testguard-cli 0.9.2__tar.gz → 0.9.4__tar.gz

testguard_cli-0.9.4/.github/scripts/approve-held-runs.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+
+# Clear GitHub's first-time-contributor hold from workflow runs created for a
+# GITHUB_TOKEN-authored pull request. The repository requires that approval,
+# and github-actions[bot] can never graduate from it because it does not author
+# the squash commit that lands on main.
+
+set -euo pipefail
+
+HEAD_SHA="${1:?usage: approve-held-runs.sh HEAD_SHA PR_URL}"
+PR_URL="${2:?usage: approve-held-runs.sh HEAD_SHA PR_URL}"
+: "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
+
+POLL_SECONDS="${TESTGUARD_HELD_RUN_POLL_SECONDS:-10}"
+approved=0
+
+held_ids() {
+  gh api "repos/${GITHUB_REPOSITORY}/actions/runs?head_sha=${HEAD_SHA}" \
+    --jq '[.workflow_runs[] | select(.status == "action_required" or .conclusion == "action_required") | .id] | .[]'
+}
+
+held_urls() {
+  gh api "repos/${GITHUB_REPOSITORY}/actions/runs?head_sha=${HEAD_SHA}" \
+    --jq '[.workflow_runs[] | select(.status == "action_required" or .conclusion == "action_required") | .html_url] | .[]'
+}
+
+echo "Clearing held workflow runs on $HEAD_SHA"
+for attempt in 1 2 3 4 5 6; do
+  # Fail closed. Treating an API failure as "no held runs" would report that
+  # auto-merge can proceed while leaving the PR queued forever.
+  if ! HELD=$(held_ids); then
+    echo "::error::Could not inspect workflow approval holds for $HEAD_SHA; auto-merge on $PR_URL may remain blocked."
+    exit 1
+  fi
+
+  for id in $HELD; do
+    if gh api -X POST "repos/${GITHUB_REPOSITORY}/actions/runs/${id}/approve" >/dev/null 2>&1; then
+      echo "  approved run $id"
+      approved=$((approved + 1))
+    else
+      # A run can leave action_required between the query and the POST. The
+      # final query decides whether that race is harmless.
+      echo "  run $id needed no approval"
+    fi
+  done
+
+  # Runs appear asynchronously. Once one was approved, the first empty query
+  # is terminal; when this repository gate does not apply, three empty polls
+  # are enough to establish that without paying the full minute.
+  if [ -z "$HELD" ] && { [ "$approved" -gt 0 ] || [ "$attempt" -ge 3 ]; }; then
+    break
+  fi
+  if [ "$attempt" -lt 6 ]; then sleep "$POLL_SECONDS"; fi
+done
+
+if ! STILL=$(held_urls); then
+  echo "::error::Could not verify workflow approval holds for $HEAD_SHA; auto-merge on $PR_URL may remain blocked."
+  exit 1
+fi
+if [ -n "$STILL" ]; then
+  echo "::error::Workflow runs are still held for approval, so auto-merge on $PR_URL will wait forever. Approve them, or re-run this workflow: $STILL"
+  exit 1
+fi
+echo "✅ no run is held for approval; auto-merge can complete"

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/.github/workflows/release.yml

@@ -236,8 +236,10 @@ jobs:
     # change lands as a bot PR with native auto-merge armed, and this job
     # dispatches ci.yml on the branch itself — a PR opened with GITHUB_TOKEN
     # gets no pull_request run, but workflow_dispatch is the documented
-    # exception. That also means the merge triggers nothing here; the hourly
-    # sweep observes the merged formula and finds brew_missing=false.
+    # exception. The PR's own runs may still appear held for first-time-
+    # contributor approval, so this job clears those holds before returning.
+    # That also means the merge triggers nothing here; the hourly sweep
+    # observes the merged formula and finds brew_missing=false.
     #
     # Idempotent: an existing branch is reused, an existing open PR is left
     # alone (CI re-dispatched only if its head has no check runs), a closed
@@ -334,3 +336,4 @@ jobs:
           else
             echo "✅ $HEAD_SHA already has $RUNS check run(s)"
           fi
+          .github/scripts/approve-held-runs.sh "$HEAD_SHA" "$PR"

