From 6cc2339e8a96da1ff0509f23976b8f51a3e6f5cd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 19:27:13 +0000 Subject: [PATCH] Version Packages --- .changeset/hip-donkeys-brake.md | 64 --------------------------------- .changeset/olive-moons-shave.md | 34 ------------------ docs-content/installation.md | 2 +- package.json | 2 +- src/core/version.ts | 2 +- 5 files changed, 3 insertions(+), 101 deletions(-) delete mode 100644 .changeset/hip-donkeys-brake.md delete mode 100644 .changeset/olive-moons-shave.md diff --git a/.changeset/hip-donkeys-brake.md b/.changeset/hip-donkeys-brake.md deleted file mode 100644 index a7f97df..0000000 --- a/.changeset/hip-donkeys-brake.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -"@cosyte/cli": patch ---- - -Close the pre-commit PHI gate's rename blind spot: `phi-scan --staged` never saw a `git mv` into a scan root. - -`scripts/phi-scan.ts` listed the index with `git diff --cached --name-only --diff-filter=AM`. -Rename detection is on by default, so `git mv test/__fixtures__/` stages as a -**two-path `R100` record**, and `R` and `C` are in neither `AM` nor `AMT`: the status filter deleted -the record outright and the destination was never enumerated. Measured on this repo, both shapes -walking through the `pnpm phi-scan --staged` pre-commit hook at **exit 0**: a regular file carrying a -value this scanner's own floor catches (`:100644 100644 R100`), and a symbolic link -(`:120000 120000 R100`, index mode `120000` under the scan root). `git mv` is an ordinary -developer action, not crafted input. - -`--no-renames` is the remedy and it costs the record stride nothing: the destination arrives as a -single-path `A` and the source as a `D` the filter drops, so the enumeration is a strict **superset** -of the previous one. Verified under `diff.renames` set to `true`, `copies`, `false` and `1`, and -under `diff.renameLimit=1`: no `R` or `C` record survives in any of them, which makes the two-field -record stride structural rather than conditional. `copies` is not hypothetical, it produces a live -`C100` here. - -Three further shapes in the same route, each measured at exit 0 on the base tree and each closed: - -- **The mode was never read at all.** The route enumerated with `--name-only` and read content with - `git show :`, and git stores a symbolic link as its **target path** under mode `120000`, so - the scan was handed the path text and never the target's bytes. It now lists with `--raw -z` and - **refuses** (exit `2`) any in-scope entry whose destination mode is not a regular blob. A refusal - names the entry's own repo-relative path and an engine-owned token for its kind, and **never the - link target**, which is working-tree text that can itself carry PHI. -- **`T` (typechange) is now in the filter.** Replacing a *tracked* regular fixture with a link is - neither an add nor a modify, so `--diff-filter=AM` deleted the record before any mode could be read. -- **Each scan root's own path is in scope**, not just its contents. Git records no index entry for a - directory, so an entry at exactly `test/__fixtures__` or `src` is the root replaced by a blob or a - link, and a prefix test requiring the trailing slash let it through while the whole corpus went - unscanned. - -The all-mode walk gets the same refusal, because a scanner whose pre-commit half refuses a link while -its CI half silently drops one is not one a developer can reason about. - -Two pre-existing exit-code defects fixed with it: a missing or unreadable allow-list, and an -unreadable scan root, both threw past every handler and exited **1** with a stack trace. `1` is this -contract's code for *hits found*, so a caller branching on the exit code read a broken invocation as -a PHI finding. Both are now exit `2` with a diagnostic. - -Stated rather than left to be inferred, all pre-existing and none closed: - -- The staged route still does not enumerate `D` (a deletion has no staged blob) or `U` (an unmerged - path has no single one). The `U` half costs nothing that can reach a commit, and that was measured - rather than assumed: `git commit` refuses an unmerged index outright. -- Under `src/` the staged route still covers only `.ts` files while the all-mode walk covers every - non-`.md` file, so the CI sweep is what covers the difference. -- **The refusal rule