docguard-cli 0.34.1__tar.gz → 0.34.2__tar.gz

{docguard_cli-0.34.1/extensions/spec-kit-docguard → docguard_cli-0.34.2/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.1
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.1 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.1
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.1 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.1/extensions/spec-kit-docguard → docguard_cli-0.34.2/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.1
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.1 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.1/extensions/spec-kit-docguard → docguard_cli-0.34.2/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.1
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.1 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.1
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.1 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Sync Skill
 

docguard_cli-0.34.2/.github/dependabot.yml

@@ -0,0 +1,32 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      all-npm:
+        patterns: ["*"]
+    ignore:
+      # @babel/parser 8.x requires Node ^22.18.0 || >=24.11.0, silently dropping
+      # Node 18 — which this project declares support for and CI gates on.
+      # Confirmed twice (PRs #331, #335): the major bump passes tests on a
+      # single local Node version but breaks the Node 18 CI job with wrong
+      # AST-parse results (not an install failure, so it slips past casual
+      # review). Stay on 7.x; take patches (see #333) via version-update:semver-patch/minor.
+      - dependency-name: "@babel/parser"
+        update-types: ["version-update:semver-major"]
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      all-pip:
+        patterns: ["*"]
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      all-actions:
+        patterns: ["*"]

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/.github/workflows/supply-chain.yml

@@ -17,8 +17,8 @@ permissions:
 jobs:
   osv-scan-pr:
     if: github.event_name == 'pull_request'
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.5.1"
 
   osv-scan-scheduled:
     if: github.event_name != 'pull_request'
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.1"

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/.wolf/anatomy.md

@@ -1,7 +1,7 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-08-28T16:51:39.555Z
-> Files: 703 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T14:49:52.100Z
+> Files: 704 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
 
@@ -29,7 +29,7 @@
 - `.pre-commit-hooks.yaml` — DocGuard hooks for the pre-commit framework (https://pre-commit.com). (~490 tok)
 - `action.yml` — Declares fs (~7591 tok)
 - `AGENTS.md` — AI Agent Instructions — DocGuard (~1827 tok)
-- `CHANGELOG.md` — Changelog (~50928 tok)
+- `CHANGELOG.md` — Changelog (~51473 tok)
 - `CLAUDE.md` — OpenWolf (~57 tok)
 - `CODE_OF_CONDUCT.md` — Contributor Covenant Code of Conduct (~532 tok)
 - `COMPARISONS.md` — Comparisons & Honest Limitations (~3382 tok)
@@ -945,6 +945,7 @@
 
 ## .github/
 
+- `dependabot.yml` (~296 tok)
 - `PULL_REQUEST_TEMPLATE.md` — Pull Request (~223 tok)
 
 ## .github/ISSUE_TEMPLATE/

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/.wolf/buglog.json

@@ -4414,6 +4414,42 @@
       "occurrences": 1,
       "last_seen": "2026-08-28T16:55:00Z",
       "notes": "The release pipeline did exactly its job: test(18) failed, everything downstream (tag/npm/pypi) correctly skipped via job dependencies, nothing bad shipped. The gap was in MY pre-push verification, not the CI design."
+    },
+    {
+      "id": "bug-268",
+      "timestamp": "2026-09-11T14:49:52.110Z",
+      "error_message": "Incorrect value in code",
+      "file": "package.json",
+      "root_cause": "Had \"0.34.1\"",
+      "fix": "Changed to \"0.34.2\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T14:49:52.110Z"
+    },
+    {
+      "id": "bug-256",
+      "timestamp": "2026-09-11T15:00:00Z",
+      "error_message": "publish-npm for v0.34.1 failed identically 3 times across 2 weeks (2026-08-28 x2, 2026-09-11): provenance signs successfully (distinct Sigstore transparency-log entry each time) then npm error E404 'docguard-cli@0.34.1 is not in this registry' on the PUT, ~0.1-0.4s later.",
+      "file": ".github/workflows/release.yml (NPM_TOKEN secret, not a code file)",
+      "root_cause": "NPM_TOKEN (a GitHub Actions repo secret) most likely expired. gh secret list shows it was last rotated 2026-05-22; the v0.34.0 publish succeeded on 2026-08-13 (day 83) using this same token, and every attempt since 2026-08-28 (day 98) has failed identically — consistent with npm's ~90-day default expiration on Automation tokens. npm returns 404 rather than 401/403 for some auth-scope failures during publish (a known npm registry quirk — doesn't confirm a package exists to an unauthorized/wrongly-scoped identity), which is why the error text looks like a missing-package error instead of an auth error. Confirmed NOT a registry incident: npm status page all-green throughout, incident history shows no active issue, and docguard-cli's existing versions were untouched on the registry each time.",
+      "fix": "Cannot fix from the CLI/repo — requires the user to generate a new npm Automation token (npmjs.com account settings) with publish rights to docguard-cli, and update the NPM_TOKEN secret in GitHub repo settings. Documented in CHANGELOG v0.34.2 'Known issue' section so it's visible to anyone checking why npm is behind. v0.34.1 and v0.34.2 are both correctly tagged/GitHub-released/PyPI-published (those don't depend on NPM_TOKEN) — only npm is stuck.",
+      "tags": [
+        "npm-publish",
+        "token-expiration",
+        "ci-secret",
+        "release-pipeline",
+        "not-fixable-by-agent",
+        "e404-masks-auth-failure"
+      ],
+      "related_bugs": [],
+      "occurrences": 3,
+      "last_seen": "2026-09-11T14:34:00Z",
+      "notes": "Do NOT keep blindly retrying publish-npm if this recurs after a token rotation looks successful — verify the token's actual publish scope/expiration on npmjs.com first. Also: don't assume '404 on a publish that should be an update' is a transient registry blip just because npm's status page is green and the error text sounds like a missing-package error — check secret rotation dates before concluding 'try again later'."
     }
   ]
 }

