Skip to content

Releases: electricsheephq/evaos-code-review-bot-neondiff

Release list

NeonDiff v1.0.4

NeonDiff v1.0.4 Latest
Latest

Choose a tag to compare

View all tags
@100yenadmin 100yenadmin released this 12 Jul 08:27
v1.0.4
fc66d27
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.4

NeonDiff 1.0.4 replaces the earlier free-use-compatible package line with
mandatory API-backed activation for every supported repository review. It is a
real non-prerelease GitHub and npm release, and the installed public package,
activation transition, local dashboard, and browser flow have been verified.

Highlights

  • Require a current production entitlement before useful review or provider
    work on public, private, internal, or unknown repositories.
  • Publish neondiff@1.0.4 as npm latest and a matching non-prerelease
    GitHub Release.
  • Verify the public-registry install, API activation, cache no-bypass behavior,
    local dashboard routes, and installed browser interaction.

Changes

  • Pin the supported distribution to the production license API and prevent
    user-editable legacy values from disabling enforcement or restoring the
    former public-free path.
  • Support bounded-stdin activation with the mode-0600 file backend for
    headless CLI and daemon installs.
  • Fail closed before checkout, provider calls, review generation, or GitHub
    posting when activation is missing, invalid, revoked, expired, out of scope,
    offline, or backed only by diagnostic cache metadata.
  • Gate the CLI, daemon, local dashboard provider route, and quarantined Desktop
    useful-work boundaries while preserving setup and status diagnostics.
  • Preserve the advanced native SwiftUI Desktop application. The local HTML
    dashboard remains a browser/setup surface, not a WebView replacement.

Fixes

  • Recover the reviewed-tarball publish after npm omitted legacy gitHead
    metadata. The v1.0.4-only fallback accepts absence only when exact package
    bytes, npm signatures, and Sigstore/SLSA provenance bind the package to this
    repository, the publish workflow, annotated tag, and release source SHA. A
    present mismatched gitHead still fails closed.
  • Promote the existing immutable package without republishing, confirm registry
    convergence at latest=1.0.4, and remove the owned release-candidate
    quarantine tag.

Breaking / Migration

  • v1.0.3 and earlier do not enforce mandatory activation and must be upgraded.
  • Activate v1.0.4 through neondiff license activate before useful review or
    provider work. Same-origin dashboard activation is not included in v1.0.4
    and remains tracked in
    #556.
  • The package-allowlisted README, setup guide, and schema remain byte-identical
    to the reviewed v1.0.4 tarball. Its compatibility label
    free-source-available-beta does not bypass mandatory runtime activation;
    #559
    tracks the typed copy/schema update in the next immutable package.

Known Boundaries

  • #557
    tracks the owner directive that REQUEST_CHANGES requires exact-head trusted
    authorization. v1.0.4 does not yet provide that review-event policy.
  • #537
    tracks internal daemon upgrade and reboot-safe supervision.
  • #561
    tracks per-repository scheduler error isolation after a recovered GitHub App
    installation lookup delayed an otherwise healthy exact-head review.
  • #559
    tracks package-allowlisted copy, typed publication-proof validation, and a
    serialized predecessor rollback mode for the next immutable patch.
  • website #45
    owns synchronization of the public/free website and installer copy that was
    stale when this proof was captured. The verified install proof here used the
    public npm registry directly, not the website installer route.
  • Predecessor npm/GitHub/tag/Actions cleanup is not complete. Public source,
    forks, caches, clones, and already-downloaded artifacts cannot be recalled.
  • This release does not prove signed or notarized Mac distribution,
    Sparkle/appcast updates, browser/native parity, model quality, full customer
    readiness, or v1.1 completion.

