Prepare CodeTruss CLI v0.2.13 by DeliriumPulse · Pull Request #3 · CodeTruss/codetruss-cli

DeliriumPulse · 2026-07-14T19:56:59Z

What changed

publishes the source-visible CodeTruss CLI 0.2.13 release candidate and DB-free analyzer engine
adds deterministic archive, SBOM, checksum, exact website-reference, and adversarial release verification
hardens Git evidence capture, agent hooks, command/provider timeouts, sync response handling, and fail-closed verdict behavior
adds macOS/Linux and Windows installers plus exact versioned/latest release fixtures
upgrades CI to Linux, macOS, and Windows across Node 20.9, 22, and 24
separates attested GitHub releases from explicitly approved npm trusted publishing

Why

CodeTruss needs a public, independently verifiable release surface before its website, npm package, Homebrew tap, and Claude Code/Codex integrations can be promoted. This change makes the exact artifact advertised by the website reproducible from and byte-bound to the public source checkout.

User impact

Developers can install the free local-first CLI without an account, run deterministic scope and quality gates during an agent session, and verify signed PASS / REVIEW_REQUIRED / FAILED receipts. Optional provider review remains bring-your-own-key and explicit receipt sync remains the only CodeTruss upload path.

Validation

pnpm validate: PASS
Vitest: 17 files, 181 tests passed
deterministic package and adversarial release verifier: PASS
clean global installer and all hook installers: PASS
exact artifact SHA-256: 2d13b2912c6e4ca0ab59880f39864f9a019487c191c1a6a41bbcbaf6d694b81c
exact SBOM SHA-256: 60d5126f46b295de8481d7a5265fba6b22852b8abb35940e69a250829ed459ed
private source matrix at release source SHA: Linux/macOS/Windows on Node 20.19/22/24 all passed
production-configured unaliased website candidate: READY; installer, metadata, archive, SBOM, legal pages, and unauthenticated API negatives smoke-tested

Release notes

This PR does not publish npm or move the codetruss.com alias. After required CI is green, merge this PR, protect main and release tags, create annotated tag v0.2.13, let the attested GitHub release complete, and only then promote the exact website candidate and bootstrap npm publication.

Summary by CodeRabbit

New Features
- Added verified installers for Unix and Windows with checksum validation.
- Added binary-aware repository indexing to handle archives, fonts, and other non-text files correctly.
- Added stricter LLM review controls, provider validation, diff-coverage reporting, and bounded responses.
- Added configurable allow/deny repository scopes during initialization.
Bug Fixes
- Improved Git for Windows long-path support.
- Strengthened verification timeouts, output limits, process cleanup, and hook reliability.
Documentation
- Expanded setup, privacy, receipts, release, support, and community guidance.
Release
- Published version 0.2.13 with deterministic archives, checksums, and SBOM metadata.

coderabbitai · 2026-07-14T19:57:08Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e4a992a7-4263-4a0c-b52d-b355b8ee0749

📥 Commits

Reviewing files that changed from the base of the PR and between 2ac69af and 22c4258.

📒 Files selected for processing (69)

.gitattributes
.github/pull_request_template.md
.github/workflows/ci.yml
.github/workflows/publish-npm.yml
.github/workflows/release.yml
CHANGELOG.md
CODE_OF_CONDUCT.md
README.md
SUPPORT.md
docs/RELEASE.md
package.json
packages/analyzer-engine/src/detect.ts
packages/analyzer-engine/src/index.ts
packages/analyzer-engine/src/indexer.ts
packages/cli/CHANGELOG.md
packages/cli/README.md
packages/cli/package.json
packages/cli/scripts/build-release.mjs
packages/cli/scripts/deterministic-package.mjs
packages/cli/scripts/generate-sbom.mjs
packages/cli/scripts/release-package-policy.mjs
packages/cli/scripts/test-deterministic-package.mjs
packages/cli/scripts/test-install.mjs
packages/cli/scripts/test-release-server.mjs
packages/cli/scripts/test-release-verifier.mjs
packages/cli/scripts/verify-deterministic-package.mjs
packages/cli/scripts/verify-release.mjs
packages/cli/src/analysis.ts
packages/cli/src/cli.ts
packages/cli/src/config.ts
packages/cli/src/git-process.ts
packages/cli/src/git-snapshot.ts
packages/cli/src/git.ts
packages/cli/src/hook-baseline.ts
packages/cli/src/hook-result.ts
packages/cli/src/hook-runtime.ts
packages/cli/src/hooks.ts
packages/cli/src/indexer.ts
packages/cli/src/llm.ts
packages/cli/src/local-command.ts
packages/cli/src/private-git-object-store.ts
packages/cli/src/receipt.ts
packages/cli/src/sync-response.ts
packages/cli/src/types.ts
packages/cli/test/analysis-profile.test.ts
packages/cli/test/command-e2e.test.ts
packages/cli/test/config.test.ts
packages/cli/test/git-evidence.test.ts
packages/cli/test/hook-result.test.ts
packages/cli/test/hook-timeout.test.ts
packages/cli/test/hooks.test.ts
packages/cli/test/indexer.test.ts
packages/cli/test/llm.test.ts
packages/cli/test/local-command.test.ts
packages/cli/test/policy-verdict.test.ts
packages/cli/test/receipt.test.ts
packages/cli/test/sync-response.test.ts
packages/cli/test/verification-timeout.test.ts
packages/cli/vitest.config.ts
public/downloads/codetruss-cli-0.2.13.sbom.cdx.json
public/downloads/codetruss-cli-0.2.13.tgz
public/downloads/codetruss-cli-0.2.13.tgz.sha256
public/downloads/codetruss-cli-latest.json
public/downloads/codetruss-cli-latest.sbom.cdx.json
public/downloads/codetruss-cli-latest.tgz
public/downloads/codetruss-cli-latest.tgz.sha256
public/install.ps1
public/install.sh
release-reference.json

