docguard-cli 0.34.5__tar.gz → 0.34.6__tar.gz

{docguard_cli-0.34.5/extensions/spec-kit-docguard → docguard_cli-0.34.6/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.6
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.6 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.5 → docguard_cli-0.34.6}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.6
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.6 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.5/extensions/spec-kit-docguard → docguard_cli-0.34.6/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.6
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.6 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.5/extensions/spec-kit-docguard → docguard_cli-0.34.6/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.6
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.6 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.5 → docguard_cli-0.34.6}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.6
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.6 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.34.5 → docguard_cli-0.34.6}/.github/workflows/release.yml

@@ -203,64 +203,59 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: 20
-          # DELIBERATELY NO `registry-url`. setup-node's registry-url writes an
-          # .npmrc containing:
-          #     //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
-          # With NODE_AUTH_TOKEN removed (Trusted Publishing), that expands to
-          # an EMPTY token. npm then takes the token-auth path holding no token
-          # and 404s, never attempting the OIDC exchange at all. v0.34.4 failed
-          # exactly this way: npm@11 installed fine, provenance signed fine, no
-          # OIDC notice in the log, then "404 ... could not be found or you do
-          # not have permission". npm defaults to registry.npmjs.org anyway, so
-          # dropping this loses nothing.
-
-      # Trusted Publishing (OIDC) needs npm CLI >= 11.5.0; Node 20's bundled
-      # npm predates that, so self-update first. Pinned to the 11.x line
-      # (NOT `npm@latest`) because npm 12 requires Node ^22.22.2 || ^24.15.0
-      # || >=26.0.0 -- newer than the Node 20 this job runs on. Learned this
-      # the hard way: the first cut of this fix used `npm@latest` and broke
-      # the same way the @babel/parser major bump did earlier (bug-255) --
-      # an unpinned "latest" floated past what this job's Node version
-      # supports. npm 11.x itself supports Node ^20.17.0 || >=22.9.0, so it
-      # installs cleanly here. No NODE_AUTH_TOKEN needed — npm exchanges the
-      # id-token (permissions, above) directly with the registry via the
-      # trusted-publisher connection configured on npmjs.com
-      # (raccioly/docguard, release.yml). This replaces the NPM_TOKEN-based
-      # auth that silently broke for 2 releases (v0.34.1, v0.34.2 never
-      # reached npm) when the token expired — nothing here can expire the
-      # same way; a short-lived token is minted per run.
+          # MUST be >= 22.14.0. npm Trusted Publishing (OIDC) requires
+          # npm CLI >= 11.5.1 AND Node >= 22.14.0, per npm's own docs.
+          # This job ran Node 20 for five straight failed releases
+          # (v0.34.1 - v0.34.5): below that floor npm never even ATTEMPTS the
+          # OIDC exchange, it just falls through to token auth. That produced
+          # two red herrings in sequence -- E404 "not found or you do not have
+          # permission" while an empty _authToken was present, then ENEEDAUTH
+          # once it wasn't -- neither of which names the actual cause.
+          node-version: 24
+          # registry-url IS required (npm's documented example sets it). An
+          # earlier theory blamed the empty _authToken it writes; that was
+          # wrong. The empty token only mattered BECAUSE Node 20 had already
+          # taken OIDC off the table, leaving token auth as the only path.
+          registry-url: 'https://registry.npmjs.org'
+
+      # Belt and braces: Node 24 already bundles npm >= 11.5.1, but pin
+      # explicitly so a runner-image change can't silently drop below the
+      # floor. npm@11 (not @latest) -- npm 12 raised its own Node floor, and
+      # an unpinned "latest" is exactly how bug-258 happened.
       - run: npm install -g npm@11
 
