triss-coworker 0.44.0 → 0.44.2

package/CHANGELOG.md

@@ -7,50 +7,77 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Added
+## [0.44.2] — 2026-10-29
 
-- All execution engines now run non-coder model projections (`ask`, `review`,
-  `chat`, `write`, `commit-msg`): `opencode` keeps its verified read-only
-  projection; `opencode2`, `omp`, and `crush` execute best-effort and attach a
-  warning naming the concrete limitation that is not verified, instead of
-  rejecting the run before launch.
-- `triss config wizard` now opens the Easy path directly (provider + key,
-  assistant hosts, summary, first command) and preserves existing explicit
-  choices on rerun. `--advanced` exposes the full sections; an optional target
-  argument accepts a canonical provider id, `coder`, or an integration name;
-  `--yes`, `--agent`, and `--install` support headless apply; `triss init
-  --setup` delegates to the same wizard after writing agent rules.
-- New persisted fields: `TRISS_CODER_PROVIDER`, `TRISS_DEFAULT_EFFORT`,
-  `TRISS_CODER_EFFORT`, `TRISS_PROTECT_CREDENTIALS`, and
-  `TRISS_CODER_PROTECT_CREDENTIALS` (credential protection is a tri-state:
-  absent, true, or false — the string `"false"` is never a truthy opt-in) and
-  `TRISS_MODEL_TRANSPORTS` (exact-model direct transport override map).
-- The `direct` engine now serves `opencode-zen` and `opencode-go` models
-  through audited per-model transports (OpenAI Chat, OpenAI Responses,
-  Anthropic Messages); a model without resolvable direct metadata fails with
-  the stable `TRISS_DIRECT_ENGINE_REQUIRED` code and an actionable
-  `TRISS_MODEL_TRANSPORTS` remedy instead of a generic registry error.
-- `--protect-credentials` / `--no-protect-credentials` on model-backed
-  commands: the former requests the parent-owned proxy and falls back to a
-  warned best-effort raw run when a protected route is unavailable; the latter
-  overrides a persisted protection choice for one run. MCP forwards
-  `protect_credentials` as the same tri-state.
+### Fixed
+
+- Keep the pinned Harness npx acceptance check executable by installing its
+  required peer dependencies explicitly instead of hanging in npm peer
+  hoisting. The real add/remove and provider-route checks remain enabled.
+- Update production and development dependencies, including Anthropic SDK
+  1.3.0, MCP SDK 1.32.2, dotenv 18.0.9, linkedom 0.18.14 and OpenAI SDK
+  7.43.0, and refresh vulnerable transitive dependencies.
+- Keep standalone builds within the existing installer archive limits by
+  omitting dependency source maps and TypeScript declaration files. Runtime
+  sources, package metadata and licenses remain included.
+- Refresh website dependencies, including Wrangler and Undici security fixes.
+  Website development and builds require Node >=22.22.0; the CLI runtime
+  requirement remains Node >=22.12.0.
 
