scar-cli 0.6.1__tar.gz → 0.7.0__tar.gz

scar_cli-0.7.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.7.0"
+}

scar_cli-0.7.0/.scars/0007-release-please-config-change-skips-open-pr.landmine.md

@@ -0,0 +1,38 @@
+---
+id: 7
+type: landmine
+title: Changing release-please extra-files config does NOT retro-apply to an already-open release PR
+severity: medium
+confidence: 0.85
+created: 2026-06-26
+authors: ["claude-code", "Kibukx"]
+anchors:
+  - path: release-please-config.json
+  - path: .github/workflows/release.yml
+evidence:
+  - pr: 64
+  - pr: 66
+  - note: v0.6.1 release cycle, 2026-06-26
+expires:
+  condition: "release-please gains retro-application of config changes to open release PRs, or the repo stops carrying version in extra files (plugin.json)"
+  review_after: 2027-06-26
+status: active
+---
+
+If a release PR is already open and you then merge a change to `release-please-config.json`
+(e.g. adding/altering `extra-files`), release-please will NOT retro-apply the new config to
+that open PR — especially when the commit that lands the config is a non-releasable type
+(`ci:`, `chore:`), because release-please sees no new releasable commit and leaves the
+existing PR untouched.
+
+Observed live: PR #64 (release 0.6.1) was computed from the #63 `fix:` commit BEFORE #65 added
+the `extra-files` updater for `plugin/plugin.json`. When #65 (a `ci:` commit) merged,
+release-please re-ran but did not re-bump the open PR, so #64 bumped `pyproject.toml` only.
+`plugin/plugin.json` stayed behind and the `test_plugin_version_matches_pyproject` drift guard
+failed CI — correctly blocking a broken release.
+
+Fix when this happens: close the stale release PR, delete its `release-please--branches--main`
+branch, and re-dispatch the Release workflow (`gh workflow run release.yml`). The fresh PR is
+built from scratch and applies the current `extra-files` config. Do NOT hand-patch the version
+into the open release branch — it leaves the manifest/state half-migrated. The drift guard is
+the safety net: it makes this failure loud instead of shipping a mismatched manifest.

{scar_cli-0.6.1 → scar_cli-0.7.0}/.scars/candidates/fp-log.txt

@@ -4,3 +4,4 @@
 2026-06-13 — false trigger: signals from iterative re-anchoring + a caught staging bug (fixed #51) + gh CLI flakiness; all genuine lessons already captured as scars #5/#6 and issues #50
 2026-06-13 false trigger: harvest-labeling session — 'revert/reverted/abandoned' prose describes ANOTHER repo's history (homelab-apps reverts judged as scar candidates), not an approach abandoned here; tool_errors were a wc-on-wrong-path + benign exit-1 during label recording. Curation work trips the drafter like meta-sessions do (FP #1).
 2026-06-24 false trigger: #54 scorer investigation — 'revert' is feature-domain (the revert heuristic) + 'user_corrections'/'wrong' is me correcting the ISSUE BODY's mechanism claim (flapping base vs uncapped osc bonus), not abandoning a tried code approach. Read-only mapping + scope question; no code written, nothing deadended. Same self-ref class as FP #1/#5: sessions reasoning about the scorer trip the scorer.
+2026-06-29 — FP: 'revert' was #54 harvest revert-signal discussion; corrections were process steering (wait for investigation, repeat question); no approach tried-and-abandoned.