-      # Fail LOUDLY if anything put an auth token back in the npm config.
-      # A stray (even empty) _authToken silently routes npm away from OIDC and
-      # the only symptom is a generic 404 that reads like a missing package --
-      # it cost four releases (v0.34.1 through v0.34.4) to identify. Better to
-      # break here with a clear message than to publish-fail cryptically again.
-      - name: Assert no npm auth token is configured (OIDC must be the path)
+      # Assert the OIDC preconditions up front, rather than discovering a
+      # violation three minutes later as an unrelated-looking auth error.
+      - name: Assert Trusted Publishing preconditions
         run: |
-          npm --version
-          # NOTE: `npm config get <key>` refuses on auth keys ("protected") and
-          # `npm config list --json` omits them entirely, so neither can be used
-          # to detect this. Grep the actual .npmrc files instead.
-          USERCONFIG=$(npm config list | sed -n 's/^userconfig = "\(.*\)"$/\1/p')
-          HITS=""
-          for f in "$USERCONFIG" ".npmrc" "$HOME/.npmrc"; do
-            if [ -n "$f" ] && [ -f "$f" ] && grep -qE '_authToken|_auth[[:space:]]*=' "$f"; then
-              HITS="$HITS $f"
-            fi
-          done
-          if [ -n "$HITS" ]; then
-            echo "::error::npm auth token found in:$HITS"
-            echo "::error::Even an EMPTY _authToken routes npm to token auth and skips OIDC/Trusted Publishing —"
-            echo "::error::the only symptom is a generic 404 that reads like a missing package."
-            echo "::error::Remove registry-url from setup-node and any NODE_AUTH_TOKEN from this job."
+          NPM_V=$(npm --version)
+          echo "node=$(node -p 'process.versions.node') npm=$NPM_V"
+          node -e '
+            const [maj, min] = process.versions.node.split(".").map(Number);
+            if (!(maj > 22 || (maj === 22 && min >= 14))) {
+              console.error(`::error::Node ${process.versions.node} is below the 22.14.0 floor npm Trusted Publishing requires. OIDC is silently not attempted below it and publish fails as an auth error.`);
+              process.exit(1);
+            }
+          '
+          node -e '
+            const v = process.argv[1].split(".").map(Number);
+            if (!(v[0] > 11 || (v[0] === 11 && (v[1] > 5 || (v[1] === 5 && v[2] >= 1))))) {
+              console.error(`::error::npm ${process.argv[1]} is below the 11.5.1 floor npm Trusted Publishing requires.`);
+              process.exit(1);
+            }
+          ' "$NPM_V"
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::error::ACTIONS_ID_TOKEN_REQUEST_URL is unset — this job lacks id-token: write, so no OIDC token can be minted."
             exit 1
           fi
-          echo "No auth token configured — npm will use OIDC (Trusted Publishing)."
-
-      - name: Publish (with provenance)
-        run: npm publish --provenance
+          echo "OIDC preconditions satisfied."
+
+      # No --provenance flag and no NODE_AUTH_TOKEN: under Trusted Publishing
+      # npm generates provenance attestations automatically, and the OIDC
+      # exchange against the trusted-publisher connection on npmjs.com
+      # (raccioly/docguard -> release.yml) IS the authentication.
+      - name: Publish (provenance is automatic under Trusted Publishing)
+        run: npm publish
 
   # ── Step 6: Publish to PyPI ────────────────────────────────────────────
   publish-pypi:

{docguard_cli-0.34.5 → docguard_cli-0.34.6}/.wolf/anatomy.md

@@ -1,6 +1,6 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T15:50:08.916Z
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T15:58:20.999Z
 > Files: 707 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
@@ -29,7 +29,7 @@
 - `.pre-commit-hooks.yaml` — DocGuard hooks for the pre-commit framework (https://pre-commit.com). (~490 tok)
 - `action.yml` — Declares fs (~7591 tok)
 - `AGENTS.md` — AI Agent Instructions — DocGuard (~1827 tok)
-- `CHANGELOG.md` — Changelog (~53296 tok)
+- `CHANGELOG.md` — Changelog (~53685 tok)
 - `CLAUDE.md` — OpenWolf (~57 tok)
 - `CODE_OF_CONDUCT.md` — Contributor Covenant Code of Conduct (~532 tok)
 - `COMPARISONS.md` — Comparisons & Honest Limitations (~3382 tok)
@@ -962,7 +962,7 @@
 - `auto-merge.yml` — CI: Auto-merge (green bot PRs) (~2234 tok)
 - `ci.yml` — CI: DocGuard CI (~1843 tok)
 - `jules-triage.yml` — CI: Jules PR Triage (~1635 tok)
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~4892 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~4763 tok)
 - `scheduled-release.yml` — CI: Scheduled Release (~2099 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 