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/.github/workflows/scheduled-release.yml

@@ -170,56 +170,10 @@ jobs:
               echo "✅ $HEAD_SHA already has $RUNS check run(s)"
             fi
 
-            # ── The third GITHUB_TOKEN wall, and the last one. ──
-            # The `pull_request` runs this PR creates are held at
-            # `action_required`: the repository requires approval from
-            # first-time contributors, and `github-actions[bot]` is
-            # PERMANENTLY one — it never authors a merged commit, so it can
-            # never graduate. Those held runs leave check suites QUEUED on the
-            # head sha forever, the status rollup never reaches a terminal
-            # state, and auto-merge waits on it even though the required
-            # contexts (test 20/22/24) are already green from the dispatched
-            # run above. v0.9.0 sat here until a human clicked Approve.
-            #
-            # GITHUB_TOKEN may clear it: `actions: write` carries the approve
-            # permission, measured 201 on a bot PR's own held run. It may not
-            # approve a REVIEW, which is a different gate and still ours alone.
-            #
-            # Runs appear asynchronously, so poll. Approving an already-running
-            # run answers 403 "not waiting for approval" — success, not failure.
-            echo "Clearing held workflow runs on $HEAD_SHA"
-            approved=0
-            for attempt in 1 2 3 4 5 6; do
-              HELD=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs?head_sha=${HEAD_SHA}" \
-                --jq '[.workflow_runs[] | select(.status == "action_required" or .conclusion == "action_required") | .id] | .[]' 2>/dev/null || true)
-              for id in $HELD; do
-                if gh api -X POST "repos/${GITHUB_REPOSITORY}/actions/runs/${id}/approve" >/dev/null 2>&1; then
-                  echo "  approved run $id"
-                  approved=$((approved + 1))
-                else
-                  echo "  run $id needed no approval"
-                fi
-              done
-              # Stop as soon as the picture is settled, rather than always
-              # paying the full poll: nothing held after something was
-              # approved means we are done, and nothing held by the third
-              # look means the gate is not applying to this run at all.
-              if [ -z "$HELD" ] && { [ "$approved" -gt 0 ] || [ "$attempt" -ge 3 ]; }; then
-                break
-              fi
-              sleep 10
-            done
-
-            # Never leave this silent: a run still held here means auto-merge
-            # will wait forever, which is the failure this whole block exists
-            # to remove. Say so, and name what to click.
-            STILL=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs?head_sha=${HEAD_SHA}" \
-              --jq '[.workflow_runs[] | select(.status == "action_required" or .conclusion == "action_required") | .html_url] | .[]' 2>/dev/null || true)
-            if [ -n "$STILL" ]; then
-              echo "::error::Workflow runs are still held for approval, so auto-merge on $PR will wait forever. Approve them, or re-run this workflow: $STILL"
-              exit 1
-            fi
-            echo "✅ no run is held for approval; auto-merge can complete"
+            # Clear the first-time-contributor holds on this bot-created PR's
+            # workflow runs. The Homebrew PR path uses the same helper so the
+            # two release automations cannot drift again.
+            .github/scripts/approve-held-runs.sh "$HEAD_SHA" "$PR"
           else
             cat /tmp/pr-err
             if grep -q 'not permitted to create or approve pull requests' /tmp/pr-err; then

