triss-coworker 0.41.0 → 0.41.1

package/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.41.1] — 2026-08-29
+
+### Fixed
+
+- Passive CLI and MCP update checks now allow five seconds for GitHub Release
+  redirects and manifest delivery, preventing persistent timeout backoff from
+  suppressing update notifications on ordinary network connections.
+
+### Changed
+
+- `triss-dsh-provider-bundle` is version-aligned and republished unchanged;
+  its OpenCode Zen, OpenCode Go, and Z.AI routes are unchanged.
+
+### Artifact integrity (0.41.1)
+
+- `triss-dsh-provider-bundle-0.41.1.tgz` — sha256
+  `11937c36ee4627c8704c9cdc0704b16f91cebb5a8fea9ab4c7e81da6c22f73dc`
+  — `sha512-sOwR4L1nbWj+goYxnKiYybcxX4hKbjycYk4OE1nDfIa7kVZ2KwOybzqVY8jZtbnaBreWS0fQN9Vn6NmdnD0F/A==`
+  (computed with npm pack; the output is byte-deterministic).
+- Root `triss-coworker-0.41.1.tgz` sha256 is reproducible via `npm pack` at
+  tag `v0.41.1`; the root tarball ships `CHANGELOG.md`, so its hash cannot be
+  recorded inside this file. Registry verification compares the packed
+  artifact with the published tarball byte-for-byte.
+
 ## [0.41.0] — 2026-08-28
 
 ### Changed
@@ -1738,7 +1762,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial release of `triss-coworker`.
 
-[Unreleased]: https://github.com/ayleen/triss-coworker/compare/v0.41.0...HEAD
+[Unreleased]: https://github.com/ayleen/triss-coworker/compare/v0.41.1...HEAD
+[0.41.1]: https://github.com/ayleen/triss-coworker/compare/v0.41.0...v0.41.1
 [0.41.0]: https://github.com/ayleen/triss-coworker/compare/v0.40.0...v0.41.0
 [0.40.0]: https://github.com/ayleen/triss-coworker/compare/v0.39.2...v0.40.0
 [0.39.2]: https://github.com/ayleen/triss-coworker/compare/v0.39.1...v0.39.2

package/README.md

@@ -7,6 +7,7 @@
 [![npm version](https://img.shields.io/npm/v/triss-coworker.svg)](https://www.npmjs.com/package/triss-coworker)
 [![npm downloads](https://img.shields.io/npm/dm/triss-coworker.svg)](https://www.npmjs.com/package/triss-coworker)
 [![Tests](https://github.com/ayleen/triss-coworker/actions/workflows/test.yml/badge.svg)](https://github.com/ayleen/triss-coworker/actions/workflows/test.yml)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14266/badge)](https://www.bestpractices.dev/en/projects/14266)
 [![Node.js](https://img.shields.io/node/v/triss-coworker.svg)](https://nodejs.org/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Changelog](https://img.shields.io/badge/changelog-Keep%20a%20Changelog-orange.svg)](CHANGELOG.md)
@@ -119,9 +120,9 @@ triss status
 