 ### Changed
 
-- Crush is provider-neutral: any canonical provider projects onto a run-scoped
-  config with `$ENV` credential references. Protected mode remains the crush
-  default; an explicit `--no-protect-credentials` runs crush raw through the
-  same run-scoped config as a disclosed best-effort choice. Responses-protocol
-  models ride a bounded chat→responses bridge in the credential proxy
-  (message-only; tool rounds are refused with a precise error).
-- `triss ask`, `triss review`, and other model-backed commands no longer
-  require engine-specific provider restrictions: provider and engine are
-  independent choices, honored as selected with truthful warnings for
-  best-effort routes.
-- The setup wizard no longer resets an existing provider/engine selection or
-  installs a Claude MCP server implicitly; Easy and Advanced share one setup
-  and resolution path.
+- Incorporate the dependency updates from Dependabot PRs #137, #139,
+  #141–#145, #147, #148 and #150–#152. MCP SDK 1.32.2 supersedes the older
+  1.32.0 proposal. GitHub Actions remain pinned to immutable commit hashes.
+- Align `triss-dsh-provider-bundle` at 0.44.2; provider routes and settings
+  remain unchanged.
+
+
+### Artifact integrity (0.44.2)
+
+- `triss-dsh-provider-bundle-0.44.2.tgz` — sha256
+  `46b4b875bc4f8f833765200bbb4440bd7ddbe60699f4acfc32f3ba6eea055528`
+  — `sha512-XsGZTWVLVyvNqatXyXc3/xjq/bCrd9Nt913oWrZA28ytCKTZEZ+8se2Kw5JQTbju+AL4sIR42irbdyhEi5S3rg==`
+  (computed with npm pack; the output is byte-deterministic).
+- Root `triss-coworker-0.44.2.tgz` sha256 is reproducible via `npm pack` at
+  tag `v0.44.2`; its tarball includes this changelog, so its hash is verified
+  separately rather than embedded here.
+
+## [0.44.1] — 2026-09-09
+
+### Fixed
+
+- All nine open Dependabot security alerts (#21–#29) are closed in one
+  sweep. Root package: `hono` 4.13.7 (CVE-2026-84363 query-parser fragment
+  differential, CVE-2026-84364 `parseBody()` memory exhaustion,
+  CVE-2026-84365 `toSSG()` path traversal) and `js-yaml` 4.3.2
+  (CVE-2026-84375). Site: `astro` 7.3.2 (critical RCE via AVIF image
+  optimization, GHSA-26w7-cxv4-gfx2), `sharp` 0.35.4 (libheif
+  GHSA-g89c-p67h-r497, GHSA-2jg2-4ch7-h545), `js-yaml` 4.3.2, and `svgo`
+  4.1.0 (CVE-2026-84369, CVE-2026-84370). `npm audit` reports 0
+  production vulnerabilities for the root package and the site.
+- Carried dependency groups superseded from Dependabot: `@anthropic-ai/sdk`
+  ^0.124.0 (production) and the development-dependencies group (`keyv`
+  5.6.0, `flat-cache` 6.1.23 lockfile-only).
+
+### Changed
+
+- The 2026-09-08 documentation audit landed (D01–D16, A01–A03): generated
+  CLI and MCP references, security-model and getting-started updates, and
+  packaged-documentation acceptance in the publish pipeline.
+- `triss-dsh-provider-bundle` is version-aligned at 0.44.1 and republished
+  unchanged; its OpenCode Zen, OpenCode Go, and Z.AI routes are unchanged.
+
+### Artifact integrity (0.44.1)
+
+- `triss-dsh-provider-bundle-0.44.1.tgz` — sha256
+  `76b74f0092665c9f0a4e7cc1060f8f359ea9de04be59cd24557580d4f71ec3a1`
+  — `sha512-8/taMLUGjQjM2i4HME6gcZev+XycbhR6TmNv0zKtbPxT66MzVm98w3aZ1LPK3oNqqkPEMWz1yGMP5n1rGUdmNw==`
+  (computed with npm pack; the output is byte-deterministic).
+- Root `triss-coworker-0.44.1.tgz` sha256 is reproducible via `npm pack` at
+  tag `v0.44.1`; the root tarball ships `CHANGELOG.md`, so its hash cannot
+  be recorded inside this file. Registry verification compares the packed
+  artifact with the published tarball byte-for-byte.
 
