testguard-cli 0.1.0__tar.gz → 0.1.1__tar.gz

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/.github/dependabot.yml

@@ -7,8 +7,7 @@ updates:
     groups:
       all-npm:
         patterns: ["*"]
-    # devDependencies only (ajv for the conformance suite, vitest as the test
-    # runner). The published package has zero runtime dependencies.
+    # One runtime dependency (ajv, exact-pinned) plus vitest for tests.
   - package-ecosystem: "pip"
     directory: "/"
     schedule:

testguard_cli-0.1.1/.github/scripts/install-smoke.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+/**
+ * Prove the package works AS INSTALLED, not as checked out: pack it, install
+ * the tarball into a scratch project with production dependencies only, and
+ * run the CLI from there. This is the gate that would have caught 0.1.0,
+ * which shipped with its schema validator's dependency declared as a
+ * devDependency and crashed on startup for every npm/npx/pip/brew user.
+ */
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, rmSync, cpSync, readdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+
+const root = resolve(process.argv[1], '..', '..', '..');
+const run = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'] });
+const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+
+const scratch = mkdtempSync(join(tmpdir(), 'testguard-install-smoke-'));
+try {
+  const packDir = join(scratch, 'pack');
+  mkdirSync(packDir);
+  run(npm, ['pack', '--pack-destination', packDir, '--ignore-scripts'], root);
+  const tgz = join(packDir, readdirSync(packDir).find((f) => f.endsWith('.tgz')));
+
+  const consumer = join(scratch, 'consumer');
+  cpSync(join(root, 'fixtures', 'known-answer'), consumer, { recursive: true, filter: (s) => !/node_modules|\.flake-counter|\.testguard/.test(s) });
+  run(npm, ['init', '-y'], consumer);
+  run(npm, ['install', '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund', tgz], consumer);
+
+  const bin = join(consumer, 'node_modules', '.bin', process.platform === 'win32' ? 'testguard.cmd' : 'testguard');
+  const version = run(bin, ['--version'], consumer).trim();
+  const claims = run(bin, ['claims', '.'], consumer);
+  if (!/^\d+\.\d+\.\d+/.test(version)) throw new Error(`unexpected --version output: ${version}`);
+  if (!claims.includes('8 claims')) throw new Error(`claims did not list the fixture:\n${claims}`);
+  const deps = Object.keys(JSON.parse(run(npm, ['ls', '--omit=dev', '--json', '--depth=0'], consumer)).dependencies ?? {});
+  console.log(`install smoke OK — testguard ${version} runs from the installed tarball; consumer deps: ${deps.join(', ')}`);
+} finally {
+  rmSync(scratch, { recursive: true, force: true });
+}

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/.github/scripts/sync-release-version.mjs

@@ -20,6 +20,7 @@ const surfaces = [
   ['pyproject.toml', /^version = "[^"]+"/m, `version = "${version}"`],
   ['action.yml', /(\n  version:\n    description: [^\n]*\n    required: false\n    default: ')[^']*(')/, `$1${version}$2`],
   ['packaging/homebrew/testguard.rb', /testguard-cli-\d+\.\d+\.\d+\.tgz/g, `testguard-cli-${version}.tgz`],
+  ['README.md', /raccioly\/testguard@v\d+\.\d+\.\d+/g, `raccioly/testguard@v${version}`],
 ];
 
 let drift = 0;

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/.github/workflows/auto-merge.yml

@@ -46,7 +46,7 @@ jobs:
 
             const { data: files } = await github.rest.pulls.listFiles({ owner, repo, pull_number: num, per_page: 300 });
             const paths = files.map((f) => f.filename);
-            const RELEASE_SURFACES = new Set(['package.json', 'package-lock.json', 'pyproject.toml', 'CHANGELOG.md', 'action.yml', 'packaging/homebrew/testguard.rb']);
+            const RELEASE_SURFACES = new Set(['package.json', 'package-lock.json', 'pyproject.toml', 'CHANGELOG.md', 'action.yml', 'packaging/homebrew/testguard.rb', 'README.md']);
 
             if (author === 'dependabot[bot]') {
               const m = /from (\d+)\.(\d+)\.\S+ to (\d+)\.(\d+)\./.exec(pr.title || '');