Release Verification

  • Source SHA: fc66d27b6ab9f6a1eb8282d289ef63407cd96982
    (protected-main candidate 42db7c8ff7dba6ceac813238dcebfb54dc83851f)
  • Tag / release: annotated tag object
    c2dbb0fd69800785028eb42e30e72b2cc648eb3c, which peels to the source SHA;
    GitHub Release v1.0.4
  • Package identity: neondiff@1.0.4, shasum
    526c04bd24673351b9cc7136d8747df00ffaa2be, integrity
    sha512-ng6g4Ivn+eFzZWkxhDAOsvaimYQi8HWktnK9xTptNLg37EK/LRh2Xr5Y+sAYnX6Sqa1YBVd3iUZBMtQLQbYvcw==,
    npm provenance,
    no republish
  • CI / workflows:
    activation lifecycle,
    recovery,
    main CI,
    CodeQL,
    Swift Desktop Gate
  • Installed proof: fresh status missing/source=none, provider work denied
    before input, and an internal-team production-smoke entitlement activated as
    active/source=api. The observed plan identifier internal is not customer
    billing or checkout proof. The provider route returned HTTP 200 after
    activation with metadata_only/configured_unverified; that proves
    configuration metadata and route gating, not end-to-end provider inference.
    Cache-only provider access remained denied with HTTP 403; the browser produced
    one redacted Verify API Key result and zero console warnings or errors.
  • Evidence:
    docs/evidence/v1.0.4-publication-proof.json,
    external proof-manifest SHA-256
    29a6ac64f828cf4fe10ad4e299ab0a14447a772c7c8d8b2c815e995468d784d8,
    attested lifecycle aggregate
  • Rollback reference: source baseline refs/tags/v1.0.3 in an isolated recovery
    checkout. v1.0.4 has no authorized npm predecessor-rollback command: the
    current workflow supports forward publication and bounded v1.0.4 recovery,
    not moving latest backward. Channel rollback is owner-gated under #559;
    do not republish immutable versions or mutate dist-tags as an ad hoc shortcut.
  • Proof tier: public release plus installed-package activation/dashboard/browser
    smoke; not signed Mac, customer-runtime, parity, or v1.1 proof
Assets 2
Loading

NeonDiff v1.0.3

NeonDiff v1.0.3

Choose a tag to compare

View all tags
@100yenadmin 100yenadmin released this 09 Jul 22:41
v1.0.3
5411365
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.3

  • Release type: stable Mac startup-stability patch
  • Release source SHA: to be stamped by refs/tags/v1.0.3
  • Previous stable release: v1.0.2
  • Tracking issues / source PR: #484, #503, #505, #506
  • Package artifact: neondiff@1.0.3 after publish
  • Rollback baseline: v1.0.2

Purpose

Publish the Keychain startup-stability fix without changing NeonDiff's public
1.0 launch boundary. The native Mac app remains the advanced product surface;
the local HTML dashboard remains a browser preview and setup surface rather than
an embedded replacement for the native UI.

Included Changes

  • Stop desktop model initialization from decrypting stored GitHub login or
    expiration values.
  • Use metadata-only Keychain presence queries with
    kSecUseAuthenticationUISkip, including legacy ACL-protected items, without
    constructing a LocalAuthentication context during startup.
  • Preserve interactive Keychain reads for explicit user actions and source
    compatibility for existing secret-store conformers.
  • Share the detached dashboard argument contract with the displayed command so
    both paths explicitly use --operator false.
  • Pin the Swift PR and unsigned desktop-release workflows to macOS 15, compile
    the broad and Keychain check targets there, and keep Security-linked helper
    execution in the local visible-smoke lane.
  • Preserve the advanced native SwiftUI onboarding/provider experience; no
    WebView or embedded-browser takeover is included.

Required Gates

  • Focused validation:
    • NODE_OPTIONS=--experimental-sqlite npx vitest run tests/desktop-keychain-startup.test.ts tests/desktop-release-pipeline.test.ts tests/swift-ci-velocity.test.ts tests/public-release-readiness.test.ts tests/release-status.test.ts tests/checkout-issuance-smoke.test.ts --pool=forks --maxWorkers=1
    • swift run --package-path apps/neondiff-desktop NeonDiffDesktopKeychainChecks
    • swift run --package-path apps/neondiff-desktop NeonDiffDesktopCoreSmoke
    • npm run build
    • node scripts/check-public-claims.mjs
    • node scripts/check-secret-scan.mjs
    • git diff --check
  • macOS 15 release workflow proof:
  • License API proof:
    • docs/evidence/v1.0.3-license-api-healthz.json
    • docs/evidence/v1.0.3-license-checkout-issuance-unauthenticated.json
    • docs/evidence/v1.0.3-license-checkout-issuance-authenticated.json
  • Desktop startup proof:
    • docs/evidence/v1.0.3-desktop-startup-smoke.json
  • Release-status public manifest gate:
    • npx tsx src/cli.ts release-status --expected-head "$(git rev-parse HEAD)" --public-release-manifest docs/public-release-manifest.json --expected-public-version v1.0.3
  • npm publication governance:
    • the tag must be annotated and reachable from protected main
    • the declared pre-metadata candidate must be an ancestor of the tag
    • a stable package is rejected from a prerelease-marked GitHub Release
    • manual retries must resolve the matching existing non-prerelease GitHub Release
    • new packages publish under a quarantine dist-tag; registry integrity, shasum, and gitHead must match the reviewed tag and dry-run pack before promotion to latest

Before publication, release_candidate and source_checkout describe the
candidate honestly. The manifest gate validates release metadata and proofs; it
does not claim npm or GitHub publication. After the public registry, GitHub
Release, and installed-package smoke pass, a separate post-release state stamp
updates main to published without moving refs/tags/v1.0.3.

