docguard-cli 0.34.4__tar.gz → 0.34.5__tar.gz

{docguard_cli-0.34.4/extensions/spec-kit-docguard → docguard_cli-0.34.5/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.4
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.4 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.4 → docguard_cli-0.34.5}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.4
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.4 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.4/extensions/spec-kit-docguard → docguard_cli-0.34.5/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.4
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.4 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.4/extensions/spec-kit-docguard → docguard_cli-0.34.5/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.4
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.4 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.4 → docguard_cli-0.34.5}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.4
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.4 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.34.4 → docguard_cli-0.34.5}/.github/workflows/auto-merge.yml

@@ -56,7 +56,8 @@ jobs:
 
             const BOT_DEPENDABOT = 'dependabot[bot]';
             const BOT_JULES = 'google-labs-jules[bot]';
-            if (![BOT_DEPENDABOT, BOT_JULES].includes(author)) {
+            const BOT_ACTIONS = 'github-actions[bot]';
+            if (![BOT_DEPENDABOT, BOT_JULES, BOT_ACTIONS].includes(author)) {
               core.info(`#${num} authored by ${author} (not a handled bot) — leaving alone.`);
               return;
             }
@@ -96,7 +97,23 @@ jobs:
             });
             const paths = files.map((f) => f.filename);
 
-            if (author === BOT_DEPENDABOT) {
+            if (author === BOT_ACTIONS) {
+              // Release PRs cut by scheduled-release.yml. Tightly constrained:
+              // must come from a release/ branch and touch ONLY the version +
+              // changelog + generated extension metadata. Anything else under
+              // this bot's name is not something we cut, so hold it.
+              if (!pr.head.ref.startsWith('release/')) {
+                await hold('needs-review', `an automated PR from a non-\`release/\` branch (\`${pr.head.ref}\`).`);
+                return;
+              }
+              const ALLOWED = /^(package(-lock)?\.json|CHANGELOG\.md|extensions\/|\.agent\/)/;
+              const unexpected = paths.filter((p) => !ALLOWED.test(p));
+              if (unexpected.length) {
+                await hold('needs-review', `a release PR touching unexpected files:\n${unexpected.map((p) => `- \`${p}\``).join('\n')}`);
+                return;
+              }
+              core.info(`#${num} automated release PR (${pr.head.ref}) — eligible.`);
+            } else if (author === BOT_DEPENDABOT) {
               // Version delta from the title: "bump X from 1.2.3 to 1.2.4"
               const m = /from (\d+)\.(\d+)\.(\d+)\S* to (\d+)\.(\d+)\.(\d+)/.exec(pr.title || '');
               if (!m) { await hold('needs-review', 'could not parse the version delta from the PR title.'); return; }

{docguard_cli-0.34.4 → docguard_cli-0.34.5}/.github/workflows/release.yml

@@ -204,7 +204,16 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: 20
-          registry-url: 'https://registry.npmjs.org'
+          # DELIBERATELY NO `registry-url`. setup-node's registry-url writes an
+          # .npmrc containing:
+          #     //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+          # With NODE_AUTH_TOKEN removed (Trusted Publishing), that expands to
+          # an EMPTY token. npm then takes the token-auth path holding no token
+          # and 404s, never attempting the OIDC exchange at all. v0.34.4 failed
+          # exactly this way: npm@11 installed fine, provenance signed fine, no
+          # OIDC notice in the log, then "404 ... could not be found or you do
+          # not have permission". npm defaults to registry.npmjs.org anyway, so
+          # dropping this loses nothing.
 
       # Trusted Publishing (OIDC) needs npm CLI >= 11.5.0; Node 20's bundled
       # npm predates that, so self-update first. Pinned to the 11.x line
@@ -223,6 +232,33 @@ jobs:
       # same way; a short-lived token is minted per run.
       - run: npm install -g npm@11
 
