testguard-cli 0.18.3 → 0.19.0

package/CHANGELOG.md

@@ -7,6 +7,95 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.19.0] - 2026-10-11
+
+Automated weekly release — everything merged since `v0.18.3`.
+
+### Changed
+
+- feat(automation): Google Jules routines with source-side backpressure (#207)
+- fix: keep project git hooks off the scratch tree; make the suite hermetic (#206)
+- fix: every defect the docs audit found — reuse, crashes, --python, init, CI templates (#210)
+- chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 (#209)
+- chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /fixtures/known-answer-playwright (#208)
+- docs: a full docs/ tree, slim README, translations, and tests that keep them true (#205)
+- chore(homebrew): sha256 for v0.18.3 (#204)
+
+
+### Security
+
+- GitHub Action: inputs reach the run step as environment variables instead of being pasted into the script, so a value containing quotes or `$(…)` is no longer executed as shell.
+- The `pip` wrapper's `npx` fallback runs the CLI version matching the installed wheel instead of `@latest`, and refuses rather than run an unpinned CLI when it cannot read its own version.
+
+### Fixed
+
+- **Verdict reuse:**
+  - A changed `--runner-cmd` invalidates reuse: the custom-command test universe hash binds the parsed command (only the hash is recorded, never the command).
+  - Reuse requires the same recorded runner (name, version, source).
+  - A record whose defenders failed to load is never reused, so fixing a broken environment always re-measures.
+- `run.runner.source` is recorded for every resolved runner (`project`, `path`, `builtin`), not only for `node-test`. Origin-policy freshness compares it too.
+- **Input errors no longer crash.** Each of these used to print "this is a bug in testguard" with a stack trace; now:
+  - A malformed `--runner-cmd` is a usage error (exit 3) on `probe`, `admit`, `sweep` and `replay`.
+  - `init --ci-evidence <anything but github|gitlab>` is a usage error (exit 3). It is checked before anything is written; it used to fail after installing the agent layer.
+  - An unparseable or wrongly shaped `.claude/settings.json` makes `init` exit 2, naming the file and the JSON error, with nothing written.
+  - A `testguard.concerns.json` that is not valid JSON or does not conform makes `concerns` and `sweep` exit 2, naming the file and the error. `sweep` used to aim at nothing and pass.
+- **`--python`:**
+  - A bare name such as `python3` is looked up on `PATH` instead of being resolved to `<cwd>/python3`. The same applies to `TESTGUARD_PYTHON` and `claims --check-anchors`.
+  - `admit`, `sweep` and `replay` now honour `--python`.
+- `baseline --json` prints a status document that validates. The `baseline` result is part of `status.schema.json` and is checked before printing.
+- **`init`:**
+  - It ignores `.testguard/sweep.json` and `.testguard/sweep-evidence.json`.
+  - Re-running it adds only missing lines inside the existing block, and nothing to a `.gitignore` that uses `.testguard/*`.
+  - Re-running it replaces any earlier TestGuard session-start hook in place, for the root and for subdirectory projects, and removes duplicates. A changed hook command no longer adds a second hook.
+- **`fetch-ci-evidence.sh`:**
+  - It finds the CLI the way the hook does (project, repo root, `PATH`) and works from any directory.
+  - It reads the evidence the Action and the GitLab template actually upload, including `<dir>/.testguard/evidence.json` for subdirectory projects.
+  - It never reads a leftover download.
+- The brief labels a CLI run from the npx, pnpm dlx or bunx cache as such, not as "local install".
+- **GitLab template:**
+  - Artifact paths include the `dir` input, so a project in a subdirectory keeps its gate, evidence and brief artifacts. The provisional evidence file is kept too.
+  - The install step no longer fails a project without an npm lockfile or a `package.json`.
+  - `GIT_DEPTH` and the template's variables are scoped to its own jobs instead of the whole pipeline.
+  - The header comment counts its jobs correctly.
+- GitHub Action: the `evidence` output names the file the run actually wrote (`evidence.json` or `evidence-provisional.json`), or is empty when nothing was written.
+- `gate --explain` lists `.py` among source extensions; the text is built from the gate's own list.
+- `probe --cost` rounds sub-second durations. The probe summary prints the baseline sentence on its own line.
+- **Contention warning:** it no longer tells an already-serial run to pass `--serial`. It advises waiting, lowering `--workers`, or the command's own concurrency, as fits the run.
+- **Help text:**
+  - `--json` is no longer promised to `mcp`.
