chore(release): @hasna/repos v0.1.41

[andrei-hasna]

Summary

• Bump @hasna/repos from 0.1.40 to 0.1.41.
• Add the 0.1.41 changelog entry for the literal FTS query fix merged in fix: quote user queries for FTS search #63.
• Leave Bun lockfiles unchanged because they contain no workspace version and bun install --frozen-lockfile reports no changes.

Source reconciliation

Published 0.1.40 provenance identifies commit a2b28d7781a7a363fa52e25e5b79a8cfded41c38, which is an ancestor of current main. The separate release/0.1.40 commit is tree-identical to that squash commit, so no reconciliation merge is required.

Gates

• bun install --frozen-lockfile — exit 0, no changes
• bun run typecheck — exit 0
• bun test — 785 pass, 0 fail, 3491 expectations
• bun run build — exit 0
• npm pack --dry-run --json — @hasna/repos@0.1.41, exit 0
• bun run src/cli/index.tsx release health . --no-git — status ok, ready true, 0 issues
• staged secrets scan — no configured credential patterns matched

Task: 2b54e97f-49ca-4940-ac97-a2c490076906
Exact head: bc04e21

No publish has been performed. Rollback before merge: close this PR/delete the release branch. Rollback after merge but before publish: revert the release commit.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

Release handoff evidence for Todos task 2b54e97f-49ca-4940-ac97-a2c490076906 at exact head bc04e21f2b807565f3e0226109f619e6f0e1bcf1:

• Changed files: package.json, CHANGELOG.md only. bun.lock has no content diff; the Bun lockfile does not encode the workspace version.
• bun install --frozen-lockfile: Checked 250 installs across 324 packages (no changes)
• bun run typecheck: $ tsc --noEmit
• bun test: 785 pass; 0 fail; 3491 expect() calls; Ran 785 tests across 51 files. [88.32s]
• bun run build: Vite reported 1579 modules transformed and built all configured bundles.
• npm pack --dry-run --json: @hasna/repos@0.1.41, hasna-repos-0.1.41.tgz
• Release health: "status":"ok"; "issues":0,"ready":true
• git diff --check: exit 0
• Staged secrets scans before commit and push: no configured credential patterns matched.
• Published-source reconciliation: npm 0.1.40 provenance names a2b28d7781a7a363fa52e25e5b79a8cfded41c38; its tree matches origin/release/0.1.40 and it is already on main, so no reconciliation merge was required.

No merge or publish was performed. Rollback before merge: close this PR and delete release/0.1.41; after merge but before publish: revert bc04e21f2b807565f3e0226109f619e6f0e1bcf1.

[andrei-hasna]

[REVIEW] GO — #64 @ bc04e21 — lens: correctness+security+gates, reviewer unresolved-account003 (1 of 1)

Exact candidate reviewed

• Local HEAD: bc04e21f2b807565f3e0226109f619e6f0e1bcf1; fresh origin/main: 07624e165675fff1937ab9ae047afe1c3c66b872.
• git log --oneline origin/main..HEAD — exit 0; one release commit.
• git diff origin/main...HEAD --stat — exit 0; 2 changed files, 12 insertions, 1 deletion.
• Read the full diff of CHANGELOG.md and package.json, their surrounding release metadata, the reachable buildFtsQuery implementation and all three repository/commit/pull-request FTS callers in src/db/repos.ts, the CLI entry point, and the focused regressions in src/db/repos.test.ts.
• The release note matches base commit 07624e1: whitespace-delimited terms are quoted, embedded quotes are doubled, and every FTS query remains a bound SQLite parameter. The release-only diff adds no trust boundary, credential material, mutation path, or rollback hazard.

Commands run

• bun install — exit 0; setup only, 496 packages installed; worktree remained clean.
• bun run typecheck — exit 0; no diagnostics (the command emits no item count).
• bun run test — exit 0; 785 pass, 0 fail, 3491 expectations across 51 files.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.

[andrei-hasna]

[REVIEW] GO — independent exact-head release review for bc04e21f2b807565f3e0226109f619e6f0e1bcf1.

Acceptance passed:

• package.json is exactly @hasna/repos@0.1.41; registry latest is 0.1.40, and 0.1.41 is not yet published.
• The complete PR diff contains only CHANGELOG.md and package.json. The changelog accurately describes merged fix 07624e165675fff1937ab9ae047afe1c3c66b872 and adds no unrelated release content.
• Root/dashboard lock metadata is unchanged; release-health drift reports package and lock name @hasna/repos with zero issues.
• Built-state npm dry-run identifies @hasna/repos@0.1.41, includes all bin targets and dist/release-provenance.json, and exits 0.
• Exact-head CI completed successfully for install, typecheck, test, and build; built-state release health reports status: ok, issues: 0, ready: true.
• Published 0.1.40 provenance records commit a2b28d7781a7a363fa52e25e5b79a8cfded41c38, which is an ancestor of current main. No reachable in-scope P0/P1 publish/install, provenance, secret, or rollback defect was found.

Raw key lines:

• "0.1.40"
• npm error 404 No match found for version 0.1.41
• name=@hasna/repos version=0.1.41 filename=hasna-repos-0.1.41.tgz files=107 size=712310
• lock-metadata-diff=clean
• "status": "ok"
• "issues": 0
• "ready": true
• head=bc04e21f2b807565f3e0226109f619e6f0e1bcf1 status=completed conclusion=success
• Install dependencies=success
• Typecheck=success
• Test=success
• Build=success

Final PR state observed before posting: bc04e21f2b807565f3e0226109f619e6f0e1bcf1 MERGED. This reviewer did not merge or publish.