v0.19.49

Backlog burn-down for the 0.19.47 feedback wave (items 11, 12, 13, 18, 20; server-side 16, 17, 21 ship separately).

init CLI

• npx @truverifai/init --version prints the version instead of running a full install; any unknown top-level flag exits 2 with a corrective message and writes nothing (item 20).
• --only / --skip name components as components: --only hook steers to --skip hook, and a mixed bad list reports every problem class in one message (item 13).
• Doctor's codex tools row checks config loadability before trusting a text match, so a config codex itself cannot parse is a loud NOT-connected instead of a false green (item 11).
• Re-running init actually bumps the installed codex plugin: refresh by remove + re-add (codex has no update verb), with teardown gated on an already-exists failure so network/auth errors never remove a working marketplace (item 12).

Vendored gates

• Fail-open advisories now carry the diagnosis and a class-matched remedy phrased for the agent to relay (install Python 3, reinstall via npx @truverifai/init@latest, or run doctor and share the output), instead of a generic re-run suggestion (item 18).

Skills copy

• The skip-gate skill states gate_context_ids are exactly gc_ + 32 hex, must be forwarded verbatim (never reconstructed), names the two id-free recoveries when a skip dead-ends, and tells floor tools to forward BOTH printed lines, always (items 16, 17, 21).

v0.19.48

Gates-off is silent and honest.

• A disabled gate drains its stdin payload before exiting, so switching the gates off no longer raises false 'the gate could not be launched after repair' (EOF) fail-open alarms on large writes, and no longer loops through pointless repairs.
• The launcher judges a stdin-pipe break by the gate's output and exit status ('the gate ran'), never as a launch failure; a genuine crash routes to the script-crash marker with back-off.
• A healthy gate run clears a stale gate-failure-reason.json, so past false alarms stop appearing in doctor.
• doctor presents gates-off as a chosen state: one informational line and exit 0 instead of a wall of red enforcement rows; the nested-repo check explains a missing resolver log instead of a raw ENOENT; error details are no longer truncated mid-path.

Client-only release (no server change). Bundles: claude 0.19.48, copilot 0.19.48, npm/cli_vendor 0.19.48.

v0.19.47

0.19.47 — FW1 test-round fixes: sandbox-honest doctor, codex config repair, complete uninstall

Client-only (no server change). Fixes surfaced by the 0.19.46 prod test round.

doctor

• Every home-resolution site honors TVAI_HOME_OVERRIDE; the macOS Keychain probes are skipped under it. A sandboxed run no longer compares its fresh key against the real machine's configs (which produced false tools config STALE rows and exit 1). A pinning test bans raw os.homedir().

codex

• A hand-added [mcp_servers.truverifai.*] subtable with no parent table made codex's ENTIRE config unloadable ("invalid transport"), breaking every codex plugin command. uninstall now removes the whole mcp_servers.truverifai namespace; init repairs the dangling state before any codex command (comment-tolerant parent detection); doctor flags it; the failure copy is honest.

uninstall

• Also deletes host-added Bash(npx @truverifai/init:*) permission rules, and removes the Claude Code and Codex plugins via their own CLIs when available (best-effort, printed; desktop app gets the in-app step). Names its survivors. A 401 on a re-run revoke reads as "already revoked or not valid for this server", never a false verified-success.

smaller

• The "blocked BEFORE it ran" deny note is unconditional (a chained command's prefix also never ran); the human-decision ask states the same.
• Consent prompt: a mixed bad answer reports all problem classes in one message; a separators-only answer re-prompts.
• The /panel-review FAQ renders repo URLs as links.

Published with provenance (OIDC, no token).

v0.19.46

0.19.46 — external-feedback wave: consent-first init, complete uninstall, real line numbers

Fixes and changes from the first outside developer trial of panel-review.

Installer — consent-first

• init now prints a full plan of everything it will write for YOUR machine and asks ONCE before touching anything. New flags: --dry-run (plan only, zero writes), --only <agents>, --skip <agents,hook,rules>, --yes (non-interactive). Declining exits with nothing written.
• Git preflight verifies git by EXECUTION (git --version), not existence, so a broken shim can't silently disable the pre-commit gate.
• Claude Code desktop app (no CLI): setup stages the marketplace and prints the one in-app step to finish (+ button, then Plugins).
• doctor: the [gate endpoint] row no longer false-FAILs on a healthy install; new [git] headline row; a staged desktop install reports as STAGED (warn).

Complete uninstall — BEHAVIOR CHANGE for scripts/CI

• uninstall now also revokes the API key server-side, clears the plugin token from the macOS Keychain (edits our leaf only), and deletes .tvai-bak backups once live files are verified clean.
• uninstall and logout exit NONZERO when secret-bearing residue remains, with a list naming exactly what was left. Scripts that assumed unconditional exit 0 should check their handling.
• Hardened by a pre-release adversarial review: per-file guarded removals, tri-state Keychain handling, stored-key revocation with an env-divergence warning, and --only vscode no longer strands a repo-committed Copilot gate.