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/.wolf/cerebrum.md

@@ -12,6 +12,9 @@
 
 ## Key Learnings
 
+- **2026-09-11 — `npm error 404` on a PUBLISH (not install) can mean an expired token, not a missing package or a registry incident.** `publish-npm` for v0.34.1 failed identically 3x over 2 weeks: provenance signs fine (real, distinct Sigstore transparency-log entries each time — proves GitHub's OIDC → Sigstore leg works), then the actual registry PUT 404s with "'docguard-cli@0.34.1' is not in this registry" ~0.1-0.4s later. Ruled out registry incident (npm status green, incident history clean, package untouched on registry each time) before concluding it's the token — `gh secret list` showing `NPM_TOKEN` last rotated 2026-05-22, and the last successful publish being 2026-08-13 (day 83) with every attempt since day 98 failing, lines up with npm's ~90-day Automation-token default expiration. npm apparently returns 404 (not 401/403) for some auth/scope failures on publish, presumably to avoid confirming a package's existence to an unauthorized caller — worth remembering next time a publish 404s on a package that obviously exists. This is NOT fixable by the agent — needs the user to rotate the token on npmjs.com and update the GitHub secret. See bug-256.
+- **2026-09-11 — The full-Node-matrix-testing discipline (from bug-255) paid off immediately.** Same dependabot proposed the same @babel/parser 7→8 major bump again (#335) two weeks after the first revert — closed it on sight, no need to re-investigate. A companion Jules-bot PR (#333) independently arrived at the correct fix (bump to the latest 7.x patch, explicitly Node-18-aware in its own PR description) — merged after verifying 1042/1042 across Node 18/20/22/24 AGAIN, plus a combined-branch test with 5 other PRs merged together (1050/1050 across all four versions) before pushing. Also added a `dependabot.yml` ignore rule for `@babel/parser` majors specifically (`update-types: version-update:semver-major`) so this stops recurring every cycle — patches/minors still flow through.
+- **2026-09-11 — A `run_in_background` Bash task can get silently orphaned if the app quits and restarts mid-session.** After an app restart, a previously-backgrounded `npm test` loop showed 3+ minutes of dead air (not even the first version's header output completing) with zero matching process in `ps aux` — not a hang, the process was gone and the harness's tracking was gone with it. Don't wait indefinitely on a background task's notification after a session restart; check `ps aux` for the actual process, and if nothing is running, just re-issue the command directly instead of continuing to wait.
 - **2026-08-28 — "Tests pass" on a major dependency bump means nothing if you only tested one Node version.** Merged dependabot's @babel/parser 7→8 bump after 1036/1036 passed locally — but locally means Node 24 only, and `@babel/parser@8.0.4` declares `engines: {node: '^22.18.0 || >=24.11.0'}`, silently dropping Node 18 (which this project's `engines` field and CI matrix both explicitly support). The mismatch doesn't fail `npm install` — it just produces wrong AST-parse results on the unsupported version, caught only when the release pipeline ran the real Node 18 test job and failed 20 tests. The pipeline's job-dependency gating worked exactly as designed (create-release/publish-npm/publish-pypi all correctly skipped), so nothing bad shipped — but the gap was avoidable. Fixed properly this time: `fnm install 18 20` locally, then verify a major bump across the FULL matrix a project's `engines` field + CI declare, not just the default local version, before pushing. Same rule applies to any future dependency bump on a project with a multi-version support matrix.
 - **2026-08-28 — When reviewing an externally/bot-authored PR before merging, MERGE it onto current main in an isolated worktree and TIME the test run — don't trust the PR's own "tests pass" status.** PR #328's own new test passed, but merging it onto main and timing the full suite showed a 12x slowdown (118ms → 190s) on the exact file it modified. Root cause: the test called `scanSchemasDeep('/', {}, docTools, {})` with a malformed fixture (`docTools.openapi` missing `found: true`) — since the intended code path's early-return requires `openapi.found` truthy, the fixture fell through into a REAL recursive scan of `/`. A test that passes but never exercises the code it claims to is worse than an honest failure. Recipe: `git fetch origin pull/<n>/head:branch && git worktree add /tmp/x branch && cd /tmp/x && git merge origin/main --no-edit && ln -s <main>/node_modules . && npm test` (time it, don't just check exit code).
 - **2026-08-28 — Jules (Google's coding agent) PRs "started by @raccioly" are the repo owner's OWN automated task runs, not third-party contributions.** Three of them (#324, #325, #329) were near-duplicate attempts at the same "add missing shared-ignore test coverage" task, submitted a week apart — evidence of a retry loop where the prior PR was never merged/closed. Diff their content directly before assuming independence: #325 was a strict subset of #324's coverage (same 3 functions, #324 additionally covered `walkFiles`), making #329/#325 fully redundant once #324 merges. Two more (#316, #327) were 0-file "checked, no update needed" PRs from a scheduled dependency-check task — safe to close outright once the real update (via dependabot) has merged.