 ## [0.44.0] — 2026-09-08
 
@@ -73,19 +100,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Headless apply: `triss config wizard --yes --agent none [--install]`
   assembles a complete configuration from existing files, the environment,
   and explicit flags; missing requirements exit non-zero before writing.
-  `triss init --setup` delegates to the same wizard after writing agent
-  rules.
+  `triss init --setup` delegates to the same wizard before any rules write,
+  preserving init's target and scope intent.
 - Every execution engine now serves every canonical provider: crush runs any
   provider through a run-scoped config with `$ENV` credential references
   (provider block seeded before `crush models use`), and opencode2, omp, and
   crush execute non-coder projections (`ask`, `review`, `chat`, `write`,
   `commit-msg`) best-effort with structured warnings naming the unverified
-  limitation.
+  limitation. Provider and engine are independent choices for model-backed
+  commands, honored as selected with truthful warnings for best-effort
+  routes.
 - `--protect-credentials` / `--no-protect-credentials` on model-backed
   commands; MCP forwards `protect_credentials` as the same tri-state and
   carries credential mode and disclosures in the run envelope.
-- `TRISS_CODER_EFFORT` and `TRISS_DEFAULT_EFFORT` knobs, honored by every
-  engine (crush discloses when a provider declares no effort support).
+- New persisted fields: `TRISS_CODER_PROVIDER` (coder-only provider default
+  that never rewrites `TRISS_DEFAULT_PROVIDER`), `TRISS_DEFAULT_EFFORT`,
+  `TRISS_CODER_EFFORT` (honored by every engine; crush discloses when a
+  provider declares no effort support), the `TRISS_PROTECT_CREDENTIALS` /
+  `TRISS_CODER_PROTECT_CREDENTIALS` tri-state (absent, true, or false — the
+  string `"false"` is never a truthy opt-in), and `TRISS_MODEL_TRANSPORTS`
+  (exact-model direct transport override map; a model without resolvable
+  direct metadata fails with the stable `TRISS_DIRECT_ENGINE_REQUIRED` code
+  and this remedy).
 
 ### Changed
 

package/README.md

@@ -55,7 +55,7 @@ triss config wizard --yes --agent none
 Connect Claude Code, Codex, or both:
 
 ```bash
-triss init --target claude --global --setup   # writes rules, then runs the wizard
+triss init --target claude --global --setup   # runs the setup wizard first, then writes rules
 triss init --target codex --global
 triss mcp install --target claude --global
 triss mcp install --target codex --global
@@ -65,12 +65,17 @@ triss mcp install --target codex --global
 integration. Omit values to enter them interactively; secret input is masked:
 
 ```bash
+triss config set -g TRISS_OPENAI_COMPATIBLE_BASE_URL
 triss config set -g TRISS_OPENAI_COMPATIBLE_API_KEY
 triss config set -g TRISS_OPENAI_COMPATIBLE_MODEL
 triss config set -g TRISS_OPENAI_COMPATIBLE_SMALL_MODEL
 ```
 
-Check the credential and selected defaults with `triss status`. Existing provider and engine choices are not changed by these three profile-field commands; use `triss config wizard --advanced` to adjust them if needed.
+`openai-compatible` is a configurable profile, not a provider detector: its
+built-in endpoint is `https://api.deepseek.com/v1`. Set the base URL explicitly
+when using another compatible endpoint. These four commands edit profile
+fields; they do not reset an existing default provider or engine. Check the
+effective configuration with `triss status` before the first request.
 
 For an installed host, run `triss mcp status` and restart that host's session. There is no need to repeat `triss init` or `triss mcp install` if the wizard already connected it. Terminal users skip this step.
 
@@ -123,7 +128,7 @@ Every provider has an endpoint, credential, `model` role, and `smallModel` role.
 4. global `~/.config/triss/.env`;
 5. registry defaults.
 
-`TRISS_DEFAULT_PROVIDER` selects the provider when a request omits one; `TRISS_DEFAULT_ENGINE` selects `direct`, `opencode`, `opencode2`, `omp`, or `crush` when it omits an engine. Direct CLI and MCP commands accept a native model id. Coder model options use `<provider>/<model-id>`. Every engine can execute non-coder model projections (`ask`, `review`, `chat`, …); what differs per engine is the available protection, not permission to run. `opencode` and `direct` have a verified read-only projection; `opencode2` runs the same deny-everything projection agent through its run-scoped config surface, `omp` uses its run-private policy overlay, and `crush` runs single-agent with the restrict allowlist. Engines without a verified projection report their concrete limitation as a warning on the result — never as a refusal.
+`TRISS_DEFAULT_PROVIDER` selects the provider when a request omits one; `TRISS_DEFAULT_ENGINE` selects `direct`, `opencode`, `opencode2`, `omp`, or `crush` when it omits an engine. The `--model` value is either a qualified `<canonical-provider>/<native-id>` selector or a bare native id; a bare id resolves against `--provider` when given, otherwise against the effective default provider. An explicit `--provider` that conflicts with a qualified model prefix is rejected, not silently replaced. Every engine can execute non-coder model projections (`ask`, `review`, `chat`, …); what differs per engine is the available protection, not permission to run. `opencode` and `direct` have a verified read-only projection; `opencode2` runs the same deny-everything projection agent through its run-scoped config surface, `omp` uses its run-private policy overlay, and `crush` runs single-agent with the restrict allowlist. Engines without a verified projection report their concrete limitation as a warning on the result — never as a refusal.
 
 Shared reasoning effort values:
 
@@ -135,7 +140,8 @@ Examples:
 