 During successful interactive CLI use, Triss checks a fixed GitHub Release
 endpoint at most once per cache window and prints a throttled update notice to
-stderr. A due check is awaited and adds at most 1.1 seconds; a fresh cache adds
-no network wait. Long-running MCP servers begin the same check only after the
-MCP initialization handshake and use MCP logging plus stderr fallback.
+stderr. A due check is awaited and adds at most 5.1 seconds; a fresh cache adds
+no network wait. Long-running MCP servers begin the same five-second check only
+after the MCP initialization handshake and use MCP logging plus stderr fallback.
 
 ```bash
 triss update                  # fresh status and guidance; no file changes

package/bin/triss.js

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 const [nodeMajor, nodeMinor] = process.versions.node.split('.').map(Number);
 if (nodeMajor < 22 || (nodeMajor === 22 && nodeMinor < 12)) {
   process.stderr.write(

package/docs/security-model.md

@@ -9,7 +9,9 @@ provider error contract are documented in the
 [Reliable Delegation contract](reliable-delegation-contract.md).
 In short: external content is
 untrusted, required boundaries fail closed, best-effort isolation is opt-in,
-and release artifacts are verified before publication.
+and release artifacts are verified before publication — including
+fail-closed GPG tag-signature checks (see
+[releasing.md](https://github.com/ayleen/triss-coworker/blob/main/docs/releasing.md)).
 
 This document does not redefine those sources. Update them together whenever a
 new provider, automatic network path, child engine, credential route, or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triss-coworker",
-  "version": "0.41.0",
+  "version": "0.41.1",
   "description": "Give your AI coding agent a cheap DeepSeek coworker. Delegate bulk reads, boilerplate, and doc updates to save 60-70% of your token budget.",
   "type": "module",
   "bin": {
@@ -36,6 +36,7 @@
     "test": "node scripts/check-lockfile-gate.cjs && npm run test:secure-default && npm run test:best-effort",
     "test:secure-default": "node scripts/run-tests.js secure-default",
     "test:best-effort": "node --test test/best-effort-*.test.js",
+    "test:coverage": "c8 --include 'src/**' --include 'bin/**' --check-coverage --statements 90 --branches 80 --functions 80 --lines 80 --reporter=text --reporter=text-summary npm test",
     "start": "node bin/triss.js",
     "lint": "eslint . --max-warnings=0",
     "lint:fix": "eslint . --fix",
@@ -44,8 +45,9 @@
     "check:config-docs": "node scripts/generate-config-defaults.js --check",
     "check:docs": "npm run check:config-docs && node scripts/check-doc-links.js",
     "check:package": "node scripts/check-package-contents.js",
-    "check": "npm run lint && npm run typecheck && npm test && npm run check:docs && npm run check:package",
-    "prepublishOnly": "npm run check"
+    "check": "npm run lint && npm run typecheck && npm test && npm run check:docs && npm run check:package && npm run check:license-headers",
+    "prepublishOnly": "npm run check",
+    "check:license-headers": "node scripts/check-license-headers.js"
   },
   "keywords": [
     "claude-code",
@@ -95,7 +97,9 @@
   "devDependencies": {
     "@deepseek-ai/dsh-app-boot": "^0.1.0-rc.6",
     "@eslint/js": "^10.0.1",
+    "c8": "^12.0.0",
     "eslint": "^10.3.0",
+    "fast-check": "^4.9.0",
     "globals": "^17.6.0"
   }
 }

package/src/agent-rule-markers.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // The Triss managed-block markers, isolated in their own tiny module so the
 // marker transaction primitive can reference them without pulling in
 // agent-rules.js — which itself depends on the MCP install module. Without

package/src/agent-rules.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // Shared agent-rules rendering. Used by `triss init` (writes the nano block
 // into CLAUDE.md / AGENTS.md) and by `triss agent-help` (prints the full
 // cookbook on demand). The split keeps the always-loaded block tiny while

package/src/call-context.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // Per-invocation call context propagated via AsyncLocalStorage.
 //
 // Each CLI subcommand or MCP tool handler runs inside `withCall(fn)`; any

package/src/cli-argv.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 export function isExecExplainInvocation(argv = []) {
   if (argv[0] !== 'exec') return false;
   const commandArgs = argv.slice(1);

package/src/client.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import OpenAI from 'openai';
 import pc from 'picocolors';
 import {

package/src/coder-credential-proxy.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-credential-proxy.js — parent-owned loopback
  * credential proxy.

package/src/coder-engine-registry.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-engine-registry.js — canonical engine registry for triss coder.
  *

package/src/coder-engines/crush.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // Crush adapter behind `triss coder run --engine
 // crush`. See docs/engines/crush.md for the supported configuration, safety
 // boundaries, and upstream limitations this adapter must preserve.

package/src/coder-engines/omp.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // OMP adapter — the FOURTH coding engine (Oh My Pi) behind
 // `triss coder run --engine omp`. See docs/engines/omp.md and
 // docs/omp-engine-plan.md for the verified facts this adapter follows.

package/src/coder-engines/opencode2.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // opencode2 adapter — the THIRD coding engine (OpenCode 2 beta) behind
 // `triss coder run --engine opencode2`. See docs/opencode2-engine-plan.md for
 // the verified facts this adapter follows. Scope mirrors crush.js: PURE

package/src/coder-git-mediator.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-git-mediator.js — bounded Git mediator.
  *

package/src/coder-lease.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-lease.js — fixed kernel locks and coder
  * leases.

package/src/coder-lock.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import {
   chmodSync,
   closeSync,

package/src/coder-models.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // src/coder-models.js — shared model-management service.
 //
 // Extracts provider/model resolution and auditing into a testable in-process

package/src/coder-orchestration.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-orchestration.js — OpenCode run and envelope
  * orchestration helpers (pure).

package/src/coder-process-supervisor.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-process-supervisor.js — complete descendant
  * supervisor primitive (best-effort).

package/src/coder-providers.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 const freeze = (value) => Object.freeze(value);
 
 // This name is deliberately stable and owned by Triss.  It is used only in

package/src/coder-result-owner-adapter.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-result-owner-adapter.js — retained-result
  * process-owner adapter.

package/src/coder-result-quarantine.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-result-quarantine.js — quarantine
  * transaction and quarantine clean.

package/src/coder-result-registry-codec.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-result-registry-codec.js — retained-result
  * registry codec.

package/src/coder-result-transitions.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-result-transitions.js — retained-result
  * transitions and deletion.