{scar_cli-0.6.1/plugin/skills/scar-authoring/assets → scar_cli-0.7.0/.scars}/template.md

@@ -13,7 +13,10 @@ anchors:
   - path: src/module/      # file or directory this protects
   - pattern: "regex"       # optional: fires when matching code appears in ANY new/edited file
 evidence:
-  - commit: abc1234        # at least one receipt: commit, pr, incident, or note
+  - pr: 123                # at least one receipt: pr, issue, url, commit, incident, or note
+  # Prefer pr/issue/url over a bare commit: SHA — feature-branch SHAs orphan on squash-merge.
+  - issue: 50
+  - url: https://github.com/org/repo/commit/abc1234
 expires:
   condition: "what change would make this scar obsolete"
   review_after: 1971-01-01 # force a freshness look even if condition never triggers

{scar_cli-0.6.1 → scar_cli-0.7.0}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.7.0](https://github.com/Daily-Nerd/Scar/compare/v0.6.1...v0.7.0) (2026-06-30)
+
+
+### Features
+
+* durable evidence forms (issue:/url:) to survive squash-merge ([#50](https://github.com/Daily-Nerd/Scar/issues/50)) ([#74](https://github.com/Daily-Nerd/Scar/issues/74)) ([d558849](https://github.com/Daily-Nerd/Scar/commit/d558849652c068a9679617c5ed522b3eefffcc78))
+
+
+### Bug Fixes
+
+* **harvest:** exclude vendored/scaffold paths from comment-archaeology ([#72](https://github.com/Daily-Nerd/Scar/issues/72)) ([#73](https://github.com/Daily-Nerd/Scar/issues/73)) ([919add4](https://github.com/Daily-Nerd/Scar/commit/919add4b3503b65f866274d97995088a0aa8612a))
+* **parser:** strip unquoted inline comments in _field ([#70](https://github.com/Daily-Nerd/Scar/issues/70)) ([03ec578](https://github.com/Daily-Nerd/Scar/commit/03ec578290f8dd8ce4ed436367a12eabbdb5c120))
+
 ## [0.6.1](https://github.com/Daily-Nerd/Scar/compare/v0.6.0...v0.6.1) (2026-06-26)
 
 

{scar_cli-0.6.1 → scar_cli-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scar-cli
-Version: 0.6.1
+Version: 0.7.0
 Summary: SCAR — version control for negative knowledge (deadends, fences, landmines)
 License: MIT
 License-File: LICENSE

{scar_cli-0.6.1 → scar_cli-0.7.0}/plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "scar",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "SCAR — version control for negative knowledge (deadends, fences, landmines)",
   "hooks": {
     "PreToolUse": [

{scar_cli-0.6.1/src/scar → scar_cli-0.7.0/plugin}/skills/scar-authoring/assets/template.md

@@ -13,7 +13,10 @@ anchors:
   - path: src/module/      # file or directory this protects
   - pattern: "regex"       # optional: fires when matching code appears in ANY new/edited file
 evidence:
-  - commit: abc1234        # at least one receipt: commit, pr, incident, or note
+  - pr: 123                # at least one receipt: pr, issue, url, commit, incident, or note
+  # Prefer pr/issue/url over a bare commit: SHA — feature-branch SHAs orphan on squash-merge.
+  - issue: 50
+  - url: https://github.com/org/repo/commit/abc1234
 expires:
   condition: "what change would make this scar obsolete"
   review_after: 1971-01-01 # force a freshness look even if condition never triggers

{scar_cli-0.6.1 → scar_cli-0.7.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "scar-cli"
-version = "0.6.1"
+version = "0.7.0"
 description = "SCAR — version control for negative knowledge (deadends, fences, landmines)"
 readme = "README.md"
 requires-python = ">=3.10"

{scar_cli-0.6.1 → scar_cli-0.7.0}/src/scar/harvest.py

@@ -351,6 +351,18 @@ def _in_scars(path: str) -> bool:
     return ".scars" in path.split("/")
 
