prjct-cli 2.37.4 → 2.37.6

package/CHANGELOG.md

@@ -2,7 +2,30 @@
 
 ## [Unreleased]
 
-## [2.37.4] - 2026-06-01
+## [2.37.6] - 2026-06-01
+
+Code-health pass (clean-code batch from the optimization audit).
+
+### Changed
+- **Dropped the `date-fns` dependency.** `toRelative()` (its only use) now uses the built-in `Intl.RelativeTimeFormat` — identical output, one fewer dependency, smaller bundle, and aligned with the zero-dependency posture. Works on Bun and Node alike.
+- **De-duplicated `execFileAsync`.** Four services each re-promisified `execFile` locally; they now import the shared `core/utils/exec` helper (single source, no drift).
+- **Hardened DB enum reads.** `workflow-rule-storage` and `context-zone-storage` validated stored enum strings via raw `as` casts; they now validate against the allowed set and fall back to a safe default (the pattern `spec-storage` already used), so a stale/renamed DB value can't propagate a bad union member.
+- **Fixed a silently-swallowed error in the file scanner.** `files-tool` had a `// Log but continue` comment with no actual log; non-ENOENT errors (e.g. EACCES) are now debug-logged so "scan found 0 files" is diagnosable. Still never fatal.
+
+Verified not a risk (audit follow-up): `prepare: lefthook install` does not run on registry installs (`npm/bun -g`) — it's dev-only, so it doesn't violate the no-install-time-scripts constraint.
+
+Robustness sweep: close an entire class of "works in the terminal, broken via the daemon" bugs — and add a test so it can't come back.
+
+### Fixed
+- **Commands silently dropped their flags when run through the daemon.** A command whose cold handler (`core/index.ts`) reads option flags but has no explicit `case` in the daemon dispatcher fell through to the option-less registry path, dropping every flag. Beyond `embeddings` (fixed in 2.37.3), this hit:
+  - `prjct capture "…" --tags … --force` — tags and the secret-override were dropped (an explicit `capture` is registered, so it skipped the unknown-verb auto-route and fell through).
+  - `prjct init --pack … --persona … --yes` — onboarding pack/persona selection was ignored.
+  - `prjct regen --md` — agents got non-md output.
+  - `prjct login --url …`, `prjct logout`, `prjct auth` — flags/args dropped.
+  Each now has an explicit dispatch case mirroring the cold path (and `init` correctly uses the request's cwd, not the daemon's).
+
+### Internal
+- New `dispatch-option-parity.test.ts`: every option-bearing cold command must be either cold-handled (`_binCommands`) or explicitly cased in the daemon dispatcher. CI now fails if a future option-taking command reintroduces this drift.
 
 Hot-path performance (batch 2 from the optimization audit) — the UserPromptSubmit hook fires on every prompt and blocks context injection, so its DB work is the most worth trimming.