🔥 Files not summarized due to errors (2)

public/downloads/codetruss-cli-0.2.13.tgz: Server error: no LLM provider could handle the message
public/downloads/codetruss-cli-latest.tgz: Server error: no LLM provider could handle the message

📝 Walkthrough

Walkthrough

The change set introduces deterministic CLI packaging and release verification, expands cross-platform CI and installers, hardens Git-backed hook state and verification execution, updates analysis and receipt contracts, and refreshes documentation, contribution policy, changelogs, and release metadata.

Changes

CLI release and execution hardening

Layer / File(s)	Summary
Deterministic package and release verification `packages/cli/scripts/`, `.github/workflows/`, `public/downloads/*`, `release-reference.json`	Builds canonical archives, validates release policy and artifact metadata, verifies checksums and SBOMs, and publishes exact tagged release assets.
Analysis, LLM, receipt, and sync contracts `packages/analyzer-engine/src/`, `packages/cli/src/{analysis,types,llm,config,receipt,sync-response}.ts`, `packages/cli/test/`	Adds binary-aware indexing, structured provider contracts, bounded LLM review, local analysis profiles, legacy receipt rendering, configurable initialization globs, and strict sync response parsing.
Hook state, Git execution, and private result handling `packages/cli/src/{git,git-process,git-snapshot,hook-runtime,hook-result,private-git-object-store}.ts`, `packages/cli/test/hooks.test.ts`	Adds long-path-aware Git commands, bounded verification with process cleanup, authenticated atomic hook results, v2 state migration, token-based locks, ownership checks, and fail-closed Stop handling.
CLI entry points, installers, and release smoke tests `packages/cli/src/cli.ts`, `public/install.`, `packages/cli/scripts/test-.mjs`, `packages/cli/test/*`	Wires provider and hook-result options through the CLI, validates installers with a fixture server, and exercises installation, receipt, hook, timeout, and release-verifier flows.
Documentation, policy, and project metadata `README.md`, `packages/cli/README.md`, `CHANGELOG.md`, `CODE_OF_CONDUCT.md`, `.github/pull_request_template.md`, `.gitattributes`	Updates usage, privacy, fail-closed behavior, contribution guidance, release notes, support links, and Git text/binary handling rules.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AgentHook
  participant HookRuntime
  participant GitEvidence
  participant LocalCommand
  participant ReceiptWriter
  AgentHook->>HookRuntime: Dispatch Stop event
  HookRuntime->>GitEvidence: Capture immutable evidence
  HookRuntime->>LocalCommand: Run bounded review
  LocalCommand-->>HookRuntime: Return attempt-bound result
  HookRuntime->>ReceiptWriter: Write verified receipt result
  ReceiptWriter-->>AgentHook: Return verdict and receipt path

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/cli-v0.2.13-release

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

DeliriumPulse added 2 commits July 14, 2026 14:55

Prepare CodeTruss CLI v0.2.13

f5f3b63

Document the Windows quickstart

22c4258

DeliriumPulse marked this pull request as ready for review July 14, 2026 20:01

DeliriumPulse merged commit 55a242a into main Jul 14, 2026
9 of 10 checks passed

DeliriumPulse deleted the codex/cli-v0.2.13-release branch July 14, 2026 20:02

coderabbitai Bot mentioned this pull request Jul 15, 2026

Release CodeTruss CLI v0.2.24 #6

Merged

2 tasks

This was referenced Aug 7, 2026

Release CodeTruss CLI v0.2.30 #16

Merged

Release CodeTruss CLI v0.2.36 #19

Merged

Navigation Menu

Uh oh!

Prepare CodeTruss CLI v0.2.13 - #3

Prepare CodeTruss CLI v0.2.13#3
DeliriumPulse merged 2 commits into
mainfrom
codex/cli-v0.2.13-release

DeliriumPulse commented Jul 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

DeliriumPulse commented Jul 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Why

User impact

Validation

Release notes

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

DeliriumPulse commented Jul 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading