v3.4.0

Added

• Added bounded hook-performance benchmarks for smoke, 250-pair full-hook, and
  1,000-pair argument-pressure repositories. The reproducible reports measure
  discovery, commit/push latency, process-tree memory, fixture size, hostile
  path handling, and conservative Windows argv limits without putting timing
  assertions in ordinary pull-request CI.
• Added required packed-artifact shell compatibility CI for Linux /bin/sh,
  Bash, and Fish; macOS /bin/sh and Zsh; and Windows PowerShell and Command
  Prompt. Every lane runs an offline commit/push/doctor/uninstall scenario from
  a hostile path with stripped executable discovery. A separate manual
  checklist defines VS Code, JetBrains, and GitHub Desktop UI validation;
  v3.4.0's unavailable GUI lanes are explicitly unverified and deferred to
  #231 rather than inferred from shell success.
• Added a release metadata gate that requires package.json, both root
  lockfile version records, the exact tag, one dated changelog section, and its
  reviewed notes to agree before publication. GitHub Releases now use the
  validated vX.Y.Z title and extracted changelog body; recovery checks the
  same metadata, while a machine-readable ledger preserves the immutable
  v3.3.0–v3.3.2 exceptions without weakening future releases.
• Added a shipped compatibility matrix for package managers, Node versions,
  operating systems, shells, Git clients, install modes, and explicit
  unsupported boundaries. Required lifecycle CI now covers Bun 1.3.14, pnpm 10,
  Yarn Classic 1.22.22, and Yarn Berry 4.17.0 with
  nodeLinker: node-modules across Ubuntu, macOS, and Windows at Node 24, plus
  exact-minimum-Node lanes on Ubuntu. Berry uses an independent
  integrity-locked CLI fixture, manager-native workspace commands, and explicit
  doctor repair after clones because it does not run npm's prepare
  lifecycle; Plug'n'Play remains unsupported.
• Added deterministic cross-version lifecycle coverage using pinned immutable
  v2.5.1, v3.2.0, and v3.3.2 release fixtures. Required pull-request CI proves
  npm upgrades on Ubuntu/Node 24, a read-only release-candidate job exercises
  the exact tarball before its hash-checked handoff to the OIDC publish job, and
  weekly health runs the migration through pnpm, Yarn, and Bun. The supported
  forward path preserves project-owned prepare logic and custom hooks while
  refreshing only exact generated state; in-place downgrades are explicitly
  unsupported and have a documented manual rollback.
• Pre-commit now shows a default-on Commit Owl welcome once per clone so
  contributors know the repository uses commitment-issues and that confusing
  guidance should be reported. A versioned marker below Git's common directory
  is shared by linked worktrees; showWelcomeOnFirstCommit: false opts out,
  JSON and hook bypasses do not consume it, and all marker failures fail open.