Caveats

  • This release does not ship signed/notarized desktop artifacts, Sparkle
    appcast, or auto-update proof. Those remain tracked by #116 and #449.
  • The macOS 15 hosted workflow proves compilation, bundle shape, and unsigned
    artifact packaging. Visible startup behavior is proven only for the named
    local unsigned bundle.
  • This release does not claim browser/native dashboard parity, full native
    desktop maturity, customer-ready installation, or calibrated review accuracy.

Rollback

Published npm versions and release tags are immutable provenance. Rollback does
not delete or rewrite v1.0.3, and it never resets a maintainer's main
checkout. Instead:

  1. Move the public install channel back to the verified 1.0.2 package.
  2. Reinstall 1.0.2 on affected daemon/dashboard hosts.
  3. Restart each host's configured daemon and dashboard process using its own
    launchd label and config path.
  4. Mark the GitHub v1.0.3 release as not latest and add an incident note that
    points users to v1.0.2.
npm dist-tag add neondiff@1.0.2 latest
npm install -g neondiff@1.0.2
gh release edit v1.0.3 \
  --repo electricsheephq/evaos-code-review-bot-neondiff \
  --latest=false

The host-specific restart is intentionally not hard-coded here: operators must
use the launchd label and configuration selected during that installation, for
example neondiff daemon start --launchd-label <label> --dry-run false --confirm true after
the package downgrade. Browser dashboard sessions are restarted from the newly
installed neondiff@1.0.2 binary.

The manifest's rollback fields remain source-checkout revert references to
satisfy the canonical governance gate. They may be used only in an isolated
recovery checkout, never against protected main; the npm/install commands
above are the public operator rollback.

Loading

v1.0.2

v1.0.2

Choose a tag to compare

View all tags
@100yenadmin 100yenadmin released this 09 Jul 17:00
v1.0.2
bf76be8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.2

  • Release type: stable desktop GitHub connection foundation patch
  • Release source SHA: to be stamped by refs/tags/v1.0.2
  • Previous stable release: v1.0.1
  • Tracking issues / source PRs: #484, #487, #499, #500, #501
  • Package artifact: neondiff@1.0.2 after publish
  • Rollback baseline: v1.0.1

Purpose

Publish a stable CLI/dashboard npm package release whose source tree includes
the verified desktop GitHub connection and repository discovery work that merged
after v1.0.1.

This patch keeps the v1.0 launch boundary unchanged: npm install -g neondiff
installs the CLI, neondiff dashboard opens the local HTML setup/status
dashboard, and the minimal Mac launcher remains the desktop entry point. The
new user-facing desktop foundation lets the app connect GitHub through the
GitHub App device flow, discover installed repositories, show public/private
repo visibility, and persist selected repositories through the config patch
path without writing tokens into config.

Included Changes

  • Ship the desktop GitHub App device-flow foundation:
    • public github.clientId config support;
    • Repos-pane device authorization controls;
    • Keychain-backed GitHub user-token storage;
    • refresh-token recovery and reconnect behavior;
    • paginated /user/installations and per-installation repository discovery;
    • public/private repository visibility rendering; and
    • manual/discovered repository allowlist controls that persist through
      config patch.
  • Carry forward the live desktop smoke proof from current main:
    • desktop authorized as 100yenadmin;
    • 3 GitHub App installations discovered;
    • 48 accessible repositories discovered;
    • public/private repo badges rendered; and
    • disposable allowlist config patch persisted with no token-like config
      values.
  • Refresh the public release manifest and license API proof paths for the
    v1.0.2 release line.
  • Keep the hosted website channel on its previously published deployment; no
    website code deploy or channel rollback is part of this patch.