Vendored gate code (ships to the other platforms via this package)

• Gate blocks cite the REAL file line of the flagged code, not :1.
• TRUNCATE in comments/plain strings no longer fires sql_risk; TRUNCATE TABLE still floors via migration_destructive.
• package.json fires the dependency signal only on dependency-shaped added lines; scripts/metadata edits stay quiet.
• The commit gate prints target_hunk_hashes, ending the confirm_floor no_binding dead-end.

Published with provenance (OIDC, no token): https://search.sigstore.dev/?logIndex=2873228457

v0.19.45

Gate-self floor unification

Gate-self (changes to the gate's own code/config) is now the ordinary hard-floor category gate_self - not a separate un-skippable tier. The bespoke gself: coverage hash and its PASS-only release are retired; gate-self changes inherit the full floor lattice (audit_coding PASS, SYNTH_CONFIRM, free confirm_floor, lineage-verified recommendations_applied, accept_risk_no_review), while judgment/path skips and an uncovered recent_pass still never release them. This eliminates the gate-self commit deadlock (review -> findings -> apply -> re-fire -> no admissible release).

• False-floor prevention: collision-prone gate basenames (hooks.json, integrity.py, cacert.pem, platforms.yaml, ...) floor only in repos that demonstrably contain the gate product (repo-identity sentinel); distinctive names and .git/hooks/ stay global. No path matches that didn't match before.
• Zero-changed-line file ops still review: a pure rename / mode-only / binary change to a gate file tags a synthetic path-derived floor hunk.
• Comment-only edits to non-core gate files stay review-free; gate-core always reviews.
• Stale (pre-0.19.45) hooks fail OPEN on gate-self against the new server - never a deadlock.

Published with npm provenance via the tag-path workflow.

v0.19.44

0.19.44 — documentation only, no behavior change

No gate-code, CLI, or classifier changes. This release exists solely to ship the updated README to npmjs.com:

• Gate GIF banner at the top (the write gate blocking a risky auth change, live)
• "See it in action" section: the 90-second demo, the full 8-minute walkthrough, and the extended 4-minute demo

If you're on 0.19.43 there is nothing to update for — the vendored gate code is byte-identical.

v0.19.43

0.19.43 — backwards update-nudge fix

FIX (stale advisory): the gate update nudge could advertise an OLDER version than the one installed (e.g. "update available: v0.19.41" on a machine running v0.19.42). The persisted staleness verdict (7-day TTL) is never cleared by the server — the gate_update field is absent for a current client — and the client cache-invalidation check was equality-only, so a machine that updated past the cached target kept nudging backwards until TTL expiry.

The suppression is now a numeric semver compare (installed >= advertised) and the spent cache entry is dropped so the state file self-heals. Unparseable installed versions keep the fail-open posture.

Ships the vendored gate code for all npx-installed platforms; the same fix is live on the Claude marketplace (panel-review 0.19.43) and Copilot hooks (0.19.42).

v0.19.42

Custom-floor ^file$ write-gate correctness fix (client-side; no server change).

• FIX (silent coverage gap): a custom floor whose paths used an exact-file anchor like ^tier_config.py$ matched the CLI preview and the commit gate but silently missed the WRITE gate — the write gate classified against the absolute file path while preview and commit gate use repo-relative paths. build_change_diff now canonicalizes the classifier path to repo-relative at the emission choke point (identity only; filesystem reads keep the raw path), so ^file$ floors fire at the write gate exactly as at the commit gate.
• floors check now flags a bare ^filename$ anchor with the (^|/) rewrite (loud, non-failing) so a fragile path form is never silently blessed; the define-custom-floors skill teaches the (^|/) form.

Designed via deliberate_coding (unanimous) and audited via audit_coding on each commit; verified with a negative-tested regression guard and an independent adversarial review. The 0.19.39 server prefix rule remains live; no redeploy.

v0.19.41

Authoring-experience release (client-side only; no server change).

• Sweep-first define-custom-floors skill. The workflow now leads with a whole-codebase scan and presents the full candidate floor list up front; the interview moved to a refine step. Removes a self-contradiction that produced thin first drafts. Every floor ships thorough, code-derived keywords, and path floors propose exclude_paths for their test/example subtrees by default.
• floors check --preview now prints an "and N more" marker when a floor's file listing is truncated, so true coverage breadth is never hidden.

The 0.19.39 server prefix rule remains live; no redeploy needed.

v0.19.40

Custom floor classes: authoring-experience follow-up to 0.19.39. The define-custom-floors skill now scans the whole codebase and proposes a broader first draft on its own initiative, so you trim rather than repeatedly add. The meta-config carve-out applies to .truverifai/risk.json unconditionally, so first-time authoring no longer trips a built-in floor on its own keywords (a real pasted secret is still caught). Settings page: custom floors is its own Step 4 with a command-first layout. No server change required. Published with provenance.