 
+# Vendored dependency trees + tool-scaffold dirs. Their files carry DO-NOT /
+# load-bearing prose the project never wrote (third-party docs, generated
+# config), so comment-archaeology self-matches the same way #55's .scars did.
+# Matched as any path segment — a nested node_modules/ is the same noise (#72).
+_VENDORED_SEGMENTS = frozenset({"node_modules", "vendor", ".tessl", ".kiro"})
+
+
+def _is_vendored(path: str) -> bool:
+    """True if a candidate path lives under a vendored/scaffold tree (#72)."""
+    return bool(_VENDORED_SEGMENTS & set(path.split("/")))
+
+
 def _annotate_and_sort(candidates: list[dict], signal_type: str,
                        now_months: int | None = None) -> list[dict]:
     """Add 'score' and 'id' fields to each candidate, then sort by score desc."""
@@ -370,12 +382,16 @@ def harvest(repo: Path) -> dict[str, list[dict]]:
         "flapping": _flapping(repo),
         "comments": _comment_archaeology(repo),
     }
-    # Drop a repo's own .scars/ tree — self-ref noise, never a fresh candidate
-    # (#55). Filtered in code, not via a git grep pathspec (landmine #1: a
-    # zero-match pathspec silently empties the whole result set).
+    # Drop self-ref noise (#55: a repo's own .scars/ tree) and vendored/scaffold
+    # noise (#72: node_modules, vendor, tool-scaffold docs). Filtered in code,
+    # not via a git grep pathspec (landmine #1: a zero-match pathspec silently
+    # empties the whole result set).
+    def _excluded(section: str, c: dict) -> bool:
+        path = _candidate_path(_SECTION_TYPES[section], c)
+        return _in_scars(path) or _is_vendored(path)
+
     raw = {
-        section: [c for c in candidates
-                  if not _in_scars(_candidate_path(_SECTION_TYPES[section], c))]
+        section: [c for c in candidates if not _excluded(section, c)]
         for section, candidates in raw.items()
     }
     return {

{scar_cli-0.6.1 → scar_cli-0.7.0}/src/scar/lint.py

@@ -9,7 +9,7 @@ import re
 import time
 from dataclasses import dataclass
 
-from .model import SEVERITIES, STATUSES, TYPES, ParseError, parse_scar_text
+from .model import SEVERITIES, STATUSES, TYPES, ParseError, is_valid_url, parse_scar_text
 
 
 @dataclass
@@ -46,6 +46,11 @@ def lint_text(text: str, today: str | None = None) -> list[Finding]:
             findings.append(Finding("error", f"invalid pattern anchor /{pat}/: {exc}"))
     if not scar.evidence:
         findings.append(Finding("warning", "no evidence links — challengeable on sight"))
+    for e in scar.evidence:
+        if e.startswith("url:") and not is_valid_url(e[len("url:"):]):
+            value = e[len("url:"):].strip()
+            findings.append(Finding(
+                "warning", f"url evidence not a valid http(s) link: '{value}'"))
     # ISO dates compare correctly as strings; never an error — a human
     # decides whether to archive (ADR-4), lint only surfaces the due date
     if (scar.status in ("active", "challenged") and scar.review_after

{scar_cli-0.6.1 → scar_cli-0.7.0}/src/scar/model.py

@@ -16,6 +16,13 @@ SEVERITIES = ("low", "medium", "high", "critical")
 STATUSES = ("candidate", "active", "challenged", "archived", "orphaned", "template")
 
 _FRONTMATTER_RE = re.compile(r"^---\n(.*?)\n---\n?(.*)$", re.DOTALL)
+_URL_RE = re.compile(r"^https?://")
+
+
+def is_valid_url(value: str) -> bool:
+    """True iff value is an http(s) URL. Used by lint to flag durable-link
+    evidence (url:) that isn't actually a link (#50)."""
+    return bool(_URL_RE.match(value.strip()))
 
 
 class ParseError(ValueError):
@@ -67,7 +74,17 @@ class Scar:
 