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
 
-      - name: Install (devDependencies only; zero runtime deps)
+      - name: Install
         run: npm ci
 
       # ── Syntax-check EVERY source, not just what the entry point eagerly
@@ -38,6 +38,13 @@ jobs:
       - name: Syntax-check all sources
         run: find cli src spec -name '*.mjs' -print0 | xargs -0 -n1 node --check
 
+      # ── Install-from-tarball smoke: the package must run as INSTALLED, with
+      #    production dependencies only. 0.1.0 shipped unrunnable because the
+      #    schema validator's dependency was a devDependency; the suite, which
+      #    runs from the checkout, could not see it. ──
+      - name: Install smoke (pack → install --omit=dev → run)
+        run: npm run test:install
+
       - name: Python wrapper imports (PyPI surface)
         run: python3 -c "import testguard_cli.wrapper; print('testguard_cli.wrapper OK')"
 

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/.github/workflows/release.yml

@@ -77,6 +77,8 @@ jobs:
           node-version: 24
       - run: npm ci
       - run: npm test
+      - name: Install smoke — the tarball must run with production deps only
+        run: npm run test:install
       - name: Self-probe must be fully defended before anything ships
         run: node cli/testguard.mjs probe . --budget 180000 --out "$RUNNER_TEMP/self-evidence.json" --quiet
       - name: Version surfaces are in sync

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/.github/workflows/scheduled-release.yml

@@ -102,7 +102,7 @@ jobs:
           # Only release surfaces may change in a release PR.
           CHANGED=$(git diff --name-only HEAD --)
           for f in $CHANGED; do
-            case "$f" in package.json|package-lock.json|pyproject.toml|CHANGELOG.md|action.yml|packaging/homebrew/testguard.rb) ;;
+            case "$f" in package.json|package-lock.json|pyproject.toml|CHANGELOG.md|action.yml|packaging/homebrew/testguard.rb|README.md) ;;
               *) echo "::error::unexpected file in release diff: $f"; exit 1;;
             esac
           done

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/.npmrc

@@ -1,7 +1,7 @@
 # Supply-chain hardening.
 # ignore-scripts: never run a dependency's install/postinstall scripts — the
-#   main supply-chain attack vector. TestGuard has zero runtime dependencies;
-#   its devDependencies (ajv, vitest) work without install scripts.
+#   main supply-chain attack vector. TestGuard's one runtime dependency (ajv)
+#   and its devDependency (vitest) work without install scripts.
 # audit-level: surface moderate-and-above advisories.
 ignore-scripts=true
 audit-level=moderate

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/AGENTS.md

@@ -6,7 +6,8 @@ Read this before changing anything. It is short on purpose.
 
 A CLI that proves a test suite defends the claims a project makes, by
 injecting the faults those claims forbid and reporting every one the tests
-miss. **Not a test generator.** Node ≥ 20, ESM, zero runtime dependencies.
+miss. **Not a test generator.** Node ≥ 20, ESM, one exact-pinned runtime
+dependency (`ajv`).
 The shared formats under `spec/` are a contract other tools adopt; the CLI is
 their first consumer.
 
@@ -16,6 +17,7 @@ their first consumer.
 npm test               # unit + fixture acceptance (~15s)
 npm run test:spec      # conformance suite only
 npm run self:probe     # TestGuard probes its own claims; must exit 0
+npm run test:install   # the packed tarball must run with production deps only
 node cli/testguard.mjs claims fixtures/known-answer
 ```
 

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-09-17
+
+### Fixed
+
+- **0.1.0 did not run when installed.** `ajv`, which validates every document
+  against the spec, was declared as a devDependency, so `testguard` crashed on
+  startup from npm, `npx`, `pip` and Homebrew. It is now an exact-pinned
+  runtime dependency — the project's one dependency.
+- CI and the release job now pack the tarball, install it into a scratch
+  project with production dependencies only, and run the CLI from there
+  (`npm run test:install`). The suite alone runs from the checkout and could
+  not see this class of defect.
+
+### Changed
+
+- Homebrew formula carries the sha256 of the published tarball; description
+  shortened to satisfy `brew audit --strict`.
+
 ## [0.1.0] - 2026-09-17
 
 First release. A claim verifier, not a test generator.

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/CONTRIBUTING.md

@@ -8,9 +8,10 @@ follow from that.
 