Fixed

• Large machine-readable hook results now drain every partial or temporarily
  blocked pipe write before immediate exit, preventing JSON above the first
  roughly 64 KiB from being truncated.
• Repository-controlled filenames, refs, configuration values, and captured
  diagnostics can no longer inject carriage returns, line breaks, tabs, or
  other terminal controls into product-owned human output. Unsafe bytes render
  visibly, ANSI CSI/OSC sequences are stripped, intentional message layout and
  Unicode remain intact, and JSON mode keeps the exact semantic values.
• Husky-era core.hooksPath recognition now removes trailing separators with
  a bounded linear-time scan, preventing adversarial repository configuration
  from stalling init, doctor, or uninstall through regular-expression
  backtracking.
• Required and scheduled Yarn Classic jobs now resolve exact version 1.22.22
  from the reviewed npm lockfile instead of installing a second global copy
  outside the repository's integrity-pinned dependency graph.
• Legacy Husky migration and uninstall cleanup now refuse to follow a linked or
  otherwise uninspectable .husky directory, preventing owned-artifact cleanup
  from deleting files outside the repository.
• Setup and removal now refuse linked or non-regular package.json,
  .gitignore, and .commitmentrc.json paths. Descriptor and file-identity
  checks prevent a repository-controlled replacement from redirecting project
  writes outside the checkout.
• Packed Markdown links are now checked against the exact npm tarball manifest
  and again after installation. Links from shipped docs to repository-only
  policies, plans, and audit evidence now use canonical GitHub URLs instead of
  paths that break on npm or inside node_modules.
• Public adoption, launch, OpenSSF, and security guidance now reflects the exact
  supported package managers, v3.3.2's documented legacy empty release notes,
  local secret-scanning boundary, and completed mainline-tag authorization
  control instead of carrying forward broader or historical claims.
• The npm tarball now uses a closed allowlist for the 28 installed runtime
  scripts instead of publishing the entire scripts/ tree. Six lifecycle and
  coverage maintenance modules remain repository-only, while package-content
  tests verify the public bin, complete relative-import closure, and exact
  runtime/maintenance classification.
• Release tags now fail before dependency installation, packing, or publication
  unless their commit is reachable from the canonical main history, closing
  the gap between the reviewed-mainline release policy and the publish
  workflow.
• The publish workflow now packs once and lifecycle-tests that exact tarball
  before hashing, uploading, and publishing it. The integration verifies the
  packed CLI bin, Node shebang, and reported version on every platform, plus
  normalized executable and non-executable modes on the POSIX release producer.
• Failed releases now use a tested, fail-closed recovery classification instead
  of blindly repeating publication. Exact same-source and same-byte runs may
  resume unfinished downstream work only while latest still names the
  candidate. The final job cryptographically verifies its local SLSA bundle;
  existing draft assets must be byte-identical, and a draft already containing
  provenance requires a failed-job rerun that retains the original bundle.
  Mismatches and published partial releases require a new patch. npm dist-tag
  changes and deprecation remain manual owner actions, and destructive
  unpublish is never a recovery step.
• Generated hooks now invoke only the project-local
  node_modules/.bin/commitment-issues entry. Missing local installs
  self-neutralize instead of falling through to a same-named global binary,
  and exact older generated hooks remain safely repairable by doctor.
• The CLI now reports the required and detected Node versions before dispatch
  when a lenient package manager launches it below Node 22.11.0.
• pnpm and Yarn recovery/removal guidance now includes required workspace-root
  flags. ESLint/Prettier install hints and quickstarts use major-bounded specs
  that remain installable at the exact Node floor.
• The package no longer ships its repository-only prepare command as a
  dependency install script. Consumer hook repair remains composed explicitly
  by init and works after normal clone installs.
• First-run pre-commit warnings and errors now take priority over the Commit Owl
  welcome instead of producing two boxes. The welcome remains unconsumed until
  a later clean or informational run, preserving the one-box-per-invocation
  contract under both hook-output policies.
• Terminal boxes no longer crash when a launcher supplies a malformed,
  impossibly narrow, or unreasonably large COLUMNS value; the shared renderer
  falls back to the smallest valid rounded presentation.
• FORCE_COLOR=0 now removes both preformatted body escapes and Boxen border
  color, matching the documented explicit color-disable contract.
• Opt-in staged-secret enforcement now fails closed when Git cannot launch,
  exits nonzero, or returns malformed patch structure. Advisory mode still
  warns and continues, while terminal and JSON output distinguish an
  unavailable scan from a detected secret. Git-quoted hostile paths and valid
  binary, rename, deletion, missing-newline, and large patch shapes have
  regression coverage.
• Discovered Node test paths beginning with - are now passed after -- and
  made absolute when necessary, preventing the built-in test runner from
  interpreting a repository filename as an option at commit or push time.
• Hook classification and repair now refuse symbolic-link hook files and hook
  directories, including dangling links, so setup cannot write through an
  uninspectable hook path.
• Pre-push Node test reports now live below a randomized private temporary
  directory instead of a predictable process-ID filename.
• Hook-launched test commands and the repository's disposable Git fixtures no
  longer inherit Git's repository-local routing variables. Nested git init,
  commit, and push commands now stay inside their intended fixture instead of
  mutating the hook caller's repository or remote.
• Restored post-merge DCO enforcement after one unsigned roadmap update by
  recording the narrow governance exception and synchronizing the operational
  audit baseline across both workflows, the checker, and maintainer guidance.
• DCO range checks now recognize a valid trailing Signed-off-by trailer after
  Dependabot's commit-message metadata without accepting matching lines in the
  message body.
• CLI setup and hook-health commands now reject unknown options before
  mutation, so a misspelled --dry-run, -n, or --quiet cannot silently
  perform the normal action. Other public commands also reject arguments
  outside their documented contracts.
• init now inspects and preflights project-file writes before installing
  hooks, reports unreadable .gitignore and read-only package files without a
  raw Node.js stack, and remains idempotently repairable after partial setup.
  uninstall likewise refuses an unwritable package before removing hooks.
• Hook setup, repair, and removal now distinguish a non-bare Git working tree
  from a bare repository, distinguish an unset core.hooksPath from a failed
  Git probe, resolve configured hook paths through Git (including ~/...), and
  preserve uninspectable or unwritable hook paths with actionable diagnostics
  instead of success claims or raw Node.js exceptions.
• Hook-time configuration loading now warns when package.json is unreadable,
  invalid JSON, or contains a malformed precommitChecks container while
  continuing with valid standalone settings or safe defaults.
• init now derives optional commit-msg hook wiring and its setup summary
  from the same merged package/standalone configuration used at runtime.
  Standalone commitMessage.enabled policies are installed immediately, while
  disabled or invalid higher-precedence standalone values no longer inherit a
  package-level opt-in accidentally.