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/CHANGELOG.md

@@ -7,6 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.4] - 2026-09-19
+
+Automated weekly release — everything merged since `v0.9.3`.
+
+### Changed
+
+- fix(test): ignore nested agent worktrees (#133)
+- chore(homebrew): sha256 for v0.9.3 (#131)
+
+
+### Fixed
+
+- The canonical `npm test` command no longer collects suites from live nested
+  worktrees under `.claude/`. A parked checkout can remain safely available
+  without its unfinished tests or fixtures contaminating the main tree's gate.
+
+## [0.9.3] - 2026-09-19
+
+Automated weekly release — everything merged since `v0.9.2`.
+
+### Changed
+
+- fix(release): clear held Homebrew PR runs (#129)
+- chore(homebrew): sha256 for v0.9.2 (#128)
+
+
+### Fixed
+
+- Bot-created Homebrew checksum PRs now clear GitHub's first-time-contributor
+  workflow holds themselves, using the same fail-closed helper as scheduled
+  release PRs. A release no longer finishes publishing while leaving its final
+  formula update waiting for a manual Approve click.
+
 ## [0.9.2] - 2026-09-19
 
 Automated weekly release — everything merged since `v0.9.1`.

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.9.2
+Version: 0.9.4
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.9.2` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.9.4` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -493,12 +493,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.9.2
+- uses: raccioly/testguard@v0.9.4
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.9.2` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.9.4` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -469,12 +469,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.9.2
+- uses: raccioly/testguard@v0.9.4
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/action.yml

@@ -46,7 +46,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.9.2'
+    default: '0.9.4'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.9.2 · MIT</div>
+    <div class="meta">Technical Brief · v0.9.4 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "testguard-cli",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.9.2",
+      "version": "0.9.4",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0"

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/packaging/gitlab/testguard.gitlab-ci.yml

@@ -3,7 +3,7 @@
 # Include it from a project's .gitlab-ci.yml, pinned to a release:
 #
 #   include:
-#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml'
+#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml'
 #       inputs:
 #         dir: backend            # where testguard.claims.json lives (default ".")
 #         post_note: true         # post the brief as a merge-request note (needs TESTGUARD_GITLAB_TOKEN, api scope)
@@ -29,7 +29,7 @@ spec:
   inputs:
     version:
       description: testguard-cli version to run
-      default: "0.9.2"
+      default: "0.9.4"
     dir:
       description: directory whose test runner is invoked (where testguard.claims.json lives)
       default: "."

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/packaging/homebrew/testguard.rb

@@ -15,8 +15,8 @@
 class Testguard < Formula
   desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.9.2.tgz"
-  sha256 "118c895b89b336b919ca61d9af35915fded75c27d08feeabaf2340d6e5a9a847"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.9.4.tgz"
+  sha256 "3ab202d339b014ea5d8a11cc143bd1bdef6ea08120a513029f7537c288ba3195"
   license "MIT"
 
   depends_on "node"

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.9.2"
+version = "0.9.4"
 description = "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }

testguard_cli-0.9.4/test/release-approval.test.mjs

@@ -0,0 +1,78 @@
+import { chmodSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { describe, expect, it } from 'vitest';
+
+const ROOT = new URL('..', import.meta.url).pathname;
+const SCRIPT = join(ROOT, '.github', 'scripts', 'approve-held-runs.sh');
+
+const run = (scenario) => {
+  const dir = mkdtempSync(join(tmpdir(), 'tg-held-runs-'));
+  const state = join(dir, 'state');
+  const gh = join(dir, 'gh');
+  writeFileSync(gh, `#!/bin/sh
+set -eu
+case "$*" in
+  *'/approve'*)
+    printf 'approved\\n' >> "$FAKE_GH_STATE"
+    [ "$FAKE_GH_SCENARIO" != 'stuck' ]
+    ;;
+  *'.html_url'*)
+    if [ "$FAKE_GH_SCENARIO" = 'stuck' ]; then
+      printf 'https://github.example/runs/42\\n'
+    fi
+    ;;
+  *'.id'*)
+    if [ "$FAKE_GH_SCENARIO" = 'query-error' ]; then exit 2; fi
+    if [ "$FAKE_GH_SCENARIO" = 'stuck' ] || { [ "$FAKE_GH_SCENARIO" = 'held-clears' ] && [ ! -s "$FAKE_GH_STATE" ]; }; then
+      printf '42\\n'
+    fi
+    ;;
+  *) exit 64 ;;
+esac
+`);
+  chmodSync(gh, 0o755);
+  const result = spawnSync('/bin/bash', [SCRIPT, 'abc1234', 'https://github.example/pull/7'], {
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      PATH: `${dir}:/usr/bin:/bin`,
+      GITHUB_REPOSITORY: 'owner/repo',
+      FAKE_GH_SCENARIO: scenario,
+      FAKE_GH_STATE: state,
+      TESTGUARD_HELD_RUN_POLL_SECONDS: '0',
+    },
+  });
+  return { ...result, approvals: readFileSync(state, { encoding: 'utf8', flag: 'a+' }) };
+};
+
+describe('release workflow approval holds', () => {
+  it('both bot-created PR paths invoke the same approval helper', () => {
+    for (const workflow of ['scheduled-release.yml', 'release.yml']) {
+      const text = readFileSync(join(ROOT, '.github', 'workflows', workflow), 'utf8');
+      expect(text).toContain('.github/scripts/approve-held-runs.sh "$HEAD_SHA" "$PR"');
+    }
+  });
+
+  it('approves a held run and verifies that the hold cleared', () => {
+    const result = run('held-clears');
+    expect(result.status, result.stderr).toBe(0);
+    expect(result.approvals).toBe('approved\n');
+    expect(result.stdout).toMatch(/approved run 42/);
+    expect(result.stdout).toMatch(/no run is held for approval/);
+  });
+
+  it('fails closed when GitHub cannot report the approval state', () => {
+    const result = run('query-error');
+    expect(result.status).toBe(1);
+    expect(result.stdout).toMatch(/Could not inspect workflow approval holds/);
+  });
+
+  it('fails with the held run URL when approval never clears', () => {
+    const result = run('stuck');
+    expect(result.status).toBe(1);
+    expect(result.stdout).toMatch(/will wait forever/);
+    expect(result.stdout).toMatch(/https:\/\/github\.example\/runs\/42/);
+  });
+});

testguard_cli-0.9.4/test/vitest-config.test.mjs

@@ -0,0 +1,11 @@
+import { describe, expect, it } from 'vitest';
+import config from '../vitest.config.mjs';
+
+describe('the root test boundary', () => {
+  it('never collects fixtures or agent-managed nested worktrees', () => {
+    expect(config.test.exclude).toEqual(expect.arrayContaining([
+      'fixtures/**',
+      '.claude/**',
+    ]));
+  });
+});

