Skip to content

docs: record v0.2.0 as released; npm still pending #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gitdamnit merged 1 commit into from
Oct 17, 2026
Merged

docs: record v0.2.0 as released; npm still pending #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 23 additions & 15 deletions PROJECT_STATUS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,24 +2,27 @@

## Current Phase

In Progress
Released

## Repository State

<!-- Machine-maintained by `prodoc update`. Do not hand-edit. -->
<!-- prodoc:observed:start -->
<!-- Observed from Git metadata only, by `prodoc update`. This block is not evidence that the implementation or its tests are correct; record that under `## Verification Evidence`. -->
- **Observed branch:** feat/stranger-danger-v2-hardening
- **Observed commit:** 9cfd8135429bffb2e5e32e97f23bec3f5b6277bd
- **Observed commit:** 64929cbaf509dc1b21011d13997c06dad92d6189
- **Observed working tree:** dirty
- **Observed at:** 2026-10-17T00:24:21Z
- **Observed at:** 2026-10-17T00:29:14Z
<!-- prodoc:observed:end -->

## Verification Evidence

- **Verification:** commit `9cfd8135429bffb2e5e32e97f23bec3f5b6277bd` — local full suite green (322 tests, 0 fail) after a clean `npm ci`, with a rebuild producing byte-identical `dist/` — evidence `/tmp/opencode/sd-verify.log` (typecheck, lint, build, unit, integration, security, package validation all `rc=0`)
- **Verification:** commit `9cfd8135429bffb2e5e32e97f23bec3f5b6277bd` — `npm run verify:package` passed every artifact check (pack, isolated install, `sd version`/`sd rules`, secret-free scan JSON, engine export, V2 plugin shape, root `index.js`) — evidence `/tmp/opencode/sd-verify.log`
- **Verification:** commit `9cfd8135429bffb2e5e32e97f23bec3f5b6277bd` — Docker Plugin Test Lab, `stranger-danger` 0.2.0, image `opencode-plugin-lab:local` (`sha256:76ebd805cd548a638b9b1508e5f16e680cd5b082cd3f3561d28f2f2301336ff1`), 145/145 passed on OpenCode 2.0.21 / Node 22.23.3 — evidence `/home/evan/Projects/opencode-plugin-lab/reports/rc-evidence.json` and `/home/evan/Projects/opencode-plugin-lab/reports/test-report.md`
- **Verification:** commit `64929cbaf509dc1b21011d13997c06dad92d6189` — release commit is byte-identical to the verified source (`git diff 9cfd813542..64929cb -- src tests dist scripts rules .github` is empty); CI green — evidence https://github.com/gitdamnit/opencode-stranger-danger/actions/runs/38986326595
- **Verification:** commit `b634ce5cb84c533c1fd1f6802d922b6e812e5afb` — merge commit on `master`; `git diff 9cfd813542..b634ce5 -- src tests dist` empty; CI on `master` green; clean install from the public tag installed, ran `sd version` → 0.2.0, detected a synthetic `github-pat` with the raw value absent from output — evidence `/tmp/opencode/clean-install.log`
- **Verification:** commit `b634ce5cb84c533c1fd1f6802d922b6e812e5afb` (annotated tag `v0.2.0`) — GitHub release published; the tag-triggered `publish.yml` workflow passed every gate (typecheck, lint, unit, integration, security, build, package validation) and failed only at `npm publish` with `ENEEDAUTH` (no token), so nothing was published to npm — evidence https://github.com/gitdamnit/opencode-stranger-danger/releases/tag/v0.2.0

## Completed Work

Expand All @@ -31,9 +34,10 @@ In Progress
- [Implemented] Atomic `sd redact` with opt-in out-of-tree backup — `src/cli/commands/redact.ts`
- [Tested] Unit, integration, security and full suites green at `9cfd813542` — `/tmp/opencode/sd-verify.log`
- [Tested] Packed-artifact validation green at `9cfd813542` — `/tmp/opencode/sd-verify.log`
- [Implemented] CI (typecheck, lint, build, tests, package validation) and npm publish workflow — `.github/workflows/ci.yml`, `.github/workflows/publish.yml`
- [Implemented] CI and npm publish workflows — `.github/workflows/ci.yml`, `.github/workflows/publish.yml`
- [Implemented] MIT `LICENSE` and vulnerability-disclosure `SECURITY.md` — `LICENSE`, `SECURITY.md`
- [Planned] npm publication of `@gitdamnit/stranger-danger` (requires registry credentials)
- [Published] GitHub release `v0.2.0` at merge commit `b634ce5cb84c533c1fd1f6802d922b6e812e5afb` — https://github.com/gitdamnit/opencode-stranger-danger/releases/tag/v0.2.0
- [Blocked] npm publication of `@gitdamnit/stranger-danger@0.2.0` — registry credentials absent (`ENEEDAUTH`, no `NPM_TOKEN`)