Changed

• Packed lifecycle integration now uses each manager's local-only runner,
  rejects inherited npm identity, exercises paths with spaces and Unicode,
  verifies scripts-disabled recovery and normal reinstall, asserts
  manager-specific hints, and removes the package dependency while preserving
  the manager lockfile.
• Machine-readable integration tests now validate every exercised --json
  payload recursively against the published versioned schema. The live
  message-state runner also commits its presentation-only fixture config so it
  no longer invents a dirty-worktree warning or hides a safe commit:fix
  recommendation.
• Replaced the README's feature-heavy opening with the established
  "For developers who overthink every commit" tagline and the plain-language
  contrast between catching mistakes early and catching them after they become
  expensive.
• Completed the meaningful-coverage audit with an executable production-to-test
  ownership map, locked-down coverage suppressions, repeatable generated-asset
  evidence, direct logo assertions, and deleted/renamed pre-push regressions.
  The aggregate CI Success gate now fails closed unless every required job
  explicitly succeeds, including when a dependency is skipped or incomplete.
• Consolidated documentation around canonical user references, a repository-only
  audience index, one maintainer operations guide, and preserved public trust
  evidence. The npm package now includes an explicit set of user guides and
  README SVGs instead of all maintainer, audit, planning, and gallery material.
• Refreshed the complete documentation set for the verified v3.3.2 baseline:
  launch preparation now requires human-authored HN copy, the roadmap and
  feature backlog reflect the open v4/platform/adapter proposals, release
  instructions use the working npm and SLSA verification flow, and trust,
  compatibility, OpenSSF, maintenance, and supply-chain guidance match current
  behavior. Broken internal anchors and stale shipped/deferred coverage entries
  were corrected as part of the audit.

Fixed

• Demo rendering CI now ignores only the volatile commit abbreviation and
  runtime values during SSIM comparison, evaluates the existing metadata-bounded
  two-frame timing variance, and keeps the strict visual threshold and original
  rendered artifact intact. Focused synthetic regressions guard against masking
  meaningful missing-scene, color, layout, or clipping changes.