Release CodeTruss CLI v0.2.55 - #47

Syncs the 0.2.55 source from the private monorepo, byte for byte against the monorepo git objects (163 paths compared by blob hash, 0 mismatches, 0 missing).

codetruss-cli-0.2.55.tgz
sha256 12010c43b6635c5e5384a753bd5467bfa7031f64403ccdf0acfa5f9baa150194

That digest was not copied into release-reference.json: pnpm release:artifact was run against this tree, resolved from this repository's own lockfile, and the rebuilt archive cmps clean against the monorepo's copy, against this repo's latest pointer, and against the bytes codetruss.com is serving right now. All three digests in release-reference.json were re-measured off the files — archive, SBOM, and the dist/cli.cjs extracted from inside the archive — rather than transcribed. The same cmp against the published 0.2.53 archive exits 1, so the comparison is capable of failing.

The blob-hash comparison was run a second time against the pre-sync tree as a negative control: it reported 8 mismatched paths and 7 missing, and exited 1, so a sync that silently dropped a file would not have passed.

Why this one is urgent

https://codetruss.com/downloads/codetruss-cli-latest.json already advertises 0.2.55, and its releaseUrl — .../releases/tag/v0.2.55 — currently 404s, because the release does not exist yet. Tagging this merge is what makes the advertised URL resolve.

This release supersedes an unreleased one

0.2.54 was merged to the monorepo and never released — no tag, no GitHub release, no Homebrew bump. That has precedent here (0.2.42 and 0.2.47 through 0.2.49 are all merged-but-unreleased, served from the site). It is not retroactively released; its changelog entry rides along in the chain and its change ships inside these bytes. The mirror carries download artifacts only for versions that were actually released, so public/downloads/codetruss-cli-0.2.54.* is deliberately absent, exactly as 0.2.47 through 0.2.49 are.

So this archive carries two changes:

0.2.54 — the README's profile id is now derived, not restated. The 0.2.53 archive contradicted itself: README.md said receipts identify the 15-pass local-registry-v4 profile while CHANGELOG.md, packed beside it in the same eight-file tarball, said local-registry-v5. scripts/docs-profile-policy.mjs now reads LOCAL_ANALYSIS_PROFILE.id from packages/cli/src/types.ts and the analyzer count from ANALYZERS in packages/analyzer-engine/src/registry.ts, and build-release.mjs asserts the README agrees with both — before any archive bytes exist, because that script refuses to overwrite an already-written versioned tarball. It runs wherever a release is built, in this repository as well as the monorepo.

0.2.55 — the mirror's CI can now fail on a rule. That is the part that matters for this repository specifically, and it gets its own section.

Until now, nine green contexts meant packaging, not behaviour

This repository carries packages/cli/ and packages/analyzer-engine/'s package.json and src. It carries no root tests/, and analyzer-engine ships src with no test directory to carry. The rule-level SAST suites live in the monorepo — tests/sast-regressions.test.ts against the hosted implementation, tests/analyzer-engine-parity.test.ts binding that to the shipped engine — and neither reaches here. A SAST behaviour regression could pass all nine contexts and the release job. Both 0.2.53 fixes were confirmed by an acceptance check run by hand, and the false positive one of them removed had already shipped.

packages/cli/scripts/test-acceptance.mjs closes that. It lives under packages/cli/, so it syncs here with the rest of the package; it joins the three existing scripts in this package's test script; it executes the built dist/cli.cjs — not src/, not the hosted implementation — over scripts/fixtures/acceptance/, and asserts the findings the release must and must not produce. Two fixtures, expected verdicts taken from the committed benchmark adjudication: a drizzle sql`…` tagged template that must not be reported (CWE-89 CRITICAL until 0.2.53), and client.query(param, …) on a database-shaped receiver that must be reported at HIGH on the client.query line (silent until 0.2.53). The benchmark repositories are not cloned.

Where it actually runs, measured rather than assumed. .github/workflows/ci.yml gates the Test step on matrix.node != '20.9.0'. So the acceptance script runs in six of the nine compatibility contexts (Node 22 and 24 on ubuntu, macos, windows) and in the tag-triggered release job, which runs pnpm test unconditionally. The three Node 20.9.0 contexts run only test-deterministic-package.mjs and test-release-verifier.mjs, and never reach it. The changelog entry inside this archive says "all nine compatibility contexts"; that sentence is wrong, and it is recorded in the "known wart" section below rather than patched, because these bytes are already served.