 ```bash
 git clone https://github.com/raccioly/testguard && cd testguard
-npm install            # devDependencies only; the package itself has none
+npm install
 npm test               # ~15s: unit tests + probing the fixture end to end
 npm run self:probe     # TestGuard's own claims, probed by TestGuard
+npm run test:install   # pack → install with prod deps only → run; what 0.1.0 lacked
 ```
 
 Node ≥ 20. Python ≥ 3.8 only if you touch `testguard_cli/`.
@@ -41,8 +42,9 @@ Node ≥ 20. Python ≥ 3.8 only if you touch `testguard_cli/`.
    load failure, or an exit code count as detection.
 5. **N-run confirmation everywhere** — baseline, probe, and escalation
    attribution. A single run is never evidence.
-6. **Zero runtime dependencies.** Adding one needs a very good reason and a
-   discussion first.
+6. **One runtime dependency** (`ajv`, exact-pinned). Adding another needs a
+   very good reason and a discussion first. `npm run test:install` proves
+   the package runs as installed with production dependencies only.
 7. **No client-identifying material.** Fixtures and examples use neutral
    domains. Benchmarks against real codebases live outside this repository
    (`bench/README.md`).

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.1.0
+Version: 0.1.1
 Summary: Proves a test suite actually defends the claims a project makes: injects the faults those claims forbid and reports every one the tests miss. Python wrapper for the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -29,7 +29,7 @@ Description-Content-Type: text/markdown
 [![PyPI](https://img.shields.io/pypi/v/testguard-cli.svg)](https://pypi.org/project/testguard-cli/)
 [![node](https://img.shields.io/node/v/testguard-cli.svg)](https://nodejs.org)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
-[![zero deps](https://img.shields.io/badge/runtime%20deps-0-brightgreen.svg)](./package.json)
+[![deps](https://img.shields.io/badge/runtime%20deps-1%20pinned-brightgreen.svg)](./package.json)
 
 > Proves that a test suite actually defends the claims a project makes — by
 > injecting the faults those claims say cannot happen, and reporting every
@@ -67,7 +67,7 @@ on known-broken code. The largest gap was a compliance-critical path with
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.1.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.1.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
 
 ## How it works
@@ -147,7 +147,7 @@ through every verdict.
 
 **v0.1.** Four commands, vitest runner, hand-authored faults. The contract
 spine — six JSON Schemas shared with the other Guard tools — is under
-[`spec/`](spec/). Zero runtime dependencies; Node ≥ 20.
+[`spec/`](spec/). One exact-pinned runtime dependency (`ajv`, for schema validation); Node ≥ 20.
 
 Not yet: test generation (the two-gate acceptance loop), other runners,
 mechanical fault producers, and calibration of fault classes against real

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/README.md

@@ -5,7 +5,7 @@
 [![PyPI](https://img.shields.io/pypi/v/testguard-cli.svg)](https://pypi.org/project/testguard-cli/)
 [![node](https://img.shields.io/node/v/testguard-cli.svg)](https://nodejs.org)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
-[![zero deps](https://img.shields.io/badge/runtime%20deps-0-brightgreen.svg)](./package.json)
+[![deps](https://img.shields.io/badge/runtime%20deps-1%20pinned-brightgreen.svg)](./package.json)
 
 > Proves that a test suite actually defends the claims a project makes — by
 > injecting the faults those claims say cannot happen, and reporting every
@@ -43,7 +43,7 @@ on known-broken code. The largest gap was a compliance-critical path with
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.1.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.1.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
 
 ## How it works
@@ -123,7 +123,7 @@ through every verdict.
 
 **v0.1.** Four commands, vitest runner, hand-authored faults. The contract
 spine — six JSON Schemas shared with the other Guard tools — is under
-[`spec/`](spec/). Zero runtime dependencies; Node ≥ 20.
+[`spec/`](spec/). One exact-pinned runtime dependency (`ajv`, for schema validation); Node ≥ 20.
 