Required Gates

  • Focused validation:
    • NODE_OPTIONS=--experimental-sqlite npx vitest run tests/public-release-readiness.test.ts tests/release-status.test.ts tests/checkout-issuance-smoke.test.ts --pool=forks --maxWorkers=1
    • npm run build
    • node scripts/check-public-claims.mjs
    • node scripts/check-secret-scan.mjs
    • git diff --check
  • License API proof:
    • docs/evidence/v1.0.2-license-api-healthz.json
    • docs/evidence/v1.0.2-license-checkout-issuance-unauthenticated.json
    • docs/evidence/v1.0.2-license-checkout-issuance-authenticated.json
  • Desktop GitHub proof:
    • committed redacted proof packet: docs/evidence/v1.0.2-desktop-github-smoke.json
  • Release-status public manifest gate:
    • npx tsx src/cli.ts release-status --expected-head "$(git rev-parse HEAD)" --public-release-manifest docs/public-release-manifest.json --expected-public-version v1.0.2

Caveats

  • This release does not ship signed/notarized desktop artifacts, Sparkle
    appcast, or auto-update proof. Those remain tracked by #116 and #449.
  • This release does not claim full native Swift desktop maturity; it publishes
    the local-first desktop GitHub connection foundation.
  • This release does not claim CodeRabbit parity, calibrated 95% review
    accuracy, auto-merge, approvals, native ZCode skills/MCP/memory, or
    target-repo mutation.
  • Public release proof is not complete until neondiff@1.0.2 is published to
    npm latest and the non-prerelease GitHub Release v1.0.2 targets a commit
    containing candidate head fb2e0238287198a1fa1462f066f295dee6c9ea2e.

Rollback

: "${REPO_ROOT:?set REPO_ROOT to your local NeonDiff checkout}"

cd "$REPO_ROOT"
git fetch origin --tags
git checkout main
git reset --hard refs/tags/v1.0.1
npm dist-tag add neondiff@1.0.1 latest
Loading

v1.0.1

v1.0.1

Choose a tag to compare

View all tags
@100yenadmin 100yenadmin released this 09 Jul 13:17
v1.0.1
4381bea
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.1

  • Release type: stable patch release hygiene and license-boundary proof
  • Release source SHA: to be stamped by refs/tags/v1.0.1
  • Previous stable release: v1.0.0
  • Tracking issues / source PRs: #382, #485, #492, #484
  • Package artifact: neondiff@1.0.1 after publish
  • Rollback baseline: v1.0.0

Purpose

Cut the first stable patch after GA so release operations stop depending on
historical beta surfaces.

This patch keeps the v1.0 launch boundary unchanged: npm install -g neondiff
installs the CLI, neondiff dashboard opens the local HTML setup/status
dashboard, and the minimal Mac launcher remains the desktop entry point until
the v1.1 signed desktop lane lands.

Included Changes

  • Remove public npm install exposure for the pre-1.0 beta train:
    • remove the beta dist-tag;
    • unpublish neondiff@0.4.30-beta.1 where npm permits;
    • verify neondiff@beta and neondiff@0.4.30-beta.1 return 404;
    • verify neondiff@latest resolves to 1.0.0 before this patch publishes.
  • Delete historical GitHub prerelease pages while preserving Git tags/source
    refs for provenance and rollback.
  • Add npm publish-token preflight to the publish workflow so missing NPM_TOKEN
    fails early with an actionable error.
  • Retire the old manual npm publish default of v0.4.30-beta.1; manual
    workflow dispatch now defaults to v1.0.1.
  • Pin public CI and npm publish workflows to immutable actions/checkout and
    actions/setup-node v5 commit SHAs compatible with the GitHub Actions Node 24
    runtime. The workflows still install Node.js 26 for NeonDiff itself.
  • Keep the hosted website/install surface in the public release manifest as a
    required published channel. The hosted installer defaults to npm latest, so
    it picks up neondiff@1.0.1 after the npm promotion without a website code
    deploy.
  • Keep the public/private license boundary guarded in release-readiness tests:
    public repositories may run free when license.publicReposFree is true, and
    private/commercial repositories require an active entitlement before checkout,
    provider calls, or posting.

Required Gates

  • Focused validation:
    • NODE_OPTIONS=--experimental-sqlite npx vitest run tests/public-release-readiness.test.ts tests/linux-packaging.test.ts tests/license.test.ts --pool=forks --maxWorkers=1
    • npm run build
    • node scripts/check-public-claims.mjs
    • node scripts/check-secret-scan.mjs
    • git diff --check
  • License API proof:
    • docs/evidence/v1.0.1-license-api-healthz.json
    • docs/evidence/v1.0.1-license-checkout-issuance-unauthenticated.json
    • docs/evidence/v1.0.1-license-checkout-issuance-authenticated.json
  • Rollback target proof:
    • docs/evidence/v1.0.1-rollback-refs.json
  • Registry/release cleanup proof:
    • registry and GitHub release-page cleanup evidence linked from the release
      tracker and cleanup issue.

Caveats

  • This release does not ship signed/notarized desktop artifacts, Sparkle
    appcast, or auto-update proof. Those remain tracked by #116 and #449.
  • This release does not delete historical Git tags; it removes public GitHub
    prerelease pages and npm install channels only.
  • This release does not claim CodeRabbit parity, calibrated 95% review accuracy,
    auto-merge, approvals, native ZCode skills/MCP/memory, or target-repo mutation.