{testguard_cli-0.9.2 → testguard_cli-0.9.4}/testguard.claims.json

@@ -3777,6 +3777,106 @@
         "preflight",
         "cost"
       ]
+    },
+    {
+      "id": "TG-RELEASE-BOT-CLEARS-HELD-RUNS",
+      "statement": "Every GITHUB_TOKEN-authored release pull request clears first-time-contributor workflow holds before its creating workflow succeeds. Both the scheduled version PR and the post-publish Homebrew checksum PR use one fail-closed helper, so an API failure or a hold that remains visible is an error rather than a silently queued auto-merge.",
+      "source": {
+        "kind": "manual",
+        "ref": "v0.9.2 Homebrew release field report"
+      },
+      "severity": "high",
+      "producedBy": {
+        "producer": "human",
+        "by": "maintainer",
+        "at": "2026-09-19T00:00:00Z"
+      },
+      "defendedBy": [
+        "test/release-approval.test.mjs"
+      ],
+      "faults": [
+        {
+          "id": "F1",
+          "description": "The post-publish Homebrew PR skips the approval helper and can remain queued after the release workflow reports success.",
+          "faultClass": "statement-deleted",
+          "file": ".github/workflows/release.yml",
+          "find": "          .github/scripts/approve-held-runs.sh \"$HEAD_SHA\" \"$PR\"",
+          "replace": "          echo \"approval hold check skipped\"",
+          "producedBy": {
+            "producer": "human",
+            "by": "maintainer",
+            "at": "2026-09-19T00:00:00Z"
+          }
+        },
+        {
+          "id": "F2",
+          "description": "The scheduled release PR stops using the shared approval helper, allowing the two bot-created PR paths to drift again.",
+          "faultClass": "statement-deleted",
+          "file": ".github/workflows/scheduled-release.yml",
+          "find": "            .github/scripts/approve-held-runs.sh \"$HEAD_SHA\" \"$PR\"",
+          "replace": "            echo \"approval hold check skipped\"",
+          "producedBy": {
+            "producer": "human",
+            "by": "maintainer",
+            "at": "2026-09-19T00:00:00Z"
+          }
+        },
+        {
+          "id": "F3",
+          "description": "A failed GitHub API query is treated as an empty hold list, so the helper reports success without knowing whether auto-merge is blocked.",
+          "faultClass": "condition-forced",
+          "file": ".github/scripts/approve-held-runs.sh",
+          "find": "  if ! HELD=$(held_ids); then",
+          "replace": "  if HELD=$(held_ids); then",
+          "producedBy": {
+            "producer": "human",
+            "by": "maintainer",
+            "at": "2026-09-19T00:00:00Z"
+          }
+        }
+      ],
+      "tags": [
+        "release",
+        "automation",
+        "github-actions"
+      ]
+    },
+    {
+      "id": "TG-ROOT-TEST-IGNORES-NESTED-WORKTREES",
+      "statement": "The root Vitest gate describes only this checkout: it never collects fixtures or agent-managed nested worktrees under .claude, so parked unmerged work cannot create false failures in npm test.",
+      "source": {
+        "kind": "manual",
+        "ref": "https://github.com/raccioly/testguard/issues/132"
+      },
+      "severity": "high",
+      "producedBy": {
+        "producer": "human",
+        "by": "maintainer",
+        "at": "2026-09-19T00:00:00Z"
+      },
+      "defendedBy": [
+        "test/vitest-config.test.mjs"
+      ],
+      "faults": [
+        {
+          "id": "F1",
+          "description": "The root test boundary stops excluding agent-managed nested worktrees, so npm test can collect an unrelated checkout.",
+          "faultClass": "field-dropped",
+          "file": "vitest.config.mjs",
+          "find": "    exclude: [...configDefaults.exclude, 'fixtures/**', '.claude/**'],",
+          "replace": "    exclude: [...configDefaults.exclude, 'fixtures/**'],",
+          "producedBy": {
+            "producer": "human",
+            "by": "maintainer",
+            "at": "2026-09-19T00:00:00Z"
+          }
+        }
+      ],
+      "tags": [
+        "tests",
+        "worktrees",
+        "isolation"
+      ]
     }
   ]
 }

testguard_cli-0.9.4/vitest.config.mjs

@@ -0,0 +1,11 @@
+import { defineConfig, configDefaults } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    // fixtures/ contains a deliberately flaky suite; it is driven by the
+    // tool's own tests, never collected directly. Agent-managed worktrees are
+    // separate checkouts too: collecting them makes this tree's result depend
+    // on unrelated, potentially unfinished work.
+    exclude: [...configDefaults.exclude, 'fixtures/**', '.claude/**'],
+  },
+});

testguard_cli-0.9.2/vitest.config.mjs

@@ -1,9 +0,0 @@
-import { defineConfig, configDefaults } from 'vitest/config';
-
-export default defineConfig({
-  test: {
-    // fixtures/ contains a deliberately flaky suite; it is driven by the
-    // tool's own tests, never collected directly.
-    exclude: [...configDefaults.exclude, 'fixtures/**'],
-  },
-});