v0.10.4

Patch Changes

• #61 3ec8134 - overlock replay now refuses a manifest entry that climbs out of the corpus on Windows too. The check looked for ../, and on Windows path.relative answers ..\, so an entry such as ../outside.diff was read from outside the corpus instead of being refused.

v0.10.3

Patch Changes

• #56 7c10002 - Stop reporting a quote-style reformat as changed or weakened assertions. 'high' and "high" now compare as the same value, so a formatter switching quote style no longer produces EXPECTED_VALUE_CHANGED, and an assertion whose only change is its quotes is no longer read as removed and paired with its neighbour as ASSERTION_WEAKENED or ASSERTION_NARROWED. A value that changed along with its quotes is still reported, as written.

• #51 d8962c1 - Take the object checks and the thrown-value message from @rxova/ts-utils, inlined at build time, so the package still has no runtime dependencies. An error from another realm now prints its message, and a thrown value that cannot be turned into a string no longer escapes the error handler.

• #55 de9c4cf - Build with the shared rxova toolchain. The JavaScript in the package is unchanged. The sources are reformatted with double quotes, so the type declarations spell their string literal types with double quotes (the types are the same), the embedded source maps change, and so does the build fingerprint written into run and evaluation records. The README's code examples now use double quotes too.

v0.10.2

Patch Changes

• #40 a60395c Thanks @jonatankruszewski! - Drop export from nine symbols that nothing imported. The published API is unchanged — none of them was re-exported from src/index.ts — but the built output no longer carries them.

v0.10.1

Patch Changes

• #36 a2b2167 Thanks @jonatankruszewski! - Build with tsdown instead of tsup. The published output is unchanged in shape — ESM-only, same dist/index.js, dist/cli.js and type declarations — but rolldown shares code between the two entries rather than duplicating it, so the tarball is smaller.

v0.10.0

Minor Changes

• #34 0c52246 Thanks @jonatankruszewski! - Add --stage-record, so the commit being built carries the record of the run that judged it.

  An evaluation record is written after the analysis that produced it, so on its own it can only ever
  reach the next commit: the evidence for a change trails one commit behind the change, and a
  repository collecting records never has a clean working tree. From a pre-commit hook, where the
  commit is still being assembled, overlock check --staged --stage-record stages the record and
  captured patch that run just wrote, and nothing else.

  It is a flag rather than a config key because the only run with a commit to join is the one a
  pre-commit hook makes. Staging is the one write overlock makes; every other invocation still leaves
  the index exactly as it found it, and a repository that has ignored .overlock keeps that decision
  — the evidence stays on disk and the refusal is reported on stderr.

v0.9.2

Patch Changes

• #31 57da3ea Thanks @jonatankruszewski! - Stop the Claude Code hook raising the same self-suppression twice. A directive
  the patch wrote about itself stops the hook once and quotes the claim back — but
  "once" was decided from stop_hook_active alone, which the agent sets only on
  the Stop that directly follows a blocked one. Every later turn arrived with the
  flag false, found the same directive still new against the same base, and
  stopped again, for the life of the branch.

  The hook now records what it quoted — rule, file, the path it names and a hash
  of the reason — in ~/.overlock/announced.jsonl, scoped to the repository and
  branch, and skips the stop when every claim in the patch has already been put to
  a person. Changing a reason or adding another directive is a new claim and still
  stops once. OVERLOCK_ANNOUNCED sets the file's path; OVERLOCK_HOME moves it
  with the ledger. Findings nobody silenced are untouched: those still stop every
  turn until they are fixed.

  Run records tell the two apart: a turn let through this way is already_announced
  rather than retry_bypass.

v0.9.1

Patch Changes

• #26 e9f13e6 Thanks @jonatankruszewski! - Crafted input no longer stalls a run. Four parsers backtracked quadratically on text the patch author controls: an Overlock-Allow: trailer with a long run of spaces in its reason, a diff --git header made of many quoted segments, a line holding a string literal of escaped quotes that never closes ("\"\"\"…), and an exclude entry with a long run of slashes. Each now reads in linear time, and every result is the same as before.

v0.9.0

Minor Changes

• #24 d9858e3 Thanks @jonatankruszewski! - Add an exclude setting: repository-root-relative paths left out of the patch the way .overlock already is, so another tool's evidence directory (.basting, .saidso) no longer changes the patch fingerprint on every turn, grows captured diffs recursively, or makes auto read the working tree. Excluded paths are absent from findings, file counts, base selection and snapshots, and the evaluation record carries the setting. Entries are literal prefixes; globs, pathspec magic, .. and filesystem paths are refused.

v0.8.0

Minor Changes

• #20 5e91d3b Thanks @jonatankruszewski! - Add opt-in repository evaluation records with portable sessions, exact patch fingerprints and snapshots, final hook decisions, and evidence before suppression. Exclude .overlock records from patch acquisition and scope. Add artifact import, independent outcome reviews, deduplicated evaluation reports, and corpus replay with separate detection and blocking oracles. Stop interpreting repeated legacy ledger detections as verified catches; the deprecated meetsBar now always returns false.

v0.7.1

Patch Changes

• #18 c7f6942 Thanks @jonatankruszewski! - SUITE_SCOPE_NARROWED no longer fires on a config file the patch creates.

  Read line by line, an added file is all gains and no losses — which is exactly
  the shape of an exclude list that grew. Every new package that arrived with a
  vitest.config.ts therefore read as a narrowed suite, at high, and blocked
  the merge.

  The trade: a config file that is born narrow is no longer reported. There is
  no prior set to compare it against, so the alternative is firing on every new
  package, and a gate that does that is one people switch off. A file that already
  existed still fires, including when it gains an exclude key it never had.