Release CodeTruss CLI v0.2.37

[DeliriumPulse]

Scope

• Approved issue or context: the public mirror sat at 0.2.36 while codetruss.com served 0.2.37. The newest attested tag must not trail what the site distributes.
• Intended change: mirror the 0.2.37 release commit 7f007d8, publish the immutable 0.2.37 artifacts, propagate the changelog repair that release shipped, and repoint the version-pinned README examples.
• Explicitly out of scope: tagging (follows this merge), npm publication (separate manual dispatch), any 0.2.36 artifact or tag.

Validation

• pnpm install --frozen-lockfile — lockfile up to date
• pnpm typecheck — clean (exit 0)
• pnpm release:artifact — rebuilt to 082a03fe5dd2d9c516acc76504e0bb45bc7d3b5a1fa7308fb2d627ce07a3c627, byte-identical to the published archive. git status shows no drift in public/downloads after the rebuild.
• pnpm test — 295 tests across 24 files, all passing, plus the deterministic package format, release integrity verifier, and new changelog policy suites (exit 0)
• pnpm release:verify — Verified immutable CodeTruss CLI 0.2.37 release (082a03fe…)
• pnpm test:install — clean global install, guided setup, all hook installers exercised

Mirror fidelity: 114 files from release commit 7f007d8, zero content mismatches and zero file-mode mismatches. (112 at 0.2.36, plus scripts/changelog-policy.mjs and scripts/test-changelog-policy.mjs.)

Bytes match the live site. The archive, SBOM, and codetruss-cli-latest.json in this branch are byte-identical (cmp, exit 0) to the ones downloaded from codetruss.com this run.

Falsification controls

Every verifier was proven to fail on tampered input before its pass was trusted. Exit codes were captured explicitly — a | head pipeline reports head's status, so the same known-bad input reads as exit 0 through a pipe and exit 1 under direct capture. That was demonstrated, not assumed.

Tamper	Verifier	Result
One flipped byte in codetruss-cli-0.2.37.tgz	release:verify	rejected (exit 1)
latest.tgz aliased to a different real release (0.2.36)	release:verify	rejected — latest.tgz does not match immutable codetruss-cli-0.2.37.tgz
Version string edited inside the published SBOM	release:verify	rejected (exit 1)
Forged .sha256 sidecar	release:verify	rejected — not the canonical checksum
packages/cli/README.md drifted from the packaged copy	release:verify	rejected — does not contain the current README.md
## 0.2.36 heading deleted from the changelog	release:artifact	rejected — release chain breaks between 0.2.37 and 0.2.35
Release version left undocumented in the changelog	release:artifact	rejected (exit 1)

Every control was reverted and the tree reverified clean afterwards.

README claims, rechecked against the shipped binary

Claim	Checked by	Result
Version	cli.cjs --version on the extracted 0.2.37 archive	codetruss 0.2.37
verify-policy trust-key in --help	cli.cjs --help	listed
Analysis profile local-registry-v2	0.2.37 bundle	present
Receipt security sections unchanged 0.2.36 → 0.2.37	both extracted bundles	byte-identical (4d0df00a…)

The receipt excerpt still reads "Abridged from a real 0.2.36 run" because that is its true provenance and the rendered sections are byte-identical under 0.2.37. Relabelling it 0.2.37 would have been a claim with no run behind it.

Privacy and network impact

• No private code, credentials, keys, receipts, or customer data are included.
• This change adds or modifies no network egress, telemetry, provider authentication, sync/upload behavior, or command execution.

The two new scripts are release-time changelog checks; they read packages/cli/CHANGELOG.md and nothing else.

Release impact

• User-visible behavior: none from this repository. It mirrors an already-shipped release.
• Release impact: none / patch (mirror sync)
• Changelog, version, package, SBOM, release-reference, website, or documentation updates: all included. packages/cli/CHANGELOG.md mirrored verbatim, root CHANGELOG.md regenerated from it so its release body stays byte-identical, release-reference.json repointed to the 0.2.37 archive, SBOM, and bundle digests.

The changelog repair 0.2.37 shipped

CLI 0.2.36 overwrote ## 0.2.35 — 2026-08-07 with its own heading, orphaning the entire local-SAST release's notes and erasing 0.2.35 from the history. 0.2.37 restores both entries and adds a build-time guard so it cannot recur: pnpm release:artifact now fails unless the version being built documents itself and every release heading forms one unbroken descending chain. That guard is falsification-checked above, in both directions.

npm

npm latest is @codetruss/cli@0.2.24 (verified against the registry this run — it is the only published version). Publication remains a separate, manually dispatched, reviewer-gated workflow.

