Release CodeTruss CLI v0.2.50

[DeliriumPulse]

Syncs the 0.2.50 source from the private monorepo, byte for byte against the monorepo git objects (168 paths compared by blob hash, 0 mismatches, 0 missing).

codetruss-cli-0.2.50.tgz
sha256 1f5fc0d4633cda7d82f2c07e315496a9608bc15f01aa14cfc10aebbd88c977f5

That digest was not copied into release-reference.json: pnpm release:artifact was run against this tree, resolved from this repository's own lockfile, and the rebuilt archive cmps clean against both the monorepo's copy and the bytes codetruss.com is serving right now — as does the dist/cli.cjs inside it. The same cmp against 0.2.49 exits 1, so the comparison is capable of failing.

Why this one matters beyond the changelog

https://codetruss.com/downloads/codetruss-cli-latest.json already advertises 0.2.50, and its releaseUrl — .../releases/tag/v0.2.50 — currently 404s, because the release does not exist yet. So does the verify command the same manifest publishes. A user following our own published verification instructions fails today. Tagging this merge is what makes the advertised URL resolve.

0.2.47, 0.2.48 and 0.2.49 were merged to the monorepo but never tagged, so this sync carries four versions of source in one step rather than one. Those three stay unreleased; there is precedent (0.2.42 is served with no tag). Only the current advertised version needs to be real.

What 0.2.50 is

dead-code spent 26 of a 27-second analysis and bought nothing with it. The pass concatenated every indexed JS/TS file into one string — 18.2 MB on calcom/cal.com — then ran one regular expression per candidate module against the whole of it: O(candidates × corpus bytes), about 1,500 sweeps of an 18 MB string. It bought nothing because the pass has been saturated at its 20-finding output cap the entire time, so more scanning changed only which candidates were examined, never how many findings came out.

It now reads the corpus twice, builds one index of the filename stems the repository actually references, and answers each candidate with a set lookup. Per the change's own measurements on calcom/cal.com@b2c28a23 (7,691 files, 517,420 LOC), dead-code drops from 25.8s to 0.03s and the deterministic analyzer phase from 27.3s to 1.5s. The analyzer phase also gained a clock, so a pass that runs long is now visible instead of inferred.

The findings are unchanged, and that was checked rather than assumed. The old expression matched a filename stem wherever it appeared — inside strings, comments, unrelated tokens — and a tidier index that quietly stopped doing so would begin reporting live modules as dead. The replacement reproduces that looseness exactly: on four pinned repositories (cal.com, astro, TanStack/query, hono) the reported findings, the findings withheld behind the cap, the completeness flags and the pass metrics are byte-identical before and after, and a differential run against the original expression agrees on all 60,600 generated cases. Stems containing whitespace or a quote character can straddle the delimiters the index keys on, so those candidates keep the original whole-corpus test — the fallback exists so the rewrite cannot narrow the rule by accident.

Also carried, from the three unreleased versions

version	what it changed
0.2.47	Taint roots were decided by the name of the root identifier, so for (const event of salesforceEvents) made every event.<anything> an untrusted source. Root names are now gated on an actual binding.
0.2.48	Ten bounded passes reported "truncated" without a denominator, so the largest repositories got no score at all. Capped passes now carry a measurable coverage ratio.
0.2.49	A redirect to a path this codebase wrote itself was reported as an open redirect; on one real repository 17 of 19 such reports were false. The sink now requires attacker control of the origin.

Not touched

pnpm-workspace.yaml, .npmrc, pnpm-lock.yaml and .github/ are unchanged — the sync never writes mirror-owned files. public/downloads/grammars/ is carried verbatim. No previously published artifact is modified: git status under public/downloads/ reports nothing outside codetruss-cli-0.2.50.* and the latest pointers, so 0.2.44/0.2.45/0.2.46 still have exactly the bytes they were attested with.

Checked locally before opening

pnpm install --frozen-lockfile resolves with the lockfile untouched (the only source change to packages/cli/package.json is the version string). pnpm validate passes against this branch: typecheck, release:artifact, pnpm test (34 files, 425 tests), release:verify, and test:install. The rebuilt archive reproduced 1f5fc0d4… exactly, and release-reference.json's three digests were each measured off the files rather than transcribed.

The blob-hash comparison was run a second time against the pre-sync tree as a negative control: it reported 19 mismatched and 3 missing paths and exited 1, so a sync that silently dropped a file would not have passed.

🤖 Generated with Claude Code