Release CodeTruss CLI v0.2.51 - #44

Syncs the 0.2.51 source from the private monorepo, byte for byte against the monorepo git objects (211 paths compared by blob hash, 0 mismatches, 0 missing).

codetruss-cli-0.2.51.tgz
sha256 0dbd333a638376aa68e4a2f330c6d59cd0e852700104a7dd5444232a2278a862

That digest was not copied into release-reference.json: pnpm release:artifact was run against this tree, resolved from this repository's own lockfile, and the rebuilt archive cmps clean against the monorepo's copy, against the monorepo's latest pointer, and against the bytes codetruss.com is serving right now — as does the dist/cli.cjs inside it. The same cmp against 0.2.50 exits 1, so the comparison is capable of failing.

Why this one is urgent

https://codetruss.com/downloads/codetruss-cli-latest.json already advertises 0.2.51, and its releaseUrl — .../releases/tag/v0.2.51 — currently 404s, because the release does not exist yet. So does the verify command the same manifest publishes. Tagging this merge is what makes the advertised URL resolve.

More to the point: 0.2.51 is the version that makes this tool usable on real repositories at all. Anyone who installs 0.2.50 today and runs it on a large TypeScript codebase hits the defect below in under two seconds.

What 0.2.51 is

A file CodeTruss could not parse reported the user's change as FAILED. On sindresorhus/ky at 3419113, appending a single comment line to source/index.ts returns FAILED, exit 2, for a reason that names no file: 1 file(s) could not be parsed locally. The trigger is a unique symbol declaration — standard TypeScript since 2018 — in source/utils/merge.ts, which the bundled zero-dependency grammar cannot read. Reproduced identically on honojs/hono and colinhacks/zod. Because codetruss setup installs a pre-commit hook, FAILED also blocks the next git commit, with uninstalling as the only escape.

Our inability to read a file is our limitation, not a defect in the change. Evidence issues are now classified where their cause is still known rather than by matching on message text at the verdict: missing — no evidence at all — still FAILS, because nothing can be concluded from such a run in either direction; partial — a hole in evidence that otherwise exists, such as an unparseable file, a size bound, a wall-clock ceiling, a truncated diff — is now REVIEW_REQUIRED. It withholds PASS, is named on the receipt, and exits 1, which the pre-commit hook allows.

Coverage gaps now name their files. The engine recorded that n files could not be parsed and dropped which ones before the receipt was signed. A count with no path is unactionable. Parse failures and in-file scan errors are now carried as bounded path lists through the scan diagnostics, disclosed in the pass detail, and recorded in the signed pass metrics.

A commented-out regex ran the analyzer phase past seven minutes at 100% CPU. colinhacks/zod never finished a review. The literal-stripping expression shared by the complexity and comment-slop analyzers spelled its escape handling as (?:\\.|(?!\1).)*, which lets a backslash be consumed by either branch; on an unterminated literal the engine then tries every partition of the backslashes in it. packages/zod/src/v3/types.ts:607 is a commented-out email regex with 133 backslashes and no closing quote: 2^133 on one 928-character line. It outlived both advertised wall-clock ceilings because those bound the SAST pass and this runs in the registry analyzers. Excluding the backslash from the second branch makes the alternatives disjoint; the same line now completes in under a millisecond with byte-identical output, and the fixture is pinned in the test suite.

Also carried: a new exclude key in .codetruss.yml that keeps a file out of the analysis index while still inventorying it, classifying it against scope, and naming it — with its glob and matched paths — in the receipt's coverage notes, and entering it into the policy fingerprint, because an exclusion that hid itself would be a worse bug than the coverage gap it works around. And one design asset committed with a text-ish extension no longer forces REVIEW_REQUIRED forever.

Not touched

pnpm-workspace.yaml, .npmrc, pnpm-lock.yaml, package.json (root) and .github/ are unchanged — the sync never writes mirror-owned files. public/downloads/grammars/ is carried verbatim. No previously published artifact is modified: git status under public/downloads/ reports nothing outside codetruss-cli-0.2.51.* and the latest pointers, so 0.2.44 through 0.2.50 still have exactly the bytes they were attested with.

CHANGELOG.md at the root is regenerated from packages/cli/CHANGELOG.md by the same rule as before. The generator was checked by feeding it the 0.2.50 package changelog and confirming it reproduces the committed 0.2.50 root changelog byte-for-byte, so a generator that had drifted would not have passed. Its npm-trail sentence moves from 0.2.41 to 0.2.50, because npm latest is 0.2.50 as of today and the old sentence had gone false.

Checked locally before opening

pnpm install --frozen-lockfile resolves with the lockfile untouched (the only source change to packages/cli/package.json is the version string). pnpm validate passes against this branch: typecheck, release:artifact, pnpm test (35 files, 433 tests), release:verify, and test:install. The rebuilt archive reproduced 0dbd333a… exactly, and release-reference.json's three digests were each measured off the files rather than transcribed.

The blob-hash comparison was run a second time against the pre-sync tree as a negative control: it reported 30 mismatched paths and exited 1, so a sync that silently dropped a file would not have passed.

The release workflow's awk extraction of the changelog entry was dry-run against the regenerated CHANGELOG.md and returns 66 non-empty lines, so the release note will not be install-steps-only.

🤖 Generated with Claude Code