 def _field(front: str, name: str, default: str = "") -> str:
     m = re.search(rf"^\s*{name}:\s*(.+?)\s*$", front, re.MULTILINE)
-    return m.group(1) if m else default
+    if not m:
+        return default
+    value = m.group(1)
+    # Strip an unquoted inline comment (YAML: a '#' after whitespace starts a
+    # comment). The template ships '# ...' on every field; a copied-but-uncleaned
+    # comment otherwise lands in the value — silently for confidence/severity,
+    # loudly for type. Quoted values are left intact so a '#' inside a quoted
+    # scalar (title, condition) stays data. See issue #69.
+    if '"' not in value and "'" not in value:
+        value = re.sub(r"\s+#.*$", "", value).rstrip()
+    return value
 
 
 def parse_scar_text(text: str) -> Scar:
@@ -91,7 +108,7 @@ def parse_scar_text(text: str) -> Scar:
                for a in authors_raw.strip("[]").split(",") if a.strip()] if authors_raw else []
 
     evidence = [f"{m1.group(1)}: {m1.group(2).strip().strip('\"')}" for m1 in re.finditer(
-        r"^\s*-\s*(commit|pr|incident|note):\s*(.+)\s*$", front, re.MULTILINE)]
+        r"^\s*-\s*(commit|pr|issue|incident|note|url):\s*(.+)\s*$", front, re.MULTILINE)]
 
     return Scar(
         type=_field(front, "type", "deadend"),

{scar_cli-0.6.1/.scars → scar_cli-0.7.0/src/scar/skills/scar-authoring/assets}/template.md

@@ -13,7 +13,10 @@ anchors:
   - path: src/module/      # file or directory this protects
   - pattern: "regex"       # optional: fires when matching code appears in ANY new/edited file
 evidence:
-  - commit: abc1234        # at least one receipt: commit, pr, incident, or note
+  - pr: 123                # at least one receipt: pr, issue, url, commit, incident, or note
+  # Prefer pr/issue/url over a bare commit: SHA — feature-branch SHAs orphan on squash-merge.
+  - issue: 50
+  - url: https://github.com/org/repo/commit/abc1234
 expires:
   condition: "what change would make this scar obsolete"
   review_after: 1971-01-01 # force a freshness look even if condition never triggers

{scar_cli-0.6.1 → scar_cli-0.7.0}/src/scar/store.py

@@ -34,8 +34,9 @@ challenge it: update or archive it with a note, don't ignore it.
 2. **YAML frontmatter is mandatory.** A scar without it is unparseable and
    will NEVER fire in any tool. `scar lint` checks; the hooks warn loudly.
 3. **Promotion** = human review: `scar promote candidates/<slug>.md`.
-4. **Evidence required.** A scar without a commit/PR/incident reference is
-   an opinion and can be challenged on sight.
+4. **Evidence required.** A scar without a pr/issue/url/commit/incident
+   reference is an opinion and can be challenged on sight. Prefer durable
+   pr/issue/url refs — feature-branch commit SHAs orphan on squash-merge.
 
 Format details: `template.md`. Project: SCAR.
 """
@@ -56,7 +57,10 @@ anchors:
   - path: src/module/      # file or directory this protects
   - pattern: "regex"       # optional: fires when matching code appears in ANY new/edited file
 evidence:
-  - commit: abc1234        # at least one receipt: commit, pr, incident, or note
+  - pr: 123                # at least one receipt: pr, issue, url, commit, incident, or note
+  # Prefer pr/issue/url over a bare commit: SHA — feature-branch SHAs orphan on squash-merge.
+  - issue: 50
+  - url: https://github.com/org/repo/commit/abc1234
 expires:
   condition: "what change would make this scar obsolete"
   review_after: 1971-01-01

{scar_cli-0.6.1 → scar_cli-0.7.0}/tests/test_harvest.py

@@ -105,6 +105,49 @@ def test_excludes_scars_dir_from_candidates(tmp_path):
         "no candidate may point into any .scars/ tree (self-ref noise, #55)"
 