+      # Fail LOUDLY if anything put an auth token back in the npm config.
+      # A stray (even empty) _authToken silently routes npm away from OIDC and
+      # the only symptom is a generic 404 that reads like a missing package --
+      # it cost four releases (v0.34.1 through v0.34.4) to identify. Better to
+      # break here with a clear message than to publish-fail cryptically again.
+      - name: Assert no npm auth token is configured (OIDC must be the path)
+        run: |
+          npm --version
+          # NOTE: `npm config get <key>` refuses on auth keys ("protected") and
+          # `npm config list --json` omits them entirely, so neither can be used
+          # to detect this. Grep the actual .npmrc files instead.
+          USERCONFIG=$(npm config list | sed -n 's/^userconfig = "\(.*\)"$/\1/p')
+          HITS=""
+          for f in "$USERCONFIG" ".npmrc" "$HOME/.npmrc"; do
+            if [ -n "$f" ] && [ -f "$f" ] && grep -qE '_authToken|_auth[[:space:]]*=' "$f"; then
+              HITS="$HITS $f"
+            fi
+          done
+          if [ -n "$HITS" ]; then
+            echo "::error::npm auth token found in:$HITS"
+            echo "::error::Even an EMPTY _authToken routes npm to token auth and skips OIDC/Trusted Publishing —"
+            echo "::error::the only symptom is a generic 404 that reads like a missing package."
+            echo "::error::Remove registry-url from setup-node and any NODE_AUTH_TOKEN from this job."
+            exit 1
+          fi
+          echo "No auth token configured — npm will use OIDC (Trusted Publishing)."
+
       - name: Publish (with provenance)
         run: npm publish --provenance
 

{docguard_cli-0.34.4 → docguard_cli-0.34.5}/.github/workflows/scheduled-release.yml

@@ -124,14 +124,48 @@ jobs:
           npm test
           node cli/docguard.mjs guard || [ $? -eq 2 ]
 
-      - name: Commit and push (this triggers release.yml)
+      # Two stacked constraints make a direct `git push origin HEAD:main`
+      # impossible here, so this opens a PR instead:
+      #
+      #   1. main requires a pull request. github-actions[bot] is not an admin
+      #      and has no bypass, so a direct push is rejected outright.
+      #   2. A PR opened with GITHUB_TOKEN does NOT trigger further workflow
+      #      runs (GitHub's loop guard). So ci.yml would never fire on it, the
+      #      required test (18/20/22/24) checks would never report, and the PR
+      #      would sit forever on "Expected — waiting for status to be
+      #      reported" — unmergeable.
+      #
+      # So: push a branch (unprotected), open the PR, then explicitly dispatch
+      # ci.yml against that branch so the checks DO report on its head SHA.
+      # auto-merge.yml then merges it once all four legs are green, and the
+      # resulting package.json change on main triggers release.yml to publish.
+      - name: Open release PR and kick off its CI
         if: steps.check.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          BRANCH="release/v${NEW_VERSION}"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH"
           git add package.json package-lock.json CHANGELOG.md extensions/ .agent/ 2>/dev/null || true
           git commit -m "release: v${NEW_VERSION} — automated weekly batch
 
           Cut by .github/workflows/scheduled-release.yml. Publishing itself is
-          handled by release.yml, which triggers on this package.json change."
-          git push origin HEAD:main
+          handled by release.yml, which triggers once this lands on main."
+          git push origin "$BRANCH"
+
+          gh pr create \
+            --base main \
+            --head "$BRANCH" \
+            --title "release: v${NEW_VERSION} — automated weekly batch" \
+            --body "Automated weekly release cut by \`scheduled-release.yml\`.
+
+          Batches everything merged since \`${{ steps.check.outputs.last_tag }}\`. Tests and \`guard\` already passed on this tree before the PR was opened; CI is dispatched separately below so the required checks report (a GITHUB_TOKEN-opened PR does not trigger workflows on its own).
+
+          Once green, \`auto-merge.yml\` merges this, and the \`package.json\` change triggers \`release.yml\` to tag and publish."
+
+          # Required checks must actually report on this SHA or the PR can
+          # never merge -- see constraint 2 above.
+          gh workflow run ci.yml --ref "$BRANCH"
+          echo "Opened $BRANCH and dispatched CI."

