chore(release): @hasna/repos v0.1.44 by andrei-hasna · Pull Request #71 · hasna/repos

andrei-hasna · 2026-08-07T15:58:09Z

Summary

bump @hasna/repos from 0.1.43 to 0.1.44
add the 0.1.44 changelog entry for the managed-path repository identity mismatch fix from fix(repos): refuse managed path identity mismatches #68
preserve the release diff to package.json and CHANGELOG.md only

Closes #67.
References #68.

Release boundary

The published 0.1.43 tarball records exact source commit
d5a37c043efb371dc9447c52aedf3ba4f79b9758; PR #68 merged afterward as
bca9a9a06a3721dbee5a0a1f35f4fc6d23bbbba9. This makes 0.1.44 the first
available version that can carry the fix.

Candidate:

commit: aec146e59bacc4e030be96b93118f2c97b3ed227
tree: 20fdd1c42d1a3c69bd4fe9466519b4c05d676c44
package SHA-256: a60e9102ea8ca44a6da6a62edead99a36711c94c0a61f1a311689e51fd513333
executable SHA-256: 06cdb84f2f9852db1d4263409c4b41a0dd57a133cd92b880b2165643fe0faa32

Verification

bun install --frozen-lockfile — exit 0
bun run typecheck — exit 0
bun test — 802 pass, 0 fail
bun run prepublishOnly — exit 0
two independent npm pack runs — byte-identical tarballs
fresh temporary bun add from the tarball — installed 0.1.44, CLI reports 0.1.44
release provenance verification receipt — exit 0, exact commit/tree/package/executable digests
shield review on the staged two-file diff — no security issues
candidate secrets scan — zero high/critical findings; only unchanged synthetic test-fixture entropy alerts
git diff --check — exit 0

This PR does not tag, publish, or install the package globally.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Release the managed-path repository identity mismatch fix from PR #68, closing issue #67. Agent: vitruvius

andrei-hasna · 2026-08-07T16:13:02Z

GO — no concrete, evidence-backed current in-scope P0/P1 findings.

Exact candidate reviewed:

head: aec146e59bacc4e030be96b93118f2c97b3ed227
base: bca9a9a06a3721dbee5a0a1f35f4fc6d23bbbba9
candidate tree: 20fdd1c42d1a3c69bd4fe9466519b4c05d676c44

Current merge result:

MERGE ba22f0e5b6092f37564ab38b215d8382eaff1ce1
TREE 20fdd1c42d1a3c69bd4fe9466519b4c05d676c44
PARENTS bca9a9a06a3721dbee5a0a1f35f4fc6d23bbbba9 aec146e59bacc4e030be96b93118f2c97b3ed227

gh pr view reports OPEN, MERGEABLE, CLEAN; CI run 31195262661 completed success on the exact head. Its Typecheck, Test & Build job and every required step succeeded. The sole Node.js 20 deprecation annotation does not break a required gate.

Release-diff and version checks:

git diff --name-status <base> <head> returns only CHANGELOG.md and package.json; git diff --check returns 0.
The diff is 18 insertions, 1 deletion: package version 0.1.43 -> 0.1.44 plus the top 0.1.44 changelog entry accurately describing merged PR fix(repos): refuse managed path identity mismatches #68. No code is added or changed.
npm view @hasna/repos@0.1.44 version --json returns E404; the GitHub v0.1.44 ref returns 404; current npm latest is 0.1.43.
The published 0.1.43 tarball's embedded provenance says exact_commit: d5a37c043efb371dc9447c52aedf3ba4f79b9758. git log d5a37c0..bca9a9a contains exactly PR fix(repos): refuse managed path identity mismatches #68's merge commit, proving 0.1.43 lacks that fix and 0.1.44 is the correct next release rather than a downgrade or duplicate.

Independent exact-head gates:

bun install --frozen-lockfile: rc=0
bun run prepublishOnly: rc=0
802 pass
0 fail

Two independent npm pack runs were byte-identical:

a60e9102ea8ca44a6da6a62edead99a36711c94c0a61f1a311689e51fd513333
byte_identical_rc=0

Isolated tarball install and provenance verification:

repos --version: 0.1.44
executable sha256: 06cdb84f2f9852db1d4263409c4b41a0dd57a133cd92b880b2165643fe0faa32
ship-chain verified: true
MERGED PASS
PUBLISHED PASS
INSTALLED PASS
RUNNING PASS

Security and attribution:

shield review: No security issues found in staged changes.
gitleaks: 1 commits scanned; no leaks found
Agent trailer count: 1
Co-Authored-By count: 0

Blocking findings: none.

andrei-hasna · 2026-08-07T16:27:43Z

[REVIEW] GO — #71 @ aec146e — lens: correctness+security+gates, reviewer Aruns (1 of 1)

Exact candidate and scope:

Reviewed HEAD aec146e59bacc4e030be96b93118f2c97b3ed227 against freshly supplied/fetched origin/main 8b08208b3c3d957fa39373380e120725dd0c0162.
Read git log --oneline origin/main..HEAD (exit 0), git diff origin/main...HEAD --stat (exit 0), and the complete diff plus surrounding package.json, CHANGELOG.md, src/db/repos.ts, src/lib/worktrees.ts, and the focused CLI/worktree regressions behind fix(repos): refuse managed path identity mismatches #68 and fix(repos): enforce managed identity on direct lookup #70.
The PR changes only CHANGELOG.md and the package version 0.1.43 to 0.1.44; the structured registry read npm view @hasna/repos version time --json exited 0 and reports latest 0.1.43 with no 0.1.44 timestamp.