{docguard_cli-0.34.5 → docguard_cli-0.34.6}/.wolf/buglog.json

@@ -4704,6 +4704,54 @@
       "related_bugs": [],
       "occurrences": 1,
       "last_seen": "2026-09-11T15:50:08.928Z"
+    },
+    {
+      "id": "bug-285",
+      "timestamp": "2026-09-11T15:55:09.291Z",
+      "error_message": "Significant refactor of ",
+      "file": "CHANGELOG.md",
+      "root_cause": "2 lines replaced/restructured",
+      "fix": "Rewrote 9→21 lines (2 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:55:09.291Z"
+    },
+    {
+      "id": "bug-286",
+      "timestamp": "2026-09-11T15:55:22.456Z",
+      "error_message": "Incorrect value in code",
+      "file": "CHANGELOG.md",
+      "root_cause": "Had `.npmrc`",
+      "fix": "Changed to `npm config get`",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:55:22.456Z"
+    },
+    {
+      "id": "bug-287",
+      "timestamp": "2026-09-11T15:57:59.781Z",
+      "error_message": "Significant refactor of ",
+      "file": ".github/workflows/release.yml",
+      "root_cause": "11 lines replaced/restructured",
+      "fix": "Rewrote 14→17 lines (11 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:57:59.781Z"
     }
   ]
 }

{docguard_cli-0.34.5 → docguard_cli-0.34.6}/.wolf/hooks/_session.json

@@ -18,14 +18,24 @@
       "first_read": "2026-09-11T14:49:34.552Z"
     },
     "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml": {
-      "count": 3,
-      "tokens": 4114,
+      "count": 6,
+      "tokens": 4964,
       "first_read": "2026-09-11T15:15:37.248Z"
     },
     "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bcylzwtls.output": {
       "count": 1,
       "tokens": 0,
       "first_read": "2026-09-11T15:48:05.168Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bno5towq5.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T15:52:48.971Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bafoc2qz9.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T15:56:42.484Z"
     }
   },
   "files_written": [
@@ -172,13 +182,37 @@
       "action": "edit",
       "tokens": 254,
       "at": "2026-09-11T15:50:08.926Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 794,
+      "at": "2026-09-11T15:55:09.289Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 138,
+      "at": "2026-09-11T15:55:22.453Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 303,
+      "at": "2026-09-11T15:57:59.778Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 594,
+      "at": "2026-09-11T15:58:21.011Z"
     }
   ],
   "edit_counts": {
     ".github/dependabot.yml": 1,
-    "CHANGELOG.md": 7,
+    "CHANGELOG.md": 9,
     "package.json": 3,
-    ".github/workflows/release.yml": 5,
+    ".github/workflows/release.yml": 7,
     ".github/workflows/ci.yml": 1,
     ".github/workflows/auto-merge.yml": 3,
     ".github/workflows/scheduled-release.yml": 2,
@@ -186,8 +220,8 @@
     "tests/commands.test.mjs": 1
   },
   "anatomy_hits": 2,
-  "anatomy_misses": 3,
-  "repeated_reads_warned": 4,
+  "anatomy_misses": 5,
+  "repeated_reads_warned": 7,
   "cerebrum_warnings": 0,
-  "stop_count": 15
+  "stop_count": 17
 }

{docguard_cli-0.34.5 → docguard_cli-0.34.6}/.wolf/memory.md

@@ -1306,3 +1306,9 @@
 | 11:47 | Session end: 22 writes across 8 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 4 reads | ~66040 tok |
 | 11:49 | Edited tests/commands.test.mjs | expanded (+17 lines) | ~391 |
 | 11:50 | Edited CHANGELOG.md | 1→2 lines | ~237 |
+| 11:51 | Session end: 24 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 5 reads | ~66713 tok |
+| 11:55 | Edited CHANGELOG.md | expanded (+12 lines) | ~741 |
+| 11:55 | Edited CHANGELOG.md | 3→2 lines | ~129 |
+| 11:56 | Session end: 26 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 6 reads | ~68423 tok |
+| 11:57 | Edited .github/workflows/release.yml | 14→17 lines | ~303 |
+| 11:58 | Edited .github/workflows/release.yml | added 2 condition(s) | ~594 |