is scoped to an _enumerated_ entry**: one the walk reached beneath a root it had - already opened, or a staged record in scope per the boundary rule, which under `src/` is `.ts` - files only (so a staged link at `src/notes.json` is under a scan root and `--staged` still exits 0 - over it, while the all-mode sweep refuses it). Three shapes escape the rule. A scan root - that is itself a **live** link is followed by the all-mode walk (`existsSync` and `readdirSync` - both resolve), so the walk reads files no commit contains and reports their values under a - fabricated in-repo path that holds no such file; the **dangling** direction is the mirror image, - reporting clean over a corpus it never opened. An **ancestor** of a scan root is in neither route's - scope. And paths mode follows an explicitly named link, because `statSync` resolves. The - `--staged` half of the first shape **is** closed here. - -No change to the CLI's runtime surface: no command, flag, exit code, diagnostic code or export moves. diff --git a/.changeset/olive-moons-shave.md b/.changeset/olive-moons-shave.md deleted file mode 100644 index f5e7865..0000000 --- a/.changeset/olive-moons-shave.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -"@cosyte/cli": patch ---- - -Put the shipped documentation sidebar back on the canonical IA spine. - -`docs-content/sidebars.json` declared two top-level categories that are not on the spine, **"MCP -server"** and **"Reference"**. The docs site lints the sidebar it receives from each package's -released `docs-content.tar.gz`, and in strict mode a non-canonical top-level label is an error, so -this package was failing that gate and holding up the whole site's deploy. - -Both categories are removed and their pages are folded into categories this package already had, so -no page moved out of the navigation and none was orphaned: - -- **`mcp`** (the MCP server, its registration steps and its tool list) and **`reference-commands`** - (the man-page-style command reference) now sit under **Guides**, next to `guides-overview`. Both - are task-oriented: what to run, and what comes back. -- **`limitations`** (what the CLI does and does not do, the per-(format, operation) support matrix, - the PHI and HIPAA posture) now sits under **Troubleshooting**, next to `troubleshooting`, which is - where the documentation standard puts known limitations. - -The categories this package ships are now `Installation`, `Quickstart`, `Core Concepts`, `Guides` -and `Troubleshooting`, in that order, under the `intro` document. - -**"Reference" was NOT renamed to "API Reference".** That category is injected by the docs site, and -a hand-authored one is refused outright rather than warned about. Whether and where the site adds it -is the site's decision, not this package's, and this package neither authors nor positions it. - -Verified against the site's own linter rather than by inspection, with the sidebar shipped in the -previous release as a negative control: that one produces two errors, and this one produces no -findings at all. - -Documentation-artifact change only. No command, flag, exit code, diagnostic code or export moves, -and no page content was rewritten. diff --git a/docs-content/installation.md b/docs-content/installation.md index a76c6e1..7ecca0c 100644 --- a/docs-content/installation.md +++ b/docs-content/installation.md @@ -102,7 +102,7 @@ autodetector, the exit-code contract, and the value-free diagnostic types: ```ts runnable import { VERSION } from "@cosyte/cli"; -VERSION; // => "0.0.3" +VERSION; // => "0.0.4" ``` If that resolves and prints the release you installed, the install is good: head to the diff --git a/package.json b/package.json index 28a0d16..eaf121a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@cosyte/cli", - "version": "0.0.3", + "version": "0.0.4", "description": "The cosyte CLI: a PHI-safe developer front door over the @cosyte/* healthcare parsers. Parse HL7 v2 / FHIR from a file or stdin to typed JSON, with a documented exit-code contract.", "keywords": [ "cli", diff --git a/src/core/version.ts b/src/core/version.ts index c5e9bc4..6a70186 100644 --- a/src/core/version.ts +++ b/src/core/version.ts @@ -23,4 +23,4 @@ * console.log(`cosyte ${VERSION}`); * ``` */ -export const VERSION: string = "0.0.3"; +export const VERSION: string = "0.0.4";