Commands actually run on the exact PR head:

bun install — exit 0; setup only, 496 packages installed.
bun run typecheck — exit 0; 0 diagnostics emitted.
bun run test — exit 0; 802 pass, 0 fail, 3,567 expectations, 52 files.

Current-base validation:

The branch merge base/parent is bca9a9a06a3721dbee5a0a1f35f4fc6d23bbbba9; main advanced only in src/db/repos.ts, src/lib/worktrees.ts, and src/lib/worktrees.test.ts, while this PR changes only the two release files.
git merge-tree bca9a9a06a3721dbee5a0a1f35f4fc6d23bbbba9 origin/main HEAD — exit 0; conflict-free union.
On an isolated snapshot of that exact union: bun install — exit 0; bun run typecheck — exit 0 with 0 diagnostics; bun run test — exit 0 with 803 pass, 0 fail, 3,571 expectations, 52 files.
Live PR state read before this verdict: OPEN, MERGEABLE, CLEAN; Typecheck, Test & Build passed. [code]smith was skipped and is not a required failing gate.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.

andrei-hasna · 2026-08-07T16:41:28Z

[REVIEW] GO — exact merged release candidate 7c992a783402b5cf23dfda6422b5b49a0edd10bd has no concrete, reachable, in-scope P0/P1 defect under the bounded release threshold.

Exact identity:

parent: 8b08208b3c3d957fa39373380e120725dd0c0162
tree: 4375b1aa58484c58035382e53a113f64f3583928
origin/main: 7c992a783402b5cf23dfda6422b5b49a0edd10bd
current-base merge control: git merge-tree --write-tree 8b08208... aec146e... printed 4375b1aa58484c58035382e53a113f64f3583928, exactly the merged tree.
release diff versus parent is only CHANGELOG.md and package.json; package version is 0.1.44; git diff --check returned 0.

Required behavior and build lanes on the exact merged commit:

push CI run 31197840140 checked out 7c992a783402b5cf23dfda6422b5b49a0edd10bd and completed successfully.
literal test summary: 803 pass, 0 fail, 3570 expect() calls, Ran 803 tests across 52 files.
exact-CI targeting controls passed:
- repo lookup validates managed path identity > refuses a managed checkout whose name and path disagree with its remote
- repo lookup validates managed path identity > still resolves a managed checkout whose path and remote identities agree
- addWorktree > refuses a mismatched managed checkout before creating a branch, directory, or lease
TypeScript typecheck and the complete build, including release-provenance generation, passed in that same exact-commit run.

Package/install evidence bridge:

the previously exercised same-base release candidate 27daa374... passed prepublish, 803/0, reproducible pack, isolated install, CLI version, and four-rung verification.
git diff --quiet 27daa374... 7c992a78... -- . ':(exclude)CHANGELOG.md' returned 0: only changelog wording differs. CHANGELOG.md is not in package.json.files; packaged source and version are identical. The exact merged CI independently rebuilt the commit-specific provenance record.

Security, provenance shape, and release state:

exact range gitleaks: 1 commits scanned. / no leaks found; git diff --check: rc=0.
commit trailers: exactly one Agent: line; Co-Authored-By count 0.
npm view @hasna/repos@0.1.44 version --json: E404 / No match found for version 0.1.44; npm latest remains 0.1.43.
exact remote tag lookup for refs/tags/v0.1.44 returned no row, while the same probe returned refs/tags/v0.1.42 as its positive control.

Blocking findings: none.

Non-blocking follow-ups, recorded once:

The merged changelog describes fix(repos): refuse managed path identity mismatches #68 but omits fix(repos): enforce managed identity on direct lookup #70 numeric-ID and zero-mutation worktree coverage. That is P2 release-note completeness; the behavior and regressions are present and passing.
The singular trailer is Agent: Aruns, not the requested Agent: vitruvius. That is P2 attribution/provenance wording and does not affect source identity, package bytes, runtime behavior, security, rollback, or an applicable release gate; do not rewrite published history solely for it.

chore(release): @hasna/repos v0.1.44

aec146e

Release the managed-path repository identity mismatch fix from PR #68, closing issue #67. Agent: vitruvius

andrei-hasna merged commit 7c992a7 into main Aug 7, 2026
2 checks passed

andrei-hasna deleted the release/repos-0.1.44 branch August 7, 2026 16:29

Navigation Menu

Uh oh!

chore(release): @hasna/repos v0.1.44 - #71

chore(release): @hasna/repos v0.1.44#71
andrei-hasna merged 1 commit into
mainfrom
release/repos-0.1.44

andrei-hasna commented Aug 7, 2026 •

edited by blacksmith-sh Bot

Loading

Uh oh!

andrei-hasna commented Aug 7, 2026

Uh oh!

andrei-hasna commented Aug 7, 2026

Uh oh!

Uh oh!

andrei-hasna commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

andrei-hasna commented Aug 7, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Release boundary

Verification

Uh oh!

andrei-hasna commented Aug 7, 2026

Uh oh!

andrei-hasna commented Aug 7, 2026

Uh oh!

Uh oh!

andrei-hasna commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

andrei-hasna commented Aug 7, 2026 •

edited by blacksmith-sh Bot

Loading