 
+def test_excludes_vendored_and_scaffold_dirs_from_candidates(tmp_path):
+    """Scar #72: harvest must not surface candidates from vendored/scaffold trees.
+
+    Comment-archaeology greps DO-NOT/load-bearing prose across the whole repo,
+    so third-party doc tiles and dependency trees (node_modules/, vendor/, and
+    tool-scaffold dirs like .tessl/.kiro) match the fence regex with prose the
+    project never wrote. Same path-based pollution class as #55's .scars filter.
+    """
+    git(tmp_path.parent, "init", "-q", "-b", "main", str(tmp_path))
+    git(tmp_path, "config", "user.email", "t@t")
+    git(tmp_path, "config", "user.name", "t")
+    # real code comment — SHOULD still be harvested
+    (tmp_path / "app.py").write_text(
+        "# DO NOT remove this init — load-bearing\nx = 1\n")
+    # vendored / scaffold trees full of trigger prose — must NOT be harvested
+    vendored = {
+        "node_modules/pkg/readme.md": "DO NOT edit; load-bearing vendored code.\n",
+        "vendor/lib/notes.md": "This must remain unchanged — load-bearing.\n",
+        ".tessl/tiles/sqlalchemy/docs/dialects.md":
+            "Add ON CONFLICT DO NOTHING clause. DO NOT change.\n",
+        ".kiro/steering/rules.md": "// DO NOT: forget the route guard\n",
+    }
+    for rel, content in vendored.items():
+        p = tmp_path / rel
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(content)
+    git(tmp_path, "add", "-A")
+    git(tmp_path, "commit", "-qm", "feat: code + vendored trees")
+
+    result = harvest(tmp_path)
+    locations = [c["location"] for c in result["comments"]]
+    assert any(loc.startswith("app.py") for loc in locations), \
+        "real code comment should still be harvested"
+    all_paths = (
+        locations
+        + [c["component"] for c in result["deleted_components"]]
+        + [c["file"] for c in result["flapping"]]
+    )
+    vendored_segs = {"node_modules", "vendor", ".tessl", ".kiro"}
+    assert not any(vendored_segs & set(p.split("/")) for p in all_paths), \
+        "no candidate may point into a vendored/scaffold tree (#72)"
+
+
 # ---------------------------------------------------------------------------
 # Ranking / scoring tests
 # ---------------------------------------------------------------------------

{scar_cli-0.6.1 → scar_cli-0.7.0}/tests/test_lint.py

@@ -68,3 +68,32 @@ def test_bad_pattern_regex_is_error():
                        '  - pattern: "([unclosed"')
     findings = lint_text(bad)
     assert any(f.level == "error" and "pattern" in f.message for f in findings)
+
+
+def test_malformed_url_evidence_is_warning():
+    bad = GOOD.replace(
+        "evidence:\n  - commit: abc1234\n",
+        "evidence:\n  - url: not-a-link\n",
+    )
+    findings = lint_text(bad)
+    assert any(f.level == "warning" and "url" in f.message and "not-a-link" in f.message
+               for f in findings)
+    assert not any(f.level == "error" for f in findings)
+
+
+def test_valid_url_evidence_no_warning():
+    ok = GOOD.replace(
+        "evidence:\n  - commit: abc1234\n",
+        "evidence:\n  - url: https://github.com/org/repo/commit/abc1234\n",
+    )
+    findings = lint_text(ok)
+    assert not any("url" in f.message for f in findings)
+
+
+def test_issue_evidence_skips_url_check():
+    ok = GOOD.replace(
+        "evidence:\n  - commit: abc1234\n",
+        "evidence:\n  - issue: 50\n",
+    )
+    findings = lint_text(ok)
+    assert findings == []

{scar_cli-0.6.1 → scar_cli-0.7.0}/tests/test_model.py

@@ -56,6 +56,31 @@ def test_confidence_defaults_when_malformed():
     assert parse_scar_text(text).confidence == 0.5
 