 ```bash
 triss ask --provider zai --model glm-5.2 --effort high \
-  --paths src --question "Find correctness defects"
+  --paths 'src/**/*.js' \
+  --question "Find correctness defects. Cite file paths and line numbers."
 
 triss review --provider moonshot --model kimi-k3 --effort max
 
@@ -143,6 +149,11 @@ triss chat --provider openai-compatible --effort low \
   "Explain this error"
 ```
 
+`--paths` accepts text files or quoted glob patterns. Directories are not read
+recursively; an input like `--paths src` fails with a "no readable file
+content" error before any model call. Quote globs so Triss, rather than the
+shell, expands them.
+
 Omit `--model` to use the command's provider role. There are no public model presets.
 
 ## Configuration
@@ -184,11 +195,15 @@ never gains ambient file, shell, edit, skill, or delegation access. The other
 engines apply their best-effort equivalents (run-scoped config surface,
 run-private policy overlay, or the restrict allowlist) and attach a warning
 that names exactly what is not verified. The process still runs as the current
-OS user and is not a filesystem sandbox. Add `--protect-credentials` to a model
-command when the selected credential can be kept behind the parent-owned proxy
-(it falls back to a best-effort raw run with a warning when a protected route
-is unavailable); `--no-protect-credentials` overrides a persisted
-`TRISS_PROTECT_CREDENTIALS=true` choice for one run. For coder runs configured
+OS user and is not a filesystem sandbox. Best-effort tool-policy support does
+not imply an automatic credential downgrade: a selected protected route fails
+closed — before any credential-bearing spawn — when the raw key cannot be
+contained by the checked credential boundary or when the proxy cannot start.
+`--protect-credentials` requests the parent-owned credential proxy;
+`--no-protect-credentials` is an explicit choice to run with the selected raw
+credential and a disclosed limitation, and it overrides a persisted
+`TRISS_PROTECT_CREDENTIALS=true` (or `TRISS_CODER_PROTECT_CREDENTIALS=true`)
+choice for one run. For coder runs configured
 through the wizard, `--coder-protect-credentials` / `--coder-no-protect-credentials`
 persist `TRISS_CODER_PROTECT_CREDENTIALS=true` / `=false` (cannot be combined);
 the coder-specific value takes precedence over the shared
@@ -287,7 +302,7 @@ Engine details:
 
 If the wizard has not already connected your host, choose Claude Code or Codex in the [host-connection guide](https://triss.work/docs/getting-started/#step-4). Only run setup for the host you intend to use.
 
-Core tools include `triss_ask`, `triss_chat`, `triss_fetch`, `triss_review`, `triss_write`, `triss_commit_msg`, `triss_status`, and the migration/update surfaces. Coder tools appear when any canonical provider credential is configured. Tracker tools appear only when their integration credential is ready.
+Core tools include `triss_ask`, `triss_chat`, `triss_fetch`, `triss_review`, `triss_review_shard`, `triss_write`, `triss_commit_msg`, and `triss_status`. Updates and migration stay CLI-side: the MCP server emits passive update notices but exposes no update or migration tool. Coder tools appear when any canonical provider credential is configured. Tracker tools appear only when their integration credential is ready.
 
 The MCP schemas use the same `provider`, `model`, `effort`, and engine contracts as the CLI. Full reference: [MCP](https://github.com/ayleen/triss-coworker/blob/main/docs/mcp.md).
 
@@ -316,7 +331,7 @@ Usage records preserve provider, model, token-class provenance, billing mode, an
 ## Updates
 
