pm-starter 2026.8.17 → 2026.8.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +23 -0
  2. package/dist/index.js +1 -1
  3. package/manifest.json +2 -5
  4. package/package.json +10 -9
package/CHANGELOG.md CHANGED
@@ -1,5 +1,28 @@
1
1
  # Changelog
2
2
 
3
+ ## Unreleased
4
+
5
+ ### Fixed
6
+
7
+ - Close PR 82 attestation audit bypasses ([pm-starter-83vb](https://github.com/unbraind/pm-starter/blob/main/.agents/pm/issues/pm-starter-83vb.toon))
8
+ - The publish-attestation gate misses a publish routed through an unquoted shell variable ([pm-starter-74p9](https://github.com/unbraind/pm-starter/blob/main/.agents/pm/issues/pm-starter-74p9.toon))
9
+ - Fix same-line scalar assignment bypass in publish attestation scanner ([pm-starter-2899](https://github.com/unbraind/pm-starter/blob/main/.agents/pm/issues/pm-starter-2899.toon))
10
+
11
+ ## 2026.8.28 - 2026-08-28
12
+
13
+ ### Fixed
14
+
15
+ - A failed provenance publish silently falls back to an unattested one ([pm-starter-uxmy](https://github.com/unbraind/pm-starter/blob/main/.agents/pm/issues/pm-starter-uxmy.toon))
16
+ - changelog scripts read the workspace with default budgets, so pm-changelog refuses complete-read checks once the tracker exceeds one page ([pm-starter-ibm7](https://github.com/unbraind/pm-starter/blob/main/.agents/pm/issues/pm-starter-ibm7.toon))
17
+
18
+ ### Security
19
+
20
+ - The identity gate deadlocks the one remediation its own failure message prescribes ([pm-starter-tf19](https://github.com/unbraind/pm-starter/blob/main/.agents/pm/issues/pm-starter-tf19.toon))
21
+
22
+ ### Other
23
+
24
+ - Retire stale PR 65 evidence note after revert 67 ([pm-starter-pmnm](https://github.com/unbraind/pm-starter/blob/main/.agents/pm/tasks/pm-starter-pmnm.toon))
25
+
3
26
  ## 2026.8.16 - 2026-08-16
4
27
 
5
28
  ### Fixed
package/dist/index.js CHANGED
@@ -1136,7 +1136,7 @@ function setupFlags(api) {
1136
1136
  const defineExtension = (module) => module;
1137
1137
  export default defineExtension({
1138
1138
  name: "pm-starter",
1139
- version: "2026.8.17",
1139
+ version: "2026.8.29",
1140
1140
  activate(api) {
1141
1141
  // Register every capability group. Each helper is defensive enough to be
1142
1142
  // safely deleted when you fork this scaffold for a real extension.
package/manifest.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "pm-starter",
3
- "version": "2026.8.17",
3
+ "version": "2026.8.29",
4
4
  "description": "Complete scaffold showing all 9 capability types: commands, renderers, hooks, schema, importers, search, parser, preflight, services. Includes plan workflow, context, and search integration examples plus guided setup. Use as a starting template for new extensions.",
5
5
  "author": "@unbraind",
6
6
  "entry": "./dist/index.js",
@@ -16,8 +16,5 @@
16
16
  "parser",
17
17
  "preflight",
18
18
  "services"
19
- ],
20
- "pm": {
21
- "compatibility": "v2"
22
- }
19
+ ]
23
20
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "pm-starter",
3
- "version": "2026.8.17",
3
+ "version": "2026.8.29",
4
4
  "description": "Complete starter/scaffold extension for pm-cli showing all capability types",
5
5
  "repository": {
6
6
  "type": "git",
@@ -29,23 +29,24 @@
29
29
  "docstring": "node scripts/docstring-gate.ts",
30
30
  "audit:prod": "node --input-type=module -e \"import { spawnSync } from 'node:child_process'; import { devNull } from 'node:os'; const env = { ...process.env, npm_config_userconfig: devNull, NPM_CONFIG_USERCONFIG: devNull }; for (const key of Object.keys(env)) if (key.toLowerCase() === 'npm_config_allow_scripts') delete env[key]; const win = process.platform === 'win32'; const r = spawnSync(win ? 'npm.cmd' : 'npm', ['audit', '--omit=dev', '--ignore-scripts'], { stdio: 'inherit', env, shell: win }); process.exit(r.status ?? 1);\"",
31
31
  "pack:dry-run": "npm pack --dry-run",