## Tests

Expand All @@ -48,27 +52,31 @@ In Progress
| full | `npm test` | Pass (322) | `/tmp/opencode/sd-verify.log` |
| package | `npm run verify:package` | Pass | `/tmp/opencode/sd-verify.log` |
| runtime lab | Docker Plugin Test Lab `--all --tier validate` | Pass (145) | `/home/evan/Projects/opencode-plugin-lab/reports/test-report.json` |
| clean install | clone `v0.2.0` → `npm pack` → install into isolated project | Pass | `/tmp/opencode/clean-install.log` |
| release CI | `CI` on merge commit `b634ce5` | Pass | https://github.com/gitdamnit/opencode-stranger-danger/actions/runs/38986400189 |
| npm publish (tag) | `Publish to npm` on tag `v0.2.0` | Fail (expected: `ENEEDAUTH`) | https://github.com/gitdamnit/opencode-stranger-danger/actions/runs/38986473186 |

## Known Defects

- None known. Non-blocking observations: `tests/debug.test.ts` and `tests/debug2.test.ts` are trivial sanity stubs; the provider-WebSocket, raw-HTTP-body, exotic-object, and encoded-secret gaps are documented limitations, not defects.

## Blockers

- npm publication is blocked on registry ownership/authentication: the `@gitdamnit` scope is not published and no `NPM_TOKEN` secret is configured. GitHub publication is unaffected.
- npm publication is blocked on registry ownership/authentication: the `@gitdamnit` scope is not published and no `NPM_TOKEN` secret is configured. GitHub publication succeeded and is unaffected.

## Next Actions

1. Merge the release pull request for `feat/stranger-danger-v2-hardening` into `master`.
2. Create the `v0.2.0` annotated tag and the GitHub release.
3. When credentials exist, publish `@gitdamnit/stranger-danger@0.2.0` to npm and verify a clean install.
1. To publish to npm: create/claim the `@gitdamnit` scope, authenticate (`npm login`, or set the `NPM_TOKEN` repository secret), then re-run the `publish.yml` workflow for tag `v0.2.0` (or run `npm publish --access public` from a clean checkout of the tag). `publishConfig.access` is already `public` and `prepublishOnly` gates on typecheck, lint, tests, and build.

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Install dependencies before suggesting manual publish

When the maintainer follows the manual alternative from a fresh checkout, npm publish --access public invokes this package's prepublishOnly script before publishing, but the required dev dependencies have not been installed. I reproduced this from an archive of the target commit: npm publish --dry-run --access public exits during npm run typecheck because dependencies such as @types/node and @opencode/plugin are unavailable. npm documents that prepublishOnly runs first for npm publish, so this path should include npm ci before the publish command.

Useful? React with 👍 / 👎.

2. After npm publication, install with the documented `plugins: ["@gitdamnit/stranger-danger"]` form and re-verify.

## Release Status

Release candidate 0.2.0 is frozen at commit `9cfd8135429bffb2e5e32e97f23bec3f5b6277bd`
on branch `feat/stranger-danger-v2-hardening`. Version `0.2.0` in `package.json` and
`src/shared/version.ts`. Validated on OpenCode `2.0.21` / Node `22.23.3` in Docker
**v0.2.0 released on GitHub.** Annotated tag `v0.2.0` → merge commit
`b634ce5cb84c533c1fd1f6802d922b6e812e5afb`; release
https://github.com/gitdamnit/opencode-stranger-danger/releases/tag/v0.2.0.
Source is byte-identical to the Docker-verified commit
`9cfd8135429bffb2e5e32e97f23bec3f5b6277bd` (OpenCode `2.0.21`, Node `22.23.3`,
image `opencode-plugin-lab:local`
(`sha256:76ebd805cd548a638b9b1508e5f16e680cd5b082cd3f3561d28f2f2301336ff1`),
145/145 lab tests and 322/322 local tests green. GitHub publication is the
remaining step; npm publication is deferred pending credentials.
`sha256:76ebd805cd548a638b9b1508e5f16e680cd5b082cd3f3561d28f2f2301336ff1`;
145/145 lab, 322/322 local). **npm is NOT published** — the tag run failed at the
publish step with `ENEEDAUTH`; there is no registry artifact yet.
7 changes: 6 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,11 @@ Add to your `opencode.jsonc` (`plugins`, not the V1 `plugin` key):
}
```

> **0.2.0 is not yet on npm.** Until it is published, install it from the
> repository or a local checkout — see
> [Loading from a directory or a checkout](#loading-from-a-directory-or-a-checkout)
> below. The `plugins` entry above resolves once the package is published.
Comment on lines +52 to +55

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Provide an executable checkout installation example

For a user installing while 0.2.0 is absent from npm, this fallback is not actionable: the linked section gives neither a clone/tag command nor a complete plugins configuration using the checkout, while the only complete example still names the unpublished npm package. The OpenCode V2 plugin documentation supports explicit local paths and Git package specifications, so provide one exact end-to-end example; otherwise users can retain the unresolved package entry and unknowingly run without the protection this plugin provides.

Useful? React with 👍 / 👎.


The plugin requires the V2 runtime and `@opencode/plugin` (peer dependency).

#### Loading from a directory or a checkout
Expand All @@ -74,7 +79,7 @@ is unavailable, the plugin did not load.
### Standalone CLI

```bash
npm install -g @gitdamnit/stranger-danger
npm install -g @gitdamnit/stranger-danger # once published to npm
```

### Use with envsitter-guard
Expand Down
Loading