 ```bash
-triss update --check
+triss update
 triss update --apply
 triss update --rollback
 ```

package/SECURITY.md

@@ -1,8 +1,8 @@
 # Security
 
 Triss is a local CLI and MCP server that can read files, fetch URLs, call
-tracker APIs, and send selected context to a DeepSeek-compatible model. That
-makes the trust boundary worth spelling out plainly.
+tracker APIs, and send selected context to the model provider you configure.
+That makes the trust boundary worth spelling out plainly.
 
 ## Reporting vulnerabilities
 
@@ -22,8 +22,8 @@ advisory unless they ask to remain anonymous.
 
 ## What leaves your machine
 
-Model-backed commands send the requested prompt and selected corpus to the
-configured OpenAI-compatible endpoint:
+Model-backed commands send the requested prompt and selected context to the
+resolved endpoint of your selected canonical provider:
 
 - `triss ask`
 - `triss chat`
@@ -84,21 +84,31 @@ content is never written to this log** — metadata only. If working-directory
 paths are themselves sensitive (client names in folder names), set
 `TRISS_USAGE_LOG_CWD=0`, or disable the log entirely with
 `TRISS_USAGE_LOG=0`. The file rotates once past `TRISS_USAGE_LOG_MAX_BYTES`;
-the generated defaults table in [docs/configuration.md](docs/configuration.md#tunables)
+the generated defaults table in
+[docs/configuration.md](docs/configuration.md#network-and-usage-controls)
 is the source of truth. Delete it at any time with `triss usage --reset`.
 
 ## Data residency and GDPR
 
 Triss is a local tool, not a hosted service — it stores none of your data
 server-side and has no subprocessors of its own. The party that processes
-your prompts is **whatever model endpoint you configure**. The default is
-DeepSeek (`api.deepseek.com`); if your compliance posture requires an EU- or
-US-resident processor, a signed DPA, or a zero-retention guarantee, point
-`TRISS_WORKER_BASE_URL` at a provider that offers one (Azure OpenAI,
-AWS Bedrock, Mistral, or a self-hosted vLLM/Ollama endpoint — see the
-provider recipes in the README) and set the model names accordingly. Your
-organisation's agreement with that provider is the controlling document;
-Triss adds no additional data flows on top of it.
+your prompts is **whatever model endpoint you configure**.
+
+Model-backed commands send their selected context to the resolved provider
+endpoint. For the `openai-compatible` profile, configure
+`TRISS_OPENAI_COMPATIBLE_BASE_URL`, `TRISS_OPENAI_COMPATIBLE_API_KEY`, and the
+profile's model fields. Other canonical providers use their own endpoint
+fields (see the provider field table in
+[docs/configuration.md](docs/configuration.md#canonical-providers)).
+`TRISS_WORKER_BASE_URL` is a pre-0.42 migration input, not a current setup
+instruction; the migration reference in
+[src/migration/legacy-inventory.js](src/migration/legacy-inventory.js) maps it
+to the canonical field. Triss does not enforce a provider's retention,
+training, residency, or contractual policies — your organisation's agreement
+with that provider is the controlling document. Triss does not add undocumented
+data flows on top of the configured provider; see the complete flow table in
+[docs/data-flows.md](docs/data-flows.md), including integrations, approved
+setup downloads, and the credential-free passive update check.
 
 ## Supply chain
 

package/THIRD_PARTY_NOTICES

@@ -4,7 +4,7 @@ Triss Coworker third-party notices
 The npm package installs the following direct runtime dependencies. Their
 license texts and transitive notices are distributed with those packages:
 
-- @anthropic-ai/sdk — MIT
+- @anthropic-ai/sdk — Apache-2.0
 - @modelcontextprotocol/sdk — MIT
 - commander — MIT
 - dotenv — BSD-2-Clause