qa360 2.2.1 → 2.2.7

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to QA360 will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+---
+
+## ⚠️ BROKEN VERSIONS - DO NOT USE
+
+| Version | Status | Issue | Fixed In |
+|---------|--------|-------|----------|
+| **2.2.4** | 🔴 BROKEN | Published without CI check (CI was failing) | 2.2.6 |
+| **2.2.5** | 🔴 BROKEN | Published without bundle script - missing `cli/dist/core/` | 2.2.6 |
+
+**Use version 2.2.6 or later instead.**
+
+---
+
+## [2.2.6] - 2025-01-18
+
+### Fixed
+- **Critical bundle fix**: Re-ran bundle script correctly before publication
+  - `cli/dist/core/` now contains the bundled core engine
+  - Imports correctly use `../core/index.js` instead of `qa360-core`
+  - Package installation now works correctly
+- **Recovery**: This version fixes the broken 2.2.4 and 2.2.5 releases
+
+### Added
+- **npm Publication Workflow section** in README with mandatory checklist
+- Documented fatal mistakes from 2.2.4 and 2.2.5 to prevent recurrence
+
+---
+
 ## Versioning Convention
 
 QA360 uses **Node.js-style versioning** (Major.Minor.Patch).

package/README.md

@@ -215,6 +215,85 @@ QA360 Core is developed in structured phases:
 - **Phase 8**: ✅ TUI & Dashboard (COMPLETE)
 - **Phase 9**: ⏳ Parallel CI → consolidated proof
 
+## 🚢 npm Publication Workflow (CRITICAL)
+
+> **⚠️ WARNING: Publishing broken packages damages user trust permanently.**
+
+### Mandatory Pre-Publication Checklist
+
+**NEVER skip these steps - versions 2.2.4 and 2.2.5 were broken due to skipping these:**
+
+1. ✅ **CI MUST be green** on both `develop` AND `main`
+2. ✅ **Run bundle script**: `cd cli && bash scripts/bundle-for-npm.sh`
+3. ✅ **Test with npm pack**: `npm pack && tar -tzf qa360-*.tgz | grep "cli/dist/core/index.js"`
+4. ✅ **Test installation**: `cd /tmp && npm install -g ./qa360-*.tgz && qa360 --version`
+5. ✅ **Get EXPLICIT authorization** from maintainer before publishing
+6. ✅ **Publish from MAIN branch only** - NEVER from `develop`
+
+### The Fatal Mistakes (DO NOT REPEAT)
+
+| Version | Mistake | Result |
+|---------|---------|--------|
+| **2.2.4** | Published without CI check | CI was failing - broken package |
+| **2.2.5** | Published without bundle script | Missing `cli/dist/core/` - completely broken |
+| **2.2.6** | Followed full checklist | ✅ Working package |
+
+### Correct Publication Workflow
+
+```bash
+# 1. Verify CI is green
+gh run list --branch develop --limit 1
+gh run list --branch main --limit 1
+
+# 2. Merge develop to main
+git checkout main
+git merge develop --no-ff
+git push origin main
+
+# 3. Wait for CI to pass on main
+gh run watch --branch main
+
+# 4. CREATE THE BUNDLE (THIS IS CRITICAL)
+cd cli
+bash scripts/bundle-for-npm.sh
+cd ..
+
+# 5. Verify bundle was created
+ls -la cli/dist/core/index.js  # Must exist
+grep "from '../core/index.js'" cli/dist/commands/ai.js  # Must show this, NOT qa360-core
+
+# 6. Test the package locally
+npm pack
+tar -tzf qa360-*.tgz | grep "cli/dist/core/index.js"  # Must exist
+cd /tmp && npm install -g /path/to/qa360-*.tgz && qa360 --version
+
+# 7. ONLY AFTER ALL TESTS PASS: Get authorization, then publish
+npm version patch  # or minor/major
+npm publish --access public
+git push origin main --tags
+
+# 8. ALWAYS return to develop
+git checkout develop
+```
+
+### Why the Bundle Script Is Critical
+
+The bundle script (`cli/scripts/bundle-for-npm.sh`) does:
+1. Copies `core/src/*` into `cli/src/core/`
+2. Changes imports from `'qa360-core'` to `'../core/index.js'`
+3. Builds TypeScript → `cli/dist/`
+4. **Result**: `cli/dist/core/` contains the bundled core engine
+
+**Without this step**: The CLI imports `'qa360-core'` which doesn't exist in the npm package → **COMPLETELY BROKEN**
+
+### Recovery from Broken Publication
+
+If a broken version is published:
+1. **Fix the issue** on `develop`
+2. **Follow the FULL checklist** above
+3. **Publish a patch version** (e.g., 2.2.5 → 2.2.6)
+4. **Add a warning** in CHANGELOG about broken versions
+
 ## 🛠️ Technology Stack
 
 - **Runtime**: Node.js 18+ with TypeScript 5+

package/cli/dist/cli-minimal.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/**
+ * QA360 CLI - Minimal version for E2E tests
+ * Only includes doctor and verify commands
+ */
+export {};

package/cli/dist/cli-minimal.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+/**
+ * QA360 CLI - Minimal version for E2E tests
+ * Only includes doctor and verify commands
+ */
+import { Command } from 'commander';
+import { doctorCommand } from './commands/doctor.js';
+import { verifyCommand } from './commands/verify.js';
+const program = new Command();
+program
+    .name('qa360')
+    .description('QA360 Proof Bundle CLI')
+    .version('1.0.1');
+program
+    .command('doctor')
+    .description('Health check and auto-fix issues')
+    .option('--fix', 'Automatically fix detected issues')
+    .option('--json', 'Output results as JSON')
+    .option('--strict', 'Exit with code 1 on any error')
+    .action(async (options) => {
+    await doctorCommand(options);
+});
+program
+    .command('verify [proof]')
+    .description('Verify proof authenticity and integrity')
+    .option('--json', 'Output results as JSON')
+    .option('--verbose', 'Show detailed verification information')
+    .action(async (proof, options) => {
+    await verifyCommand(proof, options);
+});
+// Parse arguments (no banner for clean JSON output)
+program.parse();
+// Show help if no command provided
+if (!process.argv.slice(2).length) {
+    program.outputHelp();
+}

package/cli/dist/commands/ai.d.ts

@@ -0,0 +1,43 @@
+/**
+ * QA360 AI Command
+ *
+ * Manage AI provider integration for test generation.
+ * Supports DeepSeek, Ollama, OpenAI, Anthropic with automatic selection.
+ *
+ * DeepSeek is recommended for best value (GPT-4 level at 95% lower cost).
+ */
+import { Command } from 'commander';
+/**
+ * List all available AI providers
+ */
+export declare function aiListCommand(): Promise<void>;
+/**
+ * Use a specific AI provider
+ */
+export declare function aiUseCommand(provider: string, options?: {
+    verify?: boolean;
+}): Promise<void>;
+/**
+ * Benchmark all available providers
+ */
+export declare function aiBenchmarkCommand(options?: {
+    prompt?: string;
+}): Promise<void>;
+/**
+ * Generate tests using the best available provider
+ */
+export declare function aiGenerateCommand(prompt: string, options?: {
+    provider?: string;
+    type?: string;
+    json?: boolean;
+    pack?: boolean;
+    output?: string;
+}): Promise<void>;
+/**
+ * Show AI configuration
+ */
+export declare function aiConfigCommand(): Promise<void>;
+/**
+ * Create AI commands
+ */
+export declare function createAICommands(): Command;