sverka-dev/sverka

0.2.48 (2026-10-22)

🩹 Fixes

• website: make the typecheck standalone on a clean checkout (#418)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.47 (2026-10-22)

🚀 Features

• arena: keepWorkspace — keep the run workspace and report its path (#417)

🩹 Fixes

• website: make the typecheck runnable standalone (#414)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.46 (2026-10-22)

🩹 Fixes

• repo-health: reconcile the code-scanning tools with the Security banner (#411)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.45 (2026-10-22)

🩹 Fixes

• test: disable vitest fsModuleCache — shared .vitest-cache races under parallel nx targets (#412)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.44 (2026-10-22)

🚀 Features

• arena: migrate @agentclientprotocol/sdk to 2.x (#408)

🩹 Fixes

• release: give the tarball probe ten minutes, not three (#405)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• omp
• Petr Plenkov @ThePlenkov

0.2.43 (2026-10-22)

🩹 Fixes

• arena: a cell's runId comes from its content, so a retry is idempotent (#404)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.42 (2026-10-22)

🩹 Fixes

• release: give the tarball probe the time the registry needs (#399)
• release: the lockfile refresh needs bun 1.4.3, not 1.4.0 (#401)
• repo-health: the main-green check must work outside Actions (#400)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.41 (2026-10-22)

🩹 Fixes

• arena: the index update is a compare-and-swap, not a last-writer-wins write (#398)
• release: refresh bun.lock with the released versions (#397)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.40 (2026-10-22)

🩹 Fixes

• compiler: emit actions/checkout v7 in the generated workflows (#395)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.39 (2026-10-22)

🩹 Fixes

• arena: percent-encode plugin names in every combo label (#394)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.38 (2026-10-22)

🩹 Fixes

• arena: preflight the traces and the result path before writing (#393)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.37 (2026-10-21)

🩹 Fixes

• repo-health: the doctor covers the whole Security page (#392)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.36 (2026-10-21)

🩹 Fixes

• release: retry the publish and verify the tarball is fetchable (#390)
• workflow: make the placeholder substitution linear (#391)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.35 (2026-10-21)

🩹 Fixes

• repo-health: the doctor now sees the analysis tools (#389)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.34 (2026-10-21)

🩹 Fixes

• workflow: give the workflow tests a 30s timeout (#388)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.33 (2026-10-21)

🩹 Fixes

• cli: make the hub package an optional dependency (#387)
• release: publish only the packages nx release versions (#386)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.32 (2026-10-21)

🩹 Fixes

• cli: anchor the file-access suppression to the tainted argument (#385)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.31 (2026-10-21)

🩹 Fixes

• security: acknowledge the two open code-scanning alerts (#379)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.30 (2026-10-21)

🩹 Fixes

• arena: disable git credential prompts, redact creds in URLs (#378)
• repo-health: judge the latest check-run per check name, not every run (#381)

❤️ Thank You

• omp
• Petr Plenkov @ThePlenkov

0.2.29 (2026-10-21)

🩹 Fixes

• ci: exclude own check suite in repo-health main-green gate (#358)
• ci: unblock the format gate and give process-driven tests headroom (#377)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• omp
• Petr Plenkov @ThePlenkov

0.2.28 (2026-10-10)

🩹 Fixes

• playground: scanner operand-tracking for regex-vs-division edges (#343)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.27 (2026-10-10)

🩹 Fixes

• bro: spawn devin workers non-interactive (#357)
• playground: fail fast on malformed nested step calls in toSverkaConfig (#328)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.26 (2026-10-10)

🚀 Features

• arena: results registry + leaderboard + task packs (spec 56) (#329)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.25 (2026-10-10)

🚀 Features

• hub: remote run hub — shared cache, run history, dashboard (spec 55) (#342)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.24 (2026-10-09)

🚀 Features

• gitlab: agentic workflows — triggers, safe-apply, agent drivers (spec 54) (#336)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.23 (2026-10-09)

🚀 Features

• runtime: hosted-engine worker contract + bootstrap-job docs (spec 57) (#355)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.22 (2026-10-08)

🩹 Fixes

• playground: drop contextual keywords from NON_OPERAND_WORDS (#349)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.21 (2026-10-08)

🚀 Features

• website: docs 'Run' affordance via playground embed (spec 53.4) (#340)

🩹 Fixes

• playground: ignore run results after dispose() (#348)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.20 (2026-10-08)

🚀 Features

• playground: share-link size bounds on decode (spec 53.3) (#339)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.19 (2026-10-08)

🚀 Features

• cli: sverka.run/v1 tag on --format json + field-set snapshot pin (spec 53.1) (#338)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.18 (2026-10-08)

🩹 Fixes

• reporter: scope findings collection by run identity, not mtime (#335)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.17 (2026-10-08)

🩹 Fixes

• playground: bound template nesting depth in scanner (#327)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.16 (2026-10-07)

🚀 Features

• cli: zero-config sverka run + --report flag (spec 53) (#326)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.15 (2026-10-07)

🚀 Features

• cli: sverka view opens latest run report (spec 53) (#325)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.14 (2026-10-07)