docguard_cli-0.34.2/.wolf/hooks/_session.json

@@ -0,0 +1,51 @@
+{
+  "session_id": "session-2026-09-11-1037",
+  "started": "2026-09-11T14:37:40.706Z",
+  "files_read": {
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/brseuna27.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T14:43:51.353Z"
+    },
+    "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T14:48:10.487Z"
+    },
+    "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md": {
+      "count": 1,
+      "tokens": 50928,
+      "first_read": "2026-09-11T14:49:34.552Z"
+    }
+  },
+  "files_written": [
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+      "action": "edit",
+      "tokens": 206,
+      "at": "2026-09-11T14:48:16.734Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 635,
+      "at": "2026-09-11T14:49:48.266Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+      "action": "edit",
+      "tokens": 7,
+      "at": "2026-09-11T14:49:52.109Z"
+    }
+  ],
+  "edit_counts": {
+    ".github/dependabot.yml": 1,
+    "CHANGELOG.md": 1,
+    "package.json": 1
+  },
+  "anatomy_hits": 1,
+  "anatomy_misses": 2,
+  "repeated_reads_warned": 0,
+  "cerebrum_warnings": 0,
+  "stop_count": 0
+}

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/.wolf/memory.md

@@ -1239,3 +1239,34 @@
 | 12:44 | Session end: 6 writes across 6 files (schemas.mjs, todo-tracking.mjs, schemas.test.mjs, todo-tracking.test.mjs, CHANGELOG.md) | 1 reads | ~1009 tok |
 | 12:49 | Edited package.json | inline fix | ~9 |
 | 12:51 | Edited CHANGELOG.md | 4→7 lines | ~271 |
+| 12:53 | Session end: 8 writes across 6 files (schemas.mjs, todo-tracking.mjs, schemas.test.mjs, todo-tracking.test.mjs, CHANGELOG.md) | 2 reads | ~52054 tok |
+| 12:58 | Session end: 8 writes across 6 files (schemas.mjs, todo-tracking.mjs, schemas.test.mjs, todo-tracking.test.mjs, CHANGELOG.md) | 2 reads | ~52054 tok |
+| 13:00 | Session end: 8 writes across 6 files (schemas.mjs, todo-tracking.mjs, schemas.test.mjs, todo-tracking.test.mjs, CHANGELOG.md) | 2 reads | ~52054 tok |
+
+## Session: 2026-08-28 14:59
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-08-28 14:59
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-09-11 10:30
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-09-11 10:30
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-09-11 10:37
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 10:48 | Edited .github/dependabot.yml | modified twice() | ~206 |
+| 10:49 | Edited CHANGELOG.md | expanded (+21 lines) | ~592 |
+| 10:49 | Edited package.json | inline fix | ~7 |