32
- "changelog": "pm-changelog --pm-root .agents/pm --mode prepend --output CHANGELOG.md --release-version-from-package --since-previous-tag --until-release-tag --item-url-base https://github.com/unbraind/pm-starter/blob/main/.agents/pm --respect-item-release",
33
- "changelog:full": "pm-changelog --pm-root .agents/pm --mode replace --output CHANGELOG.md --all-release-tags --release-version-from-package --item-url-base https://github.com/unbraind/pm-starter/blob/main/.agents/pm --respect-item-release",
34
- "changelog:check": "pm-changelog --pm-root .agents/pm --mode replace --output CHANGELOG.md --all-release-tags --release-version-from-package --item-url-base https://github.com/unbraind/pm-starter/blob/main/.agents/pm --respect-item-release --check",
35
- "release:check": "npm run typecheck && npm run build && npm run docstring && npm run coverage && npm run audit:prod && npm run pack:dry-run && npm run changelog:check",
32
+ "changelog": "pm-changelog --pm-root .agents/pm --mode prepend --output CHANGELOG.md --release-version-from-package --since-previous-tag --until-release-tag --item-url-base https://github.com/unbraind/pm-starter/blob/main/.agents/pm --respect-item-release --date-from-version --pm-bin ./node_modules/.bin/pm --pm-arg=--output-budget --pm-arg=unbounded --pm-arg=--output-limit --pm-arg=unbounded",
33
+ "changelog:full": "pm-changelog --pm-root .agents/pm --mode replace --output CHANGELOG.md --all-release-tags --release-version-from-package --item-url-base https://github.com/unbraind/pm-starter/blob/main/.agents/pm --respect-item-release --date-from-version --pm-bin ./node_modules/.bin/pm --pm-arg=--output-budget --pm-arg=unbounded --pm-arg=--output-limit --pm-arg=unbounded",
34
+ "changelog:check": "pm-changelog --pm-root .agents/pm --mode replace --output CHANGELOG.md --all-release-tags --release-version-from-package --item-url-base https://github.com/unbraind/pm-starter/blob/main/.agents/pm --respect-item-release --date-from-version --check --pm-bin ./node_modules/.bin/pm --pm-arg=--output-budget --pm-arg=unbounded --pm-arg=--output-limit --pm-arg=unbounded",
35
+ "release:check": "npm run typecheck && npm run build && npm run docstring && npm run coverage && npm run audit:prod && npm run pack:dry-run && npm run changelog:check && npm run verify:release-publish-attestation",
36
36
  "prepublishOnly": "npm run release:check",
37
- "release:notes": "pm-changelog --pm-root .agents/pm --stdout --since-previous-tag --until-release-tag --release-version-from-package --item-url-base https://github.com/unbraind/pm-starter/blob/main/.agents/pm --respect-item-release --pm-bin ./node_modules/.bin/pm --github-step-summary",
37
+ "release:notes": "pm-changelog --pm-root .agents/pm --stdout --since-previous-tag --until-release-tag --release-version-from-package --date-from-version --item-url-base https://github.com/unbraind/pm-starter/blob/main/.agents/pm --respect-item-release --pm-bin ./node_modules/.bin/pm --pm-arg=--output-budget --pm-arg=unbounded --pm-arg=--output-limit --pm-arg=unbounded --github-step-summary",
38
38
  "prepare": "node scripts/prepare-merge-driver.mjs",
39
39
  "merge:install": "pm merge install",
40
- "coverage": "npm run build && npm run build:test && node scripts/coverage-gate.ts"
40
+ "coverage": "npm run build && npm run build:test && node scripts/coverage-gate.ts",
41
+ "verify:release-publish-attestation": "node scripts/verify-release-publish-attestation.ts"
41
42
  },
42
43
  "peerDependencies": {
43
44
  "@unbrained/pm-cli": ">=2026.8.15"
44
45
  },
45
46
  "devDependencies": {
46
47
  "@types/node": "^26.1.1",
47
- "@unbrained/pm-cli": "2026.8.15",
48
- "pm-changelog": "^2026.8.7",
48
+ "@unbrained/pm-cli": "2026.8.23",
49
+ "pm-changelog": "^2026.8.17",
49
50
  "pm-ops": "^2026.8.8",
50
51
  "typescript": "^7.0.2"
51
52
  },