v2.13.0

• 2.12.0 was not published to npm; 2.13.0 contains its changes too.

Added

• Rule-based verdict in ASD-STE100 on the dashboard and the site. Each agent run gets headline.verdict: BENEFICIAL, NO CLEAR EFFECT or SUBOPTIMAL per arm vs vanilla, from success change, uncached saved % and its spread, cost saved % and wall time change. SUBOPTIMAL: success drops by more than 5 pp, tokens increase in every repeat, or more than 25 % slower. Fewer than 3 repeats mark the verdict "indicative". Fixed templates make short sentences, e.g. "With guidance, code-context decreases the token use by 28 %." The dashboard shows a chip on the latest cards and a Verdict section in the run detail; the site shows a verdict card, the label in the history and per group on private-suite cards. Older runs and summaries get the verdict computed from the same fields, so no published file changes. Private summaries carry verdict per run and group; the shape check accepts only the text the rule makes from the block's numbers. Rule and constants: scripts/bench/lib/verdict.mts, documented in BENCHMARK-GUIDE.md "Verdict rule". (#156)
• Private suite runs in the local dashboard. CODE_CONTEXT_BENCH_PRIVATE_DIRS (path list of suite dirs or their data/ dirs) merges private runs into the Benchmark page with a private chip and the suite alias, plus an All / Public / Private filter. /api/bench/run/:id?suite=pN serves them under the same id, index and realpath rules, per dir. The files are read from disk only and sent nowhere. (#154)
• bench:publish --private-summary <suite-dir> [--runs id,id] publishes a redacted summary. Schema ccc-bench-private-summary/1 holds only the suite alias, scope counts, and per run and per group: success, uncached tokens per session and per PASS, cost, wall time, uncached saved % with min–max spread and cost saved %. A guard refuses the summary on any suite name, path, commit, task id, prompt token, answer item, hash, absolute path or secret, and names only the JSON path. Only data/private/<alias-slug>.json and data/private/index.json are written, through the usual temp worktree; --dry-run prints the summary. Full private runs stay refused. New optional suite fields: alias, groups, tasks[].group, groupByPrefix, publicTaskIds. The site shows each summary as a "Real-world private suite" card with the caption that task texts and code are private. (#154)
• bench:live --suite <dir> runs private suites from outside the repository. A suite (suite.json, schema ccc-bench-suite/1, plus answers.json) pins local git clones by commit; each session workspace comes from git archive, so the clone's working tree is never read. New checkers path-set and symbol-set compare the answer with the suite's answer key. Results go to <dir>/data/. A private suite refuses a --data-dir inside the repository, its run JSON carries suite.private: true, and bench:publish refuses such runs. With redact (default for private suites), the run JSON stores tasks by id and sha256 only. npm run bench:suite-check -- <dir> validates a suite and builds and indexes one workspace without a model. (#149)
• PHP in the code index. .php files get exports with one-line signatures and lines (class incl. abstract/final/readonly, interface, trait, enum, top-level function and const; short name in exports.name, namespace-qualified name in exports.description), use lines in import_lines, and dependency edges from use (grouped, aliased, use function, use const), extends, implements, trait use and class names in code. Names resolve through the nearest composer.json PSR-4 maps (autoload and autoload-dev, also in a subdirectory), then through the indexed declarations; same-namespace classes resolve without use. Vendor namespaces are external packages, not edges. Comments, strings, heredoc/nowdoc and inline HTML (Blade) never create exports or edges. find_symbol and who_imports also take a qualified name (App\Models\User). A synthetic 1,501-file PHP tree indexes in about 0.8 s. (#148)

Fixed

• tsconfig/jsconfig path aliases make import-graph edges. import … from "@/lib/x" (and baseUrl imports such as components/Button) now resolve through the nearest tsconfig.json/jsconfig.json, its extends chain (relative and node_modules package configs) and, for Vite-style solution configs, the references entry whose include covers the file. paths follow TypeScript's rules (exact key, then longest * prefix, targets in order, relative to baseUrl or the defining config); files probe like relative imports, incl. .d.ts and .js → .ts. who_imports, exports_in, get_file_context and search_files see the new edges, and resolved aliases leave External packages. Configs are parsed with comments and trailing commas by a linear scanner, capped at 1 MB, and cached per index run. On a 475-file Vite React SPA: 952 of 952 alias imports resolve, edges 179 → 1,094. A 6,000-file synthetic tree indexes in ~3.1 s instead of ~2.5 s (27,119 edges instead of 8,872). Vite resolve.alias is not read. Re-index to get the edges. (#151)
• bench:live timeouts end a session at the limit. The deadline runs on the wall clock, and SIGTERM then SIGKILL reach the agent's whole process tree; the runner no longer waits on output pipes a leftover process holds. A timed-out session keeps its partial usage. Root cause of the ~900 s sessions: the Mac idle-slept on battery, and the old monotonic timer stopped in sleep. The runner now holds caffeinate -i on macOS. (#146)

Changed

• The benchmark page opens with one simple table for the latest run. The dashboard and the site show one row per model (GLM, Opus, DeepSeek) with the verdict chip, success, tokens, cost, speed and repeats in plain words ("25 % less", "23 % faster"), a caption and one result sentence per model. All other views move into one collapsed "Show details" block. (#160)
• The lowest benchmark verdict is SUBOPTIMAL, and few repeats can show it. The verdict code and label change from HARMFUL to SUBOPTIMAL; the text says "Result: code-context is suboptimal for these tasks." With fewer than 3 repeats, a token increase of 10 % or more gives SUBOPTIMAL (indicative), e.g. "The token use increases by 12 % in 1 repeat." The dashboard, the site, the index builder and the private-summary check read a stored HARMFUL verdict as SUBOPTIMAL. (#158)
• bench:live retries a failed session once. A provider error, 0 model calls or a machine sleep during the session gets one retry with a fresh workspace and HOME; the run notes list every retry. The run is void only when the retry fails too. A timeout with model calls stays a model FAIL. (#146)