🚀 Features

• playground: examples gallery + ShellStep demo stub (spec 53.6) (#322)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.13 (2026-10-07)

🚀 Features

• playground: toSverkaConfig transpile (spec 53.5) (#321)
• run: per-run report artifacts + report tail (spec 53.1) (#317)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.12 (2026-10-07)

🚀 Features

• playground: mountRunner embed API (spec 53.4) (#320)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.11 (2026-10-07)

🚀 Features

• playground: share links via #c= fragment (spec 53.3) (#318)
• run: sverka run --watch (spec 53.2) (#324)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.10 (2026-10-06)

🩹 Fixes

• resolve @sverka/* from src to kill the dist/ read race (#314)
• compiler: fail or inline env/secrets refs in job-level if conditions (#313)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.9 (2026-10-06)

🚀 Features

• compiler: scope runtime.env/secrets to GH step env, not job env (#312)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.8 (2026-10-06)

🩹 Fixes

• sonar: move NOSONAR markers onto the flagged callee lines (#311)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.7 (2026-10-06)

🩹 Fixes

• compiler: secret inputs out of dispatch inputs + pipeline bootstrap opt-out (#304)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.6 (2026-10-06)

🩹 Fixes

• runtime,reporter: mask secrets in captured output; keep truncation marker (#302)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.5 (2026-10-06)

🩹 Fixes

• workflow: structural kind markers for dual-package installs (#301)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.4 (2026-10-06)

🚀 Features

• reporter: ANSI colors + captured step output in text renderer (#300)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.2.3 (2026-10-04)

🚀 Features

• cli: text output is the default for sverka run (#299)
• repo-health: report non-Actions check failures on main (#298)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.2 (2026-10-04)

🩹 Fixes

• include create-sverka in nx release projects (#297)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.1 (2026-10-04)

🚀 Features

• add create-sverka scaffold shim (#296)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.2.0 (2026-10-04)

🚀 Features

• ci: repo-health pipeline — gh-based GitHub project checks (#293)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.35 (2026-10-03)

🚀 Features

• arena: opt-in unshareNet network isolation for checks (#291)

🩹 Fixes

• website: scrub host paths and ANSI-split leaks from benchmark artifacts (#290)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.34 (2026-10-03)

🚀 Features

• arena: bwrap sandbox for task checks (#289)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.1.33 (2026-10-03)

🩹 Fixes

• storage: harden snapshot validation, permissions, and tmp cleanup (#287)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.32 (2026-10-02)

🩹 Fixes

• reporter,arena: split drawer log panels; scrub check env (#288)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.31 (2026-10-02)

🩹 Fixes

• arena: redirect HOME so host user skills don't leak into benchmark cells (#286)
• website: case detail renders for trace-only cases (#285)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.30 (2026-10-02)

🩹 Fixes

• website: benchmark pages work on static hosting (#284)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.29 (2026-10-02)

🩹 Fixes

• deps: scope brace-expansion override per consumer line (#282)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.28 (2026-10-02)

🚀 Features

• arena: aggregate report — whole run matrix as one sverka report (#276)
• website: migrate site to sverka.dev on Cloudflare Workers — fixes docs navigation (#272)

🩹 Fixes

• website: emit root index.html — sverka.dev / was 404 (#273)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.27 (2026-09-30)

🚀 Features

• report: unified step inspector — findings+logs, layout-aware docking (#269)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.26 (2026-09-30)

🚀 Features

• report: step-details drawer with logs on any-view click (#267)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.25 (2026-09-30)

🚀 Features

• report: show failed-step reason in findings table (#266)
• website: minimal /pipeline-reports/ index page (#263)

🩹 Fixes

• ci: ignore generated website/content in format:check (#265)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.24 (2026-09-30)

🚀 Features

• reporter: DAG polish — LR/TB toggle, minimap, edge hover highlight (#262)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.23 (2026-09-30)

🚀 Features

• arena: real per-step timings in agent traces (#261)
• website: bake fumadocs search index as a static asset (#259)

🩹 Fixes

• website: drop docs:arena from build — arena results are committed snapshots (#258)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.22 (2026-09-29)

🚀 Features

• website: rebuild site on TanStack Start + fumadocs (#257)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.21 (2026-09-29)

🚀 Features

• arena: render agent traces as sverka reports (dogfooding) (#256)
• website: /arena/ results page (#254)
• website: wire the arena workbench into the deployed site (#255)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.20 (2026-09-29)

🚀 Features

• cli: compile --output-dir for multi-pipeline projects (#250)

❤️ Thank You

• Petr Plenkov @ThePlenkov
• ThePlenkov

0.1.19 (2026-09-29)

🚀 Features

• reporter: ReactFlow-style DAG — dots grid, card nodes, curved edges (#252)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.18 (2026-09-29)

🚀 Features

• reporter: zoomable, padded DAG viewport (#251)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.17 (2026-09-29)

🚀 Features

• reporter: click a step in any view to filter its findings (#248)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.16 (2026-09-29)

🚀 Features

• reporter: dagre layout for DAG view + strip ci/ namespace (#244)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.15 (2026-09-29)

🚀 Features

• reporter: CI-grade HTML report — context, Gantt/DAG/Tree views (#243)
• website: surface pipeline status in header, hero, sidebar top (#231)

🩹 Fixes

• ci: checkout submodules in deploy-website workflow (#230)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.14 (2026-09-28)

🚀 Features

• ci: supply-chain quality gates + dogfood self-run (#228)
• website: live pipeline status page with real sverka runs (#227)
• website: full HTML run reports on /pipeline/ (#229)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov
• ThePlenkov

0.1.13 (2026-09-28)

🚀 Features

• arena: verification-suite dogfood fixture + task setup hook (#226)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.12 (2026-09-28)

🩹 Fixes

• arena: read llmCallCount from the session DB (#224)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.1.11 (2026-09-28)

🩹 Fixes

• arena: isolate agent env so plugin-off cells are truly off (#223)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.1.10 (2026-09-28)

🚀 Features

• arena: dogfood config + user docs for sverka-arena (#219)

🩹 Fixes

• arena: anchor fixture paths to the config file's directory (#220)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.9 (2026-09-23)

🚀 Features

• arena: sverka-arena CLI — run, report, doctor (#218)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.8 (2026-09-23)

🩹 Fixes

• replace backtracking step-ref regex with linear pattern (#216)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov
• ThePlenkov

0.1.7 (2026-09-23)

🩹 Fixes

• cli: generated workflows set persist-credentials: false (#214)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.6 (2026-09-23)

🚀 Features

• workflow: make Pipeline's Project scope optional (#212)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov

0.1.5 (2026-09-23)

🩹 Fixes

• arena: drop published bin until the CLI is implemented (#211)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.1.4 (2026-09-22)

🩹 Fixes

• cli: use module.registerHooks when available (#207)

❤️ Thank You

• Petr Plenkov @ThePlenkov

0.1.3 (2026-09-22)

🚀 Features

• policy gate step + artifact import ordering fix (#200)

❤️ Thank You

• Petr Plenkov @ThePlenkov
• ThePlenkov

0.1.2 (2026-09-21)

🚀 Features

• compiler: inject toolchain setup into generated GitHub workflows (#196)

🩹 Fixes

• cli: report own package version for --version and MCP server (#198)
• release: prefix publish dir with ./ to avoid git shorthand (#194)

❤️ Thank You

• Petr Plenkov @ThePlenkov
• ThePlenkov

0.1.1 (2026-09-21)

🚀 Features

• Wave 0 — spec tree, monorepo scaffold, Gas City, website (5e03d63)
• Wave 1 — core package (7827892)
• Wave 2 — IR package (canonical plan schema and validation) (cdee22f)
• Wave 1 — core package (ac44528)
• Wave 2 — IR package (canonical plan schema and validation) (6394033)
• Wave 3 — runtime package (executor interfaces and scheduler) (13a3d29)
• Wave 4 — runtime-host package (host process executor) (7c7c9f9)
• Wave 5 — runtime-docker package (Docker executor) (5038d7a)
• Wave 6 — planner package (discovery and plan synthesis) (df244f8)
• Wave 7 — findings package (normalization, fingerprints, baseline) (86ad86c)
• Wave 8 — policy package (policy evaluation) (2f89767)
• Wave 9 — sdk package (public TypeScript API) (5da05e5)
• Wave 10 — cli package (command-line interface) (e6cf172)
• Wave 11 — checks package (check resolution and findings extraction) (8b5da33)
• Wave 12 — compiler-github package (Plan IR to GitHub Actions YAML) (2dc0c96)
• Wave 13 — compiler-gitlab package (Plan IR to GitLab CI YAML) (54d7784)
• Wave 14 — website (sverka.dev Astro site with sitemap, SEO, 404) (552f18f)
• recover content from closed PRs #20 and #22 (#20, #22)
• add pre-alpha disclaimers and Cloudflare Pages deploy workflow (77fb72f)
• PR stack resolution harness — formula, order, script (ed5bf7d)
• add mayor nudge logic to PR stack resolve script (39df5d7)
• port F-01 to F-16 core features from v0-n-docs to main (#62)
• port F-17 to F-25 runtime features from v0-n-docs to main (#63)
• port F-29 to F-49 advanced features from v0-n-docs to main (#75)
• gc-watchdog Devin plugin with self-healing (#78)
• port shell proxy API ($, shell) from v0-n-docs to main (#77)
• v1 Wave 1 — CacheStore, RetryPolicy, RunEvent, GHA SHA pinning (#122)
• v1 Wave 2 — MCP & AI Integration (#123)
• v1 Wave 2 — Sverka MCP server (#124)
• v1 Wave 3 — RunSnapshot storage + suspend/resume types (#126)
• v1 Wave 3 — Saga compensations (Spec 30, ADR-013) (#127)
• v1 Wave 4 — Interoperability Engines (#128)
• v1 Wave 5 — DX & Polish (#129)
• @sverka/arena — generic benchmark framework with CRUD dashboard (#150)
• @sverka/reporter — renