trackfw 9.3.0 → 9.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +35 -29
  2. package/package.json +7 -7
package/README.md CHANGED
@@ -19,12 +19,12 @@ ADR → REQ → ROADMAP → backlog / wip / blocked / done / abandoned
19
19
  Every piece of work traces back to a decision. Every decision links to a requirement. Every requirement lands in a roadmap. No orphan work, no undocumented choices.
20
20
 
21
21
  > 🚧 **Platform support: Linux and macOS are supported. Windows support is partial.**
22
- > The CLIs install on Windows and core governance commands run. From the next release,
23
- > guard hooks call `trackfw guard <name>` (the Go binary) instead of a POSIX shell
24
- > script — measured blocking and allowing correctly in PowerShell 5, cmd.exe, and Git
25
- > Bash (non-login) on Windows. Windows CI still reports known test failures. There are
26
- > limits worth knowing; **read [Windows support (partial)](#windows-support-partial)
27
- > before adopting on Windows.**
22
+ > The CLIs install on Windows and core governance commands run. Since v9.3.0, guard
23
+ > hooks call `trackfw guard <name>` (the Go binary) instead of a POSIX shell script —
24
+ > measured blocking and allowing correctly in PowerShell 5, cmd.exe, and Git Bash on
25
+ > Windows; Claude Code and Codex CLI proven end-to-end. Windows CI still reports known
26
+ > test failures. There are limits worth knowing; **read
27
+ > [Windows support (partial)](#windows-support-partial) before adopting on Windows.**
28
28
 
29
29
  ---
30
30
 
@@ -112,14 +112,17 @@ declaration.
112
112
 
113
113
  Shared behavior follows the [command contract](docs/cli-parity.md).
114
114
 
115
- > **The CLI installs on Node ≥ 18 alone — the generated guard hooks do not run on
116
- > Node alone.** They are POSIX shell scripts and need a POSIX shell to execute. On
117
- > Windows, see [Windows support](#windows-support-partial) before relying on them.
115
+ > **The npm package delivers the same Go binary, and the guard hooks run it from `PATH`.**
116
+ > Since v9.3.0, hooks call `trackfw guard <name>` directly; no POSIX shell is needed. On
117
+ > Windows, the npm shim is a `.ps1` that PowerShell's `ExecutionPolicy Restricted` blocks —
118
+ > see [Windows support](#windows-support-partial) before relying on the hooks.
118
119
 
119
120
  ### Windows support (partial)
120
121
 
121
- 🚧 **Windows support is partial. Native Windows hooks are planned but not yet being
122
- worked on. Read this before adopting `trackfw` on Windows.**
122
+ 🚧 **Windows support is partial. Read this before adopting `trackfw` on Windows.**
123
+
124
+ Since v9.3.0, guard hooks call `trackfw guard <name>` (the Go binary) and run on
125
+ Windows. Windows CI still reports known test failures mapped by root cause.
123
126
 
124
127
  We publish a Windows binary and the npm/pip packages install on Windows. That is not
125
128
  the same as the tool working end to end, and we would rather tell you where the edges
@@ -138,31 +141,34 @@ are than let you find them after adoption.
138
141
 
139
142
  - Our Windows CI still reports **known test failures**. They are mapped by root cause,
140
143
  not unknown — but they are not zero.
141
- **Guard hooks on Windows — measured state (from the next release)**
144
+ **Guard hooks on Windows — measured state (since v9.3.0)**
142
145
 
143
- From the next release, guard hooks call `trackfw guard <name>` (the Go binary) instead
144
- of a `.sh` script. The same binary runs in every shell; for a given agent CLI, the hook
146
+ Since v9.3.0, guard hooks call `trackfw guard <name>` (the Go binary) instead of a
147
+ `.sh` script. The same binary runs in every shell; for a given agent CLI, the hook
145
148
  line in the committed config is the same string across PowerShell, cmd.exe, and Git
146
149
  Bash — a team with mixed OS can commit one config and have it work on all machines.
147
150
 
148
151
  The hook line emitted depends on the shell the agent CLI uses on Windows — a fact of
149
152
  the vendor, not of the OS:
150
153
 