package/src/coder-result.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-result.js — pure coder result and lifecycle
  * contract.

package/src/coder-run-state.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-run-state.js — coder run-state and rollback
  * composition.

package/src/coder-sandbox.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-sandbox.js — filesystem and network
  * capability adapter.

package/src/coder-session-engines.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-session-engines.js — the canonical v2 coder session engine enum.
  *

package/src/coder-session-inventory-codec.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-session-inventory-codec.js — project-worktree
  * session inventory codec.

package/src/coder-session-owner-adapter.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-session-owner-adapter.js — session
  * process-owner adapter.

package/src/coder-session-slots.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * Project-wide persistent-session slot authority.
  *

package/src/coder-session-store.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-session-store.js — bounded per-session
  * generation store.

package/src/coder-session-transitions.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-session-transitions.js — session admission
  * and inventory transitions.

package/src/coder-state-backup.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-state-backup.js — rollback backup
  * orchestrator.

package/src/coder-state.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-state.js — metadata persistence and cleanup
  * lifecycle.

package/src/coder-write-quota.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-write-quota.js — aggregate writable quota
  * adapter (best-effort).

package/src/commands/agent-help.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // Print the full Triss delegation cookbook to stdout. The nano block in
 // CLAUDE.md / AGENTS.md points here so the agent loads the long reference
 // only when it actually needs to look something up — saving the per-session

package/src/commands/ask.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { chat, chatStream, reportUsage, responseText } from '../client.js';
 import { assertProviderText } from '../provider-errors.js';

package/src/commands/chat.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { chat, chatStream, reportUsage } from '../client.js';
 import { resolveModel } from '../models.js';

package/src/commands/coder-models.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // src/commands/coder-models.js — CLI handlers for `triss coder models` (live
 // read-only model listing) and `triss coder model set` (persistent model
 // switch). These are the Phase 4 command surfaces wired in bin/triss.js.

package/src/commands/coder-state-backup.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * coder-state-backup.js (commands) — CLI run
  * functions for `triss coder state backup` and `triss coder state validate`.

package/src/commands/coder.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // `triss coder` — delegate coding tasks to a GLM agent. opencode is the
 // default engine (deny-first bash policy); crush is an optional second
 // engine behind --engine crush / TRISS_CODER_ENGINE=crush (single JSON

package/src/commands/commit-msg.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { spawnSync } from 'node:child_process';
 import pc from 'picocolors';
 import { chat, reportUsage } from '../client.js';

package/src/commands/completion.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // Shell-completion generator. Walks the Commander tree and emits a
 // completion script for bash or zsh. The generated scripts complete:
 //   - top-level command names

package/src/commands/config.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import pc from 'picocolors';

package/src/commands/exec.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { runAsk, validateAskOptions } from './ask.js';
 import { runReview, validateReviewOptions } from './review.js';

package/src/commands/extract.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { readFileSync, writeFileSync } from 'node:fs';
 import pc from 'picocolors';
 import { assertSafePath } from '../safety.js';

package/src/commands/fetch.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { fetchAsMarkdown } from '../web.js';
 import { summarize, printResult } from '../integrations/_contract.js';

package/src/commands/init.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';

package/src/commands/mcp.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { runServer } from '../mcp/server.js';
 import {

package/src/commands/review.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { chat, chatStream, reportUsage, responseText } from '../client.js';
 import { assertProviderText } from '../provider-errors.js';

package/src/commands/status.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { getConfig } from '../config.js';
 import { listPresets, describeGlmRouting, describeKimiRouting } from '../models.js';

package/src/commands/update.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { computeRetainedStats, journalDigest, receiptDigest } from '../update/install.js';
 
 function parseVersion(value) {

package/src/commands/usage.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { readLog, summarize, parsePeriod, clearLog, USAGE_FILE } from '../usage.js';
 

package/src/commands/write.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import pc from 'picocolors';

package/src/config-defaults.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 export const CONFIG_DEFAULTS = Object.freeze({
   TRISS_UPDATE_CHECK: Object.freeze({
     value: 'enabled',

package/src/config.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import dotenv from 'dotenv';
 import { readFileSync } from 'node:fs';
 import { activeEnvFiles } from './secrets.js';

package/src/fixed-kernel-lock.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 /**
  * fixed-kernel-lock.js — fixed lock capability
  * primitive.

package/src/git.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { spawnSync } from 'node:child_process';
 
 function run(cmd, args, opts = {}) {

package/src/integrations/_atlassian.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 // Shared Atlassian (Jira + Confluence) auth and request helper.
 // Both products live on the same Cloud tenant and share the same triple
 // of env vars; centralising avoids drift if Atlassian changes auth.

package/src/integrations/_contract.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { chat, reportUsage } from '../client.js';
 import { resolveModel } from '../models.js';

package/src/integrations/_registry.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { readdirSync, statSync, existsSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';

package/src/integrations/confluence/client.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { ATLASSIAN_ENV, atlassianConfig, atlassianCall } from '../_atlassian.js';
 
 export const ENV = ATLASSIAN_ENV;

package/src/integrations/confluence/commands.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import pc from 'picocolors';
 import { confluence, textToStorage } from './client.js';
 import { adfToText } from '../jira/adf.js';

package/src/integrations/confluence/index.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 ayleen
+
 import { searchCmd, pageCmd, createCmd, updateCmd, spacesCmd } from './commands.js';
 
 const CLAUDE_INSTRUCTIONS = `### \`triss confluence\` — Atlassian Confluence