{docguard_cli-0.34.4 → docguard_cli-0.34.5}/.wolf/anatomy.md

@@ -1,6 +1,6 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T15:34:41.013Z
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T15:50:08.916Z
 > Files: 707 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
@@ -29,7 +29,7 @@
 - `.pre-commit-hooks.yaml` — DocGuard hooks for the pre-commit framework (https://pre-commit.com). (~490 tok)
 - `action.yml` — Declares fs (~7591 tok)
 - `AGENTS.md` — AI Agent Instructions — DocGuard (~1827 tok)
-- `CHANGELOG.md` — Changelog (~52543 tok)
+- `CHANGELOG.md` — Changelog (~53296 tok)
 - `CLAUDE.md` — OpenWolf (~57 tok)
 - `CODE_OF_CONDUCT.md` — Contributor Covenant Code of Conduct (~532 tok)
 - `COMPARISONS.md` — Comparisons & Honest Limitations (~3382 tok)
@@ -959,11 +959,11 @@
 
 ## .github/workflows/
 
-- `auto-merge.yml` — CI: Auto-merge (green bot PRs) (~1917 tok)
+- `auto-merge.yml` — CI: Auto-merge (green bot PRs) (~2234 tok)
 - `ci.yml` — CI: DocGuard CI (~1843 tok)
 - `jules-triage.yml` — CI: Jules PR Triage (~1635 tok)
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~4258 tok)
-- `scheduled-release.yml` — CI: Scheduled Release (~1539 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~4892 tok)
+- `scheduled-release.yml` — CI: Scheduled Release (~2099 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 
 ## .jules/
@@ -1116,7 +1116,7 @@
 - `canonical-docs-nested-phase2.test.mjs` — Phase 2 of the nested-canonical-docs fix: the remaining 14 sites found (~1482 tok)
 - `canonical-docs-nested.test.mjs` — Regression: canonical docs in SUBFOLDERS must be seen by every consumer. (~2028 tok)
 - `changelog.test.mjs` — Exports x, x (~1315 tok)
-- `commands.test.mjs` — DocGuard CLI Tests — Tests all commands and flags (~10442 tok)
+- `commands.test.mjs` — DocGuard CLI Tests — Tests all commands and flags (~10729 tok)
 - `cross-reference.test.mjs` — Cross-Reference Validator — K-7 / S-8 (~4060 tok)
 - `ensure-skills-idempotent.test.mjs` — v0.24 — Skill install is idempotent (field report, Issue D). (~1133 tok)
 - `field-report-3-deferred.test.mjs` — v0.28 — the detection-gap items deferred from LLM field report #3. (~3325 tok)

{docguard_cli-0.34.4 → docguard_cli-0.34.5}/.wolf/buglog.json

@@ -4624,6 +4624,86 @@
       "related_bugs": [],
       "occurrences": 1,
       "last_seen": "2026-09-11T15:34:41.023Z"
+    },
+    {
+      "id": "bug-280",
+      "timestamp": "2026-09-11T15:44:51.130Z",
+      "error_message": "Significant refactor of ",
+      "file": ".github/workflows/release.yml",
+      "root_cause": "9 lines replaced/restructured",
+      "fix": "Rewrote 16→21 lines (9 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:44:51.130Z"
+    },
+    {
+      "id": "bug-281",
+      "timestamp": "2026-09-11T15:45:19.623Z",
+      "error_message": "Significant refactor of ",
+      "file": ".github/workflows/scheduled-release.yml",
+      "root_cause": "3 lines replaced/restructured",
+      "fix": "Rewrote 11→45 lines (3 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:45:19.623Z"
+    },
+    {
+      "id": "bug-282",
+      "timestamp": "2026-09-11T15:45:32.759Z",
+      "error_message": "Wrong condition in logic",
+      "file": ".github/workflows/auto-merge.yml",
+      "root_cause": "Condition was: if (author === BOT_DEPENDABOT)",
+      "fix": "Changed to: if (author === BOT_ACTIONS)",
+      "tags": [
+        "auto-detected",
+        "logic-fix",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:45:32.759Z"
+    },
+    {
+      "id": "bug-283",
+      "timestamp": "2026-09-11T15:49:08.791Z",
+      "error_message": "Significant refactor of ",
+      "file": "tests/commands.test.mjs",
+      "root_cause": "3 lines replaced/restructured",
+      "fix": "Rewrote 8→25 lines (3 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:49:08.791Z"
+    },
+    {
+      "id": "bug-284",
+      "timestamp": "2026-09-11T15:50:08.928Z",
+      "error_message": "Incorrect value in code",
+      "file": "CHANGELOG.md",
+      "root_cause": "Had `scheduled-release.yml`",
+      "fix": "Changed to `tests/commands.test.mjs`",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:50:08.928Z"
     }
   ]
 }