Rollback

: "${REPO_ROOT:?set REPO_ROOT to your local NeonDiff checkout}"

cd "$REPO_ROOT"
git fetch origin --tags
git checkout main
git reset --hard refs/tags/v1.0.0
npm dist-tag add neondiff@1.0.0 latest
Loading

v1.0.0

v1.0.0

Choose a tag to compare

View all tags
@100yenadmin 100yenadmin released this 09 Jul 10:09
v1.0.0
23d6671
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.0

  • Release type: stable GA package and local dashboard release
  • Release source SHA: 23d66717c0627b25a8c56895bba9627bcdd69cca
  • Previous prerelease: v0.4.46-beta.1
  • Tracking issues / source PRs: #396, #421, #443, #444, #445, #446, #447, #448, #450, #451
  • Release metadata base SHA: 7453349008ca8f23641fab1665ac909d0b51b10a
  • Package artifact: neondiff@1.0.0 published to npm latest
  • Rollback baseline: v0.4.46-beta.1

Purpose

Cut the first stable NeonDiff release.

The 1.0 launch bar is intentionally narrow: npm install -g neondiff installs
the CLI, neondiff dashboard opens the local HTML setup/status dashboard, the
dashboard can verify provider API-key readiness with redacted output, and the
minimal Mac launcher opens that same dashboard. Signed desktop packaging,
notarization, Sparkle appcast, and auto-update maturity remain post-launch work.

Included Changes

  • Publish the public npm package as neondiff@1.0.0.
  • Move first-run install docs and the website installer default from the held
    beta package to the latest npm path.
  • Keep the local dashboard as the GA setup surface for license status, GitHub
    App status, daemon status, and provider readiness.
  • Include the minimal Mac launcher/smoke lane as GA proof only for opening the
    same dashboard, not as signed desktop maturity.
  • Promote the license API from health-only proof to configured checkout
    issuance proof:
    • unauthenticated issuance fails closed with HTTP 401;
    • owner-held authenticated smoke writes only a redacted prefix/fingerprint
      proof;
    • product validator activation accepts a live nd_live_ key minted by the
      license API.

Required Gates

  • Release metadata PR checks must pass on the current head.
  • Focused public readiness checks:
    • npm test -- --run tests/public-release-readiness.test.ts tests/release-status.test.ts --pool=forks --maxWorkers=1
    • npm run build
    • node scripts/check-public-claims.mjs
    • node scripts/check-secret-scan.mjs
    • git diff --check
  • License API proof:
    • docs/evidence/v1.0.0-license-api-healthz.json
    • docs/evidence/v1.0.0-license-checkout-issuance-unauthenticated.json
    • docs/evidence/license-checkout-issuance-authenticated.json
  • Runtime/payment proof:
    • docs/evidence/v1.0.0-live-checkout-success-redacted.json
    • docs/evidence/license-checkout-issuance-authenticated.json
  • Rollback target proof:
    • docs/evidence/v1.0.0-rollback-refs.json
  • After merge and publish:
    • npm view neondiff version dist-tags --json shows latest at 1.0.0;
    • npm install -g neondiff installs 1.0.0;
    • neondiff dashboard --config config.local.json opens the local HTML dashboard;
    • GitHub Release v1.0.0 is non-prerelease and points at this packet.

Caveats

  • This release does not claim CodeRabbit parity, calibrated 95% review accuracy,
    auto-merge, approvals, native ZCode skills/MCP/memory, or target-repo mutation.
  • This release does not ship signed/notarized desktop artifacts, Sparkle
    appcast, or auto-update proof. Those remain tracked by #116 and #449.
  • Live checkout proof used the owner-approved QA promo path, redacted success
    page state, and a Stripe-style signed replay after the schema fix. It does
    not claim the original in-flight Stripe delivery was accepted before that
    fix, and it does not publish raw license keys, webhook secrets, fulfillment
    tokens, customer-sensitive checkout payloads, or operator-local scratch paths.

Rollback

: "${REPO_ROOT:?set REPO_ROOT to your local NeonDiff checkout}"

cd "$REPO_ROOT"
git fetch origin --tags
git checkout main
git reset --hard refs/tags/v0.4.46-beta.1
npm dist-tag add neondiff@0.4.30-beta.1 latest

Website rollback is scoped to the website repo, not this product checkout:

git -C /path/to/neon-diff-agent-website revert 6b670d00cd587fb7d564347b6bc0d4d3e8d13186
Loading