CodeTruss CLI v0.2.37
Two fixes that came out of chasing a Windows CI failure to its root, plus a guard so one class of release mistake cannot happen again.
Never signal a recorded process id. On Windows, a freed pid is recycled within milliseconds. Both process-tree killers ran taskkill on a leader pid recorded earlier — including from the child's own exit handler, where the leader is dead by definition — which could force-kill whatever unrelated process had inherited that pid. In CI it killed a freshly forked test worker. Termination is now gated on a liveness check through our own process handle, which cannot be misdirected.
The 0.2.35 changelog entry is restored. The 0.2.36 release overwrote its heading, so the release that moved security analysis onto your machine shipped with no entry of its own. It is back, byte-identical to what it said.
The release build now refuses to cut a version whose changelog is wrong — a missing heading, a broken version chain, a duplicate. The bug above is why.
Install
curl -fsSL https://codetruss.com/install.sh | shVerify what you installed
sha256 082a03fe5dd2d9c516acc76504e0bb45bc7d3b5a1fa7308fb2d627ce07a3c627
gh attestation verify codetruss-cli-0.2.37.tgz --repo CodeTruss/codetruss-cli