 
+def test_inline_comment_stripped_from_type():
+    # The template ships `type: deadend  # ...`; a copied-but-uncleaned comment
+    # must not become part of the value (else the type fails its enum check).
+    text = VALID.replace("type: deadend", "type: deadend            # tried+failed")
+    assert parse_scar_text(text).type == "deadend"
+
+
+def test_inline_comment_stripped_from_confidence_keeps_value():
+    # Silent-corruption case: a comment used to make float() fail -> reset to 0.5.
+    text = VALID.replace("confidence: 0.9", "confidence: 0.9            # 0..1 how sure")
+    assert parse_scar_text(text).confidence == 0.9
+
+
+def test_inline_comment_stripped_from_severity():
+    text = VALID.replace("severity: high", "severity: high            # low | medium | high | critical")
+    assert parse_scar_text(text).severity == "high"
+
+
+def test_quoted_hash_is_data_not_comment():
+    # A '#' inside a quoted scalar is part of the value, not a comment.
+    text = VALID.replace('condition: "sessions become re-derivable"',
+                         'condition: "drop #legacy sessions"')
+    assert parse_scar_text(text).expires_condition == "drop #legacy sessions"
+
+
 def test_quoted_pattern_anchor_unwrapped():
     s = parse_scar_text(VALID)
     assert '"' not in s.pattern_anchors[0]
@@ -98,3 +123,57 @@ Body.
     assert 'inner' in s.evidence[0]
     s2 = parse_scar_text(s.to_text())
     assert s2.evidence == s.evidence
+
+
+def test_issue_and_url_evidence_parse_and_roundtrip():
+    text = """\
+---
+type: landmine
+title: Durable evidence forms
+severity: medium
+confidence: 0.7
+anchors:
+  - path: src/scar/
+evidence:
+  - pr: 123
+  - issue: 50
+  - url: https://github.com/org/repo/commit/abc1234
+status: active
+---
+
+Body.
+"""
+    s = parse_scar_text(text)
+    assert s.evidence == [
+        "pr: 123",
+        "issue: 50",
+        "url: https://github.com/org/repo/commit/abc1234",
+    ]
+    s2 = parse_scar_text(s.to_text())
+    assert s2.evidence == s.evidence
+
+
+def test_existing_evidence_prefixes_still_parse():
+    text = """\
+---
+type: deadend
+title: keeps old forms
+severity: low
+confidence: 0.5
+anchors:
+  - path: a/
+evidence:
+  - commit: a3f9c21
+  - incident: 2024-prod-outage
+  - note: archived 2025-01-01: superseded
+status: active
+---
+
+Body.
+"""
+    s = parse_scar_text(text)
+    assert s.evidence == [
+        "commit: a3f9c21",
+        "incident: 2024-prod-outage",
+        "note: archived 2025-01-01: superseded",
+    ]

{scar_cli-0.6.1 → scar_cli-0.7.0}/tests/test_store.py

@@ -107,3 +107,18 @@ def test_scars_for_path_is_bidirectional(repo):
     assert store.scars_for_path("src/deep/file.py")
     assert store.scars_for_path("")  # repo root: every anchor is under it
     assert not store.scars_for_path("docs/readme.md")
+
+
+def test_template_documents_durable_evidence_forms():
+    from scar.store import TEMPLATE
+    assert "issue:" in TEMPLATE
+    assert "url:" in TEMPLATE
+    assert "squash" in TEMPLATE.lower()
+
+
+def test_template_with_durable_forms_parses_clean():
+    from scar.store import TEMPLATE
+    from scar.model import parse_scar_text
+    text = TEMPLATE.replace("status: template", "status: active")
+    s = parse_scar_text(text)
+    assert any(e.startswith("issue:") or e.startswith("url:") for e in s.evidence)

{scar_cli-0.6.1 → scar_cli-0.7.0}/uv.lock

@@ -79,7 +79,7 @@ wheels = [
 
 [[package]]
 name = "scar-cli"
-version = "0.6.0"
+version = "0.6.1"
 source = { editable = "." }
 
 [package.dev-dependencies]

scar_cli-0.6.1/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.6.1"
-}