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/.wolf/token-ledger.json

@@ -2,14 +2,14 @@
   "version": 1,
   "created_at": "2026-05-26T15:31:59.491Z",
   "lifetime": {
-    "total_tokens_estimated": 6617937,
-    "total_reads": 1604,
-    "total_writes": 2915,
-    "total_sessions": 47,
-    "anatomy_hits": 988,
-    "anatomy_misses": 612,
+    "total_tokens_estimated": 6774099,
+    "total_reads": 1610,
+    "total_writes": 2939,
+    "total_sessions": 52,
+    "anatomy_hits": 991,
+    "anatomy_misses": 615,
     "repeated_reads_blocked": 940,
-    "estimated_savings_vs_bare_cli": 5293889
+    "estimated_savings_vs_bare_cli": 5294489
   },
   "sessions": [
     {
@@ -25848,6 +25848,213 @@
         "repeated_reads_blocked": 0,
         "anatomy_lookups": 0
       }
+    },
+    {
+      "id": "session-2026-08-28-2148",
+      "started": "2026-08-28T01:48:33.769Z",
+      "ended": "2026-08-28T16:53:26.557Z",
+      "reads": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/cli/scanners/schemas.mjs",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 50746,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/cli/scanners/schemas.mjs",
+          "tokens_estimated": 73,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/cli/validators/todo-tracking.mjs",
+          "tokens_estimated": 38,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/tests/schemas.test.mjs",
+          "tokens_estimated": 280,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/tests/todo-tracking.test.mjs",
+          "tokens_estimated": 281,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 330,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 7,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 9,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 290,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 50746,
+        "output_tokens_estimated": 1308,
+        "reads_count": 2,
+        "writes_count": 8,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 1
+      }
+    },
+    {
+      "id": "session-2026-08-28-2148",
+      "started": "2026-08-28T01:48:33.769Z",
+      "ended": "2026-08-28T16:58:24.044Z",
+      "reads": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/cli/scanners/schemas.mjs",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 50746,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/cli/scanners/schemas.mjs",
+          "tokens_estimated": 73,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/cli/validators/todo-tracking.mjs",
+          "tokens_estimated": 38,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/tests/schemas.test.mjs",
+          "tokens_estimated": 280,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/tests/todo-tracking.test.mjs",
+          "tokens_estimated": 281,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 330,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 7,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 9,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 290,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 50746,
+        "output_tokens_estimated": 1308,
+        "reads_count": 2,
+        "writes_count": 8,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 1
+      }
+    },
+    {
+      "id": "session-2026-08-28-2148",
+      "started": "2026-08-28T01:48:33.769Z",
+      "ended": "2026-08-28T17:00:52.804Z",
+      "reads": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/cli/scanners/schemas.mjs",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 50746,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/cli/scanners/schemas.mjs",
+          "tokens_estimated": 73,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/cli/validators/todo-tracking.mjs",
+          "tokens_estimated": 38,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/tests/schemas.test.mjs",
+          "tokens_estimated": 280,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/tests/todo-tracking.test.mjs",
+          "tokens_estimated": 281,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 330,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 7,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 9,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 290,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 50746,
+        "output_tokens_estimated": 1308,
+        "reads_count": 2,
+        "writes_count": 8,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 1
+      }
     }
   ],
   "daemon_usage": [],

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.34.2] - 2026-09-11
+
+### Fixed
+
+- **`@babel/parser` 7.29.7 → 7.29.8** — the newest 7.x patch, confirmed Node-18-compatible. Supersedes dependabot's repeat proposal of the 8.0.4 major bump (already reverted once in 0.34.1 — see below) with the correct fix. (#333)
+- **`docs-diff`'s `collectCodeTests` ignored `.docguardignore`/`config.ignore` during recursive test-directory scans**, so excluded test files could still count toward test-coverage validation, producing false positives on projects that explicitly excluded fixture/generated test dirs. Both recursive walkers now filter through `shouldIgnore` before collecting. (#334)
+- Doc example for `generate --dir` used a non-existent absolute path (`/path/to/project`), which fails with `EACCES` if anyone actually runs it verbatim. Now a relative path. (#338)
+
+### Changed
+
+- Bumped the `osv-scanner-action` reusable workflows (supply-chain scanning) from v2.3.8 to v2.5.1. (#336)
+- **`.github/dependabot.yml`: added an ignore rule for `@babel/parser` major-version bumps.** The 8.x line requires Node `^22.18.0 || >=24.11.0`, silently dropping Node 18 (which this project supports and CI gates on) — confirmed twice now (#331 in 0.34.1, #335 closed this release) that dependabot will keep proposing it every cycle since it can't see the `engines` mismatch. Patches/minors on the 7.x line still flow through normally.
+
+### Tests
+
+- Added coverage for previously-untested exports: `surfaceConfidence`, `astTierAvailable`, `parseCheckedTasks`, `compileGlob`, `isRunnerEnvVar`. (#337, #339)
+
+### Known issue
+
+- **npm publish is blocked on an expired `NPM_TOKEN`.** `v0.34.1`'s npm publish failed identically three times (Aug 28 ×2, Sep 11) with a `404` on the registry PUT immediately after successful provenance signing — not a registry incident (npm status green throughout, `docguard-cli` package unaffected on the registry). The token was last rotated 2026-05-22 and last worked for the 2026-08-13 (v0.34.0) publish; the failure window is consistent with npm's ~90-day Automation-token expiration. `v0.34.1` and `v0.34.2` are both tagged, GitHub-released, and on PyPI, but missing from npm until the token is rotated.
+
 ## [0.34.1] - 2026-08-28
 
 ### Fixed

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: docguard-cli
-Version: 0.34.1
+Version: 0.34.2
 Summary: The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. No Python dependencies (requires Node.js 18+).
 Project-URL: Homepage, https://github.com/raccioly/docguard
 Project-URL: Documentation, https://github.com/raccioly/docguard#readme

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/cli/validators/docs-diff.mjs

@@ -257,7 +257,10 @@ export function collectCodeTests(dir, config = {}) {
   // 2. recursive scan of each source root (co-located + nested __tests__)
   for (const root of resolveSourceRoots(dir, config)) {
     for (const f of getFilesRecursive(root, config)) {
-      if (isTest(f)) codeTests.add(relative(dir, f));
+      if (isTest(f)) {
+        const rel = relative(dir, f);
+        if (!shouldIgnore(rel, config)) codeTests.add(rel);
+      }
     }
   }
 
@@ -266,7 +269,10 @@ export function collectCodeTests(dir, config = {}) {
     const testDir = join(resolve(dir), td);
     if (!existsSync(testDir)) continue;
     for (const f of getFilesRecursive(testDir, config)) {
-      if (isTest(f)) codeTests.add(relative(dir, f));
+      if (isTest(f)) {
+        const rel = relative(dir, f);
+        if (!shouldIgnore(rel, config)) codeTests.add(rel);
+      }
     }
   }
 

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/docs/commands.md

@@ -132,7 +132,7 @@ npx docguard-cli init --skip-prompts            # No AI prompt output
 
 ```bash
 npx docguard-cli generate
-npx docguard-cli generate --dir /path/to/project
+npx docguard-cli generate --dir ./my-project
 ```
 
 **Detects:** Next.js, React, Vue, Angular, Express, Fastify, Hono, Django, FastAPI, SvelteKit, and more.

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/extensions/spec-kit-docguard/extension.yml

@@ -3,7 +3,7 @@ schema_version: "1.0"
 extension:
   id: "docguard"
   name: "DocGuard — CDD Enforcement"
-  version: "0.34.1"
+  version: "0.34.2"
   description: "Canonical-Driven Development enforcement as a true spec-kit extension. LLM-first design with automated validators, 4 AI behavior skills, spec-kit skill chaining, and workflow hooks. One pinned runtime dependency (@babel/parser); pure Node.js otherwise."
   author: "Ricardo Accioly"
   repository: "https://github.com/raccioly/docguard"

{docguard_cli-0.34.1/.agent → docguard_cli-0.34.2/extensions/spec-kit-docguard}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.1
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.1 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.1 → docguard_cli-0.34.2}/extensions/spec-kit-docguard/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.1
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.1 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.1/.agent → docguard_cli-0.34.2/extensions/spec-kit-docguard}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.1
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.1 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Review Skill