Verified capable of failing, in both directions, from inside this repository. Reverting the 0.2.53 tagged-template exemption in packages/analyzer-engine/src/security/rules.ts and rebuilding turns it red with CRITICAL sql-injection at src/db/rpc.ts:11 — SQL injection where none is allowed. Switching the caller-supplied-argument gate to () => false turns it red with expected exactly 1 sql-injection finding …, got 0. Restoring each returns it to green, and the 163-path blob comparison was re-run afterwards and still reported 163 identical, so the tree in this PR is not a patched-back approximation.

Bundle delta

dist/cli.cjs goes from 828,029 bytes (0.2.53, and 0.2.54 — identical size) to 828,065 (+36), 2 changed lines out of 296, first difference at byte offset 674,865.

That delta is entirely the inlined package.json: the version string, and the 36 characters of && node scripts/test-acceptance.mjs appended to the test script. git diff between the 0.2.53 and 0.2.55 monorepo trees reports no changes at all under packages/cli/src or packages/analyzer-engine/src. No analyzer, rule, or receipt behaviour changes in this release. The archive grows 955,997 → 962,141 bytes because CHANGELOG.md ships inside it and gained two entries; the eight-file archive membership is unchanged.

The frozen renderers still reproduce

Receipts stay on local-registry-v5. No frozen digest moved. The pinned block in packages/cli/test/verify-receipt.test.ts — v1 928da3c4…, v2 113d62de…, v3 f38a8bde…, v4 288de3e2…, v5 6ae337ce… — is byte-identical between the 0.2.53 and 0.2.55 monorepo trees.

That test is not decoration: flipping the last hex character of the v4 expected digest makes it fail with renders 'local-registry-v4' to the exact bytes its signature covers (1 failed, 20 passed), and the file was restored byte-exactly afterwards.

No published artifact was modified

git status under public/downloads/ reports nothing outside codetruss-cli-0.2.55.* and the latest pointers, so 0.2.44 through 0.2.53 still carry exactly the bytes they were attested with. packages/cli/CHANGELOG.md is 104 additions, 0 deletions; the 0.2.53, 0.2.52 and 0.2.51 sections are byte-identical to what is already published (8,359, 4,435 and 4,300 bytes respectively, heading excluded).

pnpm-workspace.yaml, .npmrc, pnpm-lock.yaml, package.json (root), README.md, CONTRIBUTING.md and .github/ are unchanged — the sync never writes mirror-owned files.

CHANGELOG.md at the root is regenerated from packages/cli/CHANGELOG.md. The generator was checked by feeding it the 0.2.53 package changelog and confirming it reproduces the committed 0.2.53 root changelog byte-for-byte; run with a deliberately wrong release version it throws, and with a wrong npm-trail version its output cmps non-zero, so it is capable of failing. Its npm-trail sentence stays at 0.2.50, because npm view @codetruss/cli dist-tags still reports latest as 0.2.50.

Checked locally before opening

pnpm install --frozen-lockfile resolves with the lockfile untouched (the only source change to packages/cli/package.json is the version string and the appended test script). pnpm validate passes against this branch: typecheck, release:artifact, pnpm test (35 files, 435 tests, plus the deterministic-package, release-verifier, changelog-policy and new acceptance suites), release:verify, and test:install. The rebuilt archive reproduced 12010c43… exactly, and the acceptance script printed:

acceptance: dist/cli.cjs 0.2.55 (newer than packages/cli/src and packages/analyzer-engine/src) reproduced 2 adjudicated verdicts over 2 fixtures

The release workflow's awk extraction of the changelog entry was dry-run against the regenerated CHANGELOG.md and returns 48 non-empty lines (3,644 bytes), so the release note will not be install-steps-only; the same awk for a version with no entry returns 0 bytes, which is the case the workflow refuses to publish.

One thing this release gets wrong

The 0.2.55 changelog entry — inside this archive — says the acceptance script "runs in all nine compatibility contexts". It runs in six of nine, for the reason given above: ci.yml skips pnpm test on Node 20.9.0. The check is real and the gap it closes is closed on every context that runs the test suite, but the count in the prose is wrong.

It is not corrected here. The 0.2.55 archive is already committed to the monorepo, already served by codetruss.com, and already advertised by the live manifest under the digest above; editing it now would mean changing bytes that are already published. It is recorded here and belongs in 0.2.56 — the same way the 0.2.53 README error was left standing and corrected in 0.2.54 rather than rewritten.

🤖 Generated with Claude Code