{docguard_cli-0.34.4 → docguard_cli-0.34.5}/.wolf/hooks/_session.json

@@ -21,6 +21,11 @@
       "count": 3,
       "tokens": 4114,
       "first_read": "2026-09-11T15:15:37.248Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bcylzwtls.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T15:48:05.168Z"
     }
   },
   "files_written": [
@@ -113,21 +118,76 @@
       "action": "edit",
       "tokens": 742,
       "at": "2026-09-11T15:34:41.021Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 231,
+      "at": "2026-09-11T15:44:03.069Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 378,
+      "at": "2026-09-11T15:44:14.382Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 338,
+      "at": "2026-09-11T15:44:51.128Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/scheduled-release.yml",
+      "action": "edit",
+      "tokens": 739,
+      "at": "2026-09-11T15:45:19.621Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/auto-merge.yml",
+      "action": "edit",
+      "tokens": 107,
+      "at": "2026-09-11T15:45:25.169Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/auto-merge.yml",
+      "action": "edit",
+      "tokens": 310,
+      "at": "2026-09-11T15:45:32.758Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 638,
+      "at": "2026-09-11T15:46:08.414Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/tests/commands.test.mjs",
+      "action": "edit",
+      "tokens": 419,
+      "at": "2026-09-11T15:49:08.790Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 254,
+      "at": "2026-09-11T15:50:08.926Z"
     }
   ],
   "edit_counts": {
     ".github/dependabot.yml": 1,
-    "CHANGELOG.md": 5,
+    "CHANGELOG.md": 7,
     "package.json": 3,
-    ".github/workflows/release.yml": 2,
+    ".github/workflows/release.yml": 5,
     ".github/workflows/ci.yml": 1,
-    ".github/workflows/auto-merge.yml": 1,
-    ".github/workflows/scheduled-release.yml": 1,
-    ".github/workflows/jules-triage.yml": 1
+    ".github/workflows/auto-merge.yml": 3,
+    ".github/workflows/scheduled-release.yml": 2,
+    ".github/workflows/jules-triage.yml": 1,
+    "tests/commands.test.mjs": 1
   },
   "anatomy_hits": 2,
-  "anatomy_misses": 2,
+  "anatomy_misses": 3,
   "repeated_reads_warned": 4,
   "cerebrum_warnings": 0,
-  "stop_count": 8
+  "stop_count": 15
 }

{docguard_cli-0.34.4 → docguard_cli-0.34.5}/.wolf/memory.md

@@ -1290,3 +1290,19 @@
 | 11:33 | Created .github/workflows/scheduled-release.yml | — | ~1539 |
 | 11:33 | Edited .github/workflows/jules-triage.yml | added error handling | ~464 |
 | 11:34 | Edited CHANGELOG.md | added error handling | ~693 |
+| 11:36 | Session end: 15 writes across 8 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 4 reads | ~63299 tok |
+| 11:37 | Session end: 15 writes across 8 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 4 reads | ~63299 tok |
+| 11:37 | Session end: 15 writes across 8 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 4 reads | ~63299 tok |
+| 11:38 | Session end: 15 writes across 8 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 4 reads | ~63299 tok |
+| 11:39 | Session end: 15 writes across 8 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 4 reads | ~63299 tok |
+| 11:41 | Session end: 15 writes across 8 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 4 reads | ~63299 tok |
+| 11:44 | Edited .github/workflows/release.yml | expanded (+9 lines) | ~231 |
+| 11:44 | Edited .github/workflows/release.yml | expanded (+22 lines) | ~378 |
+| 11:44 | Edited .github/workflows/release.yml | 16→21 lines | ~338 |
+| 11:45 | Edited .github/workflows/scheduled-release.yml | expanded (+34 lines) | ~739 |
+| 11:45 | Edited .github/workflows/auto-merge.yml | 6→7 lines | ~107 |
+| 11:45 | Edited .github/workflows/auto-merge.yml | added 3 condition(s) | ~310 |
+| 11:46 | Edited CHANGELOG.md | expanded (+10 lines) | ~595 |
+| 11:47 | Session end: 22 writes across 8 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 4 reads | ~66040 tok |
+| 11:49 | Edited tests/commands.test.mjs | expanded (+17 lines) | ~391 |
+| 11:50 | Edited CHANGELOG.md | 1→2 lines | ~237 |