return [];
   }
 }
 function parseGitStatusPath(line) {
-  const trimmed = line.trim();
-  if (trimmed.length < 4) {
+  const stripped = line.replace(/\r$/, "");
+  if (stripped.length < 4) {
+    return null;
+  }
+  const payload = stripped.slice(3).trim();
+  if (payload.length === 0) {
     return null;
   }
-  const payload = trimmed.slice(3).trim();
   if (payload.includes(" -> ")) {
     return (
       /* v8 ignore next */
@@ -35033,7 +35036,7 @@ init_esm_shims();
 init_esm_shims();
 
 // src/index.ts
-var VERSION = "1.22.1";
+var VERSION = "1.22.2";
 
 // src/cli/commands/audit.ts
 init_esm_shims();