Summary by CodeRabbit

• New Features
  • Released CLI version 0.2.37 with updated download metadata, checksums, and software bill of materials.
• Bug Fixes
  • Improved Windows process cleanup to avoid terminating stale or already-exited processes.
  • Made timeout-related descendant cleanup safer and more reliable.
• Documentation
  • Updated installation instructions and release references to version 0.2.37.
  • Restored and expanded release history entries.
• Quality Improvements
  • Added release validation to detect missing, duplicate, misordered, or skipped changelog entries before publishing.

[coderabbitai]

📝 Walkthrough

Walkthrough

CLI 0.2.37 adds PID-safe Windows process cleanup, changelog release-chain validation, updated release documentation, and refreshed package artifacts, checksums, SBOMs, manifests, and release references.

Changes

CLI 0.2.37 release

Layer / File(s)	Summary
Process-tree cleanup safety packages/cli/src/git.ts, packages/cli/src/local-command.ts, packages/cli/test/verification-timeout.test.ts	Process cleanup receives the owning ChildProcess and skips Windows taskkill when the leader has exited. The timeout test uses sentinel-driven descendant termination.
Changelog policy enforcement packages/cli/scripts/changelog-policy.mjs, packages/cli/scripts/build-release.mjs, packages/cli/scripts/test-changelog-policy.mjs, packages/cli/package.json, CHANGELOG.md, packages/cli/CHANGELOG.md	Release builds and tests validate changelog headings, semver continuity, ordering, uniqueness, Unreleased content, and the requested package version. The package version and release notes are updated to 0.2.37.
Release metadata and published artifacts README.md, public/downloads/*, release-reference.json	Documentation, manifests, checksums, SBOMs, and release references now identify version 0.2.37.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• DeliriumPulse/codetruss-cli#12: Both changes update changelog release history and Unreleased handling.
• DeliriumPulse/codetruss-cli#16: Both changes update the CLI release metadata, changelogs, package version, and published artifacts.
• DeliriumPulse/codetruss-cli#19: Both changes update successive CLI release metadata and published artifacts.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: releasing CodeTruss CLI version 0.2.37.
Description check	✅ Passed	The description covers scope, validation, privacy, release impact, artifacts, and known exclusions with detailed supporting results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/v0.2.37

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/cli/scripts/changelog-policy.mjs`:
- Line 30: Update the changelog parsing around changelog.split to split on both
LF and CRLF line endings, ensuring heading matching works regardless of checkout
format. Add a CRLF-formatted fixture covering release heading detection for the
release:artifact flow.

In `@packages/cli/src/git.ts`:
- Around line 453-463: Replace the PID/liveness shutdown logic in
terminateVerificationProcessTree with a pre-established Windows job object or
equivalent containment mechanism that terminates descendants safely even after
the leader exits; apply the same mechanism to local-provider process handling in
packages/cli/src/local-command.ts lines 55-65. Update
packages/cli/test/verification-timeout.test.ts lines 58-87 to verify descendants
stop before the sentinel is removed, such as by detecting a stale heartbeat.
Ship the fix in a new released version, not a mirror-only source edit, and keep
published TypeScript byte-identical to the committed release archive.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 751902bd-0d68-4246-8ea5-9dba7615a5d7

📥 Commits

Reviewing files that changed from the base of the PR and between ed7debb and d2e2cf2.

📒 Files selected for processing (18)

• CHANGELOG.md
• README.md
• packages/cli/CHANGELOG.md
• packages/cli/package.json
• packages/cli/scripts/build-release.mjs
• packages/cli/scripts/changelog-policy.mjs
• packages/cli/scripts/test-changelog-policy.mjs
• packages/cli/src/git.ts
• packages/cli/src/local-command.ts
• packages/cli/test/verification-timeout.test.ts
• public/downloads/codetruss-cli-0.2.37.sbom.cdx.json
• public/downloads/codetruss-cli-0.2.37.tgz
• public/downloads/codetruss-cli-0.2.37.tgz.sha256
• public/downloads/codetruss-cli-latest.json
• public/downloads/codetruss-cli-latest.sbom.cdx.json
• public/downloads/codetruss-cli-latest.tgz
• public/downloads/codetruss-cli-latest.tgz.sha256
• release-reference.json