151
- | Agent CLI | Shell on Windows | Hook line emitted | Basis |
154
+ | Agent CLI | Shell on Windows | Hook line emitted (D11, ML-6B) | Basis |
152
155
  |---|---|---|---|
153
- | Claude Code | Git Bash (if installed), else PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor docs (2026-10-04) |
154
- | Codex CLI | PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor source (2026-10-04) |
155
- | Gemini CLI | PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor source (2026-10-04) |
156
- | Cursor | PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor bundle (2026-09-06) |
157
- | Windsurf | PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor docs (2026-10-04) |
158
- | GitHub Copilot | PowerShell / cross-platform `command` field | `trackfw guard <name>; exit $LASTEXITCODE` | vendor docs (2026-10-04) |
159
- | Kiro | cmd.exe | `trackfw guard <name>` | vendor docs (2026-10-04) |
160
- | Amazon Q | cmd.exe | `trackfw guard <name>` | vendor source (2026-10-04) |
161
-
162
- The `; exit $LASTEXITCODE` suffix is required for PowerShell 5: without it, PowerShell
163
- converts exit 2 (deny) from the child process into exit 1, and 6 of 8 CLIs treat exit 1
164
- as a non-blocking error. cmd.exe and bash propagate the exit code directly; they do not
165
- need the suffix.
156
+ | Claude Code | Git Bash (if installed), else PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor docs (2026-10-04) |
157
+ | Codex CLI | PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor source (2026-10-04) |
158
+ | Gemini CLI | PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor source (2026-10-04) |
159
+ | Cursor | PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor bundle (2026-09-06) |
160
+ | Windsurf | PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor docs (2026-10-04) |
161
+ | GitHub Copilot | PowerShell / cross-platform `command` field | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor docs (2026-10-04) |
162
+ | Kiro | cmd.exe | `trackfw guard <name> \|\| exit 2` | vendor docs (2026-10-04) |
163
+ | Amazon Q | cmd.exe | `trackfw guard <name> \|\| exit 2` | vendor source (2026-10-04) |
164
+
165
+ The D11 line (ML-6B, issue #535) is **fail-closed**: if `trackfw` is absent from `PATH`,
166
+ the hook exits with code 2 instead of 0. The seed `$LASTEXITCODE=2` is a PowerShell
167
+ automatic-variable assignment; in sh/bash the resulting `=2: command not found` error is
168
+ silently discarded by `2>${null-/dev/null}` (where `${null-/dev/null}` expands to
169
+ `/dev/null` via bash parameter expansion, and to nothing in PowerShell). When the binary is
170
+ absent, `LASTEXITCODE=$((2*!!$?))` normalizes any non-zero exit to 2; when the guard
171
+ succeeds, it normalizes to 0. For cmd.exe: `|| exit 2` is the native short-circuit.
166
172
 
167
173
  **What was measured in the VM (Windows 11 ARM64, 2026-10-06):** PowerShell 5, cmd.exe,
168
174
  and Git Bash (non-login, explicit PATH to the branch binary) all block
@@ -192,7 +198,7 @@ Code names the tool `Bash`) and Windows (where it names it `PowerShell`). Run
192
198
  through Git Bash (login shell), whose login profile puts `~/bin` at the front of `PATH`.
193
199
  If an older trackfw binary (without the `guard` subcommand) lives in `~/bin`, the hook
194
200
  exits 1 ("unknown command") and fails open on most CLIs — remove or update that binary.
195
- `trackfw validate` will report this condition from the next release.
201
+ Since v9.3.0, `trackfw validate` reports this condition.
196
202
 
197
203
  **The guard requires a `trackfw` binary with the `guard` subcommand in the PATH of the
198
204
  agent CLI's process.** `trackfw validate` now reports three new conditions:
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "trackfw",
3
- "version": "9.3.0",
3
+ "version": "9.3.2",
4
4
  "description": "Governance CLI for AI-native software delivery and AI coding agents. Enforces traceability: ADR → REQ → ROADMAP → kanban. Native support for Codex, Claude Code, Gemini CLI, Cursor, Copilot, Windsurf, Amazon Q, OpenCode, and Kiro.",
5
5
  "keywords": [
6
6
  "cli",
@@ -63,11 +63,11 @@
63
63
  "node": ">=18"
64
64
  },
65
65
  "optionalDependencies": {
66
- "@trackfw-bin/darwin-arm64": "9.3.0",
67
- "@trackfw-bin/darwin-x64": "9.3.0",
68
- "@trackfw-bin/linux-arm64": "9.3.0",
69
- "@trackfw-bin/linux-x64": "9.3.0",
70
- "@trackfw-bin/win32-arm64": "9.3.0",
71
- "@trackfw-bin/win32-x64": "9.3.0"
66
+ "@trackfw-bin/darwin-arm64": "9.3.2",
67
+ "@trackfw-bin/darwin-x64": "9.3.2",
68
+ "@trackfw-bin/linux-arm64": "9.3.2",
69
+ "@trackfw-bin/linux-x64": "9.3.2",
70
+ "@trackfw-bin/win32-arm64": "9.3.2",
71
+ "@trackfw-bin/win32-x64": "9.3.2"
72
72
  }
73
73
  }