+  - `replay` no longer shows sweep's shape lines, and shows the `--max` default and the `--changed` alias.
+  - `admit`, `sweep` and `replay` list `--runner`, `--runner-cmd`, `--node-modules` and `--python`.
+  - `--python` and `--serial` describe what they actually do.
+- `fixtures/known-answer-python/README.md` shows UNREACHED-001 as unverifiable (subject-not-executed), matching `expected.json`.
+- `probe` and `replay` no longer run the project's git hooks on their scratch tree. `git worktree add` and replay's revert of a fixed file both trigger `post-checkout`, so a failing hook (Git LFS's whenever `git-lfs` is not on PATH, a husky or lefthook script) failed a probe that would otherwise have succeeded, and a slow one slowed every run. Hooks are disabled for those two commands only; filters, LFS smudge included, still apply. Claimed as `TG-SCRATCH-NEVER-RUNS-PROJECT-HOOKS`.
+- The test suite no longer depends on the machine's global git config. Fixtures committed through it, so a global `core.hooksPath` or `commit.gpgsign=true` turned 142 tests red while CI stayed green. Fixtures now pin their own git options (`test/helpers/git.mjs`), and a new CI `hermeticity` job runs the suite under a deliberately hostile config. That job is what found the hook bug above.
+
+### Changed
+
+- `replay --calibration-out <path>` chooses where the calibration is written. The undocumented `replay --baseline` now exits 3 and names the new flag.
+- **`testguard.ignore.json`:**
+  - It no longer accepts `kind: "fingerprint"`, which nothing ever read; use a baseline.
+  - `claim` and `fault` patterns must be exact identities (`<claimId>`, `<claimId>/<faultId>`); a bare claim ID used to excuse a whole removed claim through a `fault` entry.
+  - `GATE-SEMANTICS.md` states that no ignore entry removes anything from a probe.
+- Schema errors on a closed list name the allowed values.
+- **GitLab template inputs are typed:**
+  - `no_escalate`, `strict` and `post_note` are `boolean`; `confirm` and `budget` are `number`.
+  - `severity` and `runner` declare their allowed values.
+  - Write switches unquoted (`post_note: true`).
+- The `runner` input descriptions in `action.yml` and the GitLab template list `node-test`.
+
+### Documentation
+
+- A `docs/` tree replaces the README-as-manual. It has a quickstart, installation for every channel, and an upgrade guide. Guides cover adopting TestGuard in an existing project, new projects, writing claims, AI agents, Python, monorepos, performance, replay, GitHub Actions, GitLab CI and pre-commit. Reference pages cover the CLI, languages and runners, configuration, verdicts, artifacts and MCP. There are also concepts, troubleshooting, FAQ and glossary pages. The README is now the front page and links into it with absolute URLs, so the links also work on npm and PyPI.
+- `test/docs.test.mjs` derives facts from the code and fails when a page is missing one: a CLI command, a `--runner` value, an Action or GitLab input, a verdict, a status state or a schema. It also fails on a broken relative link or heading anchor.
+- Release-sync now rewrites the version pins in the docs pages that show a pinned install, and in the `.pre-commit-hooks.yaml` consumer example (it read `v0.1.0`). A new test fails when any tracked file pins a release without being a sync surface.
+- Fixed stale facts: the README status section (v0.5, "eleven commands" without `concerns`) and the schema counts in the README and CONTRIBUTING (there are fourteen). PRIVACY now names the `pip` wrapper's `npx` fallback and the opt-in GitLab note.
+- Issue templates: a documentation template, and contact links to the docs, Discussions and private security advisories.
+- Translations of the README and quickstart into Português (Brasil), Español and 简体中文 under `docs/i18n/`. English is authoritative; each translation names the release it came from and copies every code block byte for byte, and tests check both. The translated READMEs are release-sync surfaces.
+- `spec/README.md` lists the `concerns` and `sweep` formats and no longer calls `authoring-input` CLI exposure pending. The exit-code table in `GATE-SEMANTICS.md` now sits under its own heading instead of under the origin-policy subsection.
+- The `init --ci-evidence` helper's "not installed" messages point at the CI guides instead of a README section that no longer exists. `.agents/skills/testguard/SKILL.md` matches the shipped template again, and a test keeps it that way.
+- Self-claim `TG-DOCS-COVER-THE-CLI`: a command or runner added without documentation is a fault `test/docs.test.mjs` kills.
+
 ## [0.18.3] - 2026-10-05
 
 Automated weekly release — everything merged since `v0.18.2`.