 Not yet: test generation (the two-gate acceptance loop), other runners,
 mechanical fault producers, and calibration of fault classes against real

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/SECURITY.md

@@ -18,7 +18,9 @@ You will get an acknowledgement within 48 hours and a timeline for a fix.
 
 TestGuard is a local CLI with a deliberately small surface:
 
-- **Zero runtime dependencies.** `ajv` and `vitest` are development-only.
+- **One runtime dependency, exact-pinned:** `ajv`, which validates every
+  document the tool reads or writes against the spec. Install scripts are
+  disabled (`.npmrc`). `vitest` is development-only.
 - **No network access.** Nothing is uploaded, fetched, or reported anywhere.
 - **No credentials.** There is nothing to authenticate to.
 - **Writes are confined** to `.testguard/` in the probed project and to

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/action.yml

@@ -38,7 +38,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.1.0'
+    default: '0.1.1'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/package-lock.json

@@ -1,15 +1,20 @@
 {
   "name": "testguard-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.1.0",
+      "version": "0.1.1",
       "license": "MIT",
+      "dependencies": {
+        "ajv": "8.20.0"
+      },
+      "bin": {
+        "testguard": "cli/testguard.mjs"
+      },
       "devDependencies": {
-        "ajv": "^8.20.0",
         "vitest": "^5.0.1"
       },
       "engines": {
@@ -418,7 +423,6 @@
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
       "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -493,14 +497,12 @@
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-uri": {
       "version": "3.1.8",
       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
       "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
-      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -551,7 +553,6 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
       "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/lightningcss": {
@@ -938,7 +939,6 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
       "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Proves a test suite defends the claims a project makes: injects the faults those claims forbid and reports every one the tests fail to detect.",
   "type": "module",
   "license": "MIT",
@@ -28,7 +28,8 @@
     "test:spec": "vitest run spec/conformance",
     "self:probe": "node cli/testguard.mjs probe . --budget 180000",
     "release:sync": "node .github/scripts/sync-release-version.mjs",
-    "prepublishOnly": "node cli/testguard.mjs --version && node .github/scripts/sync-release-version.mjs --check"
+    "prepublishOnly": "node cli/testguard.mjs --version && node .github/scripts/sync-release-version.mjs --check",
+    "test:install": "node .github/scripts/install-smoke.mjs"
   },
   "keywords": [
     "testing",
@@ -45,7 +46,6 @@
     "quality-gate"
   ],
   "devDependencies": {
-    "ajv": "^8.20.0",
     "vitest": "^5.0.1"
   },
   "bin": {
@@ -62,5 +62,8 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "ajv": "8.20.0"
   }
 }

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/packaging/homebrew/testguard.rb

@@ -11,10 +11,10 @@
 #      and set `sha256` from the published tarball:
 #        curl -sL https://registry.npmjs.org/testguard-cli/-/testguard-cli-<VER>.tgz | shasum -a 256
 class Testguard < Formula
-  desc "Proves a test suite defends the claims a project makes, by injecting the faults those claims forbid"
+  desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.1.0.tgz"
-  sha256 "SET_AFTER_FIRST_NPM_PUBLISH"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.1.1.tgz"
+  sha256 "fb7de3fa96886ca55a860bb6b2ed03dea1a6df13fb9fa7ad1bb12d860f9a971a"
   license "MIT"
 
   depends_on "node"

{testguard_cli-0.1.0 → testguard_cli-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.1.0"
+version = "0.1.1"
 description = "Proves a test suite actually defends the claims a project makes: injects the faults those claims forbid and reports every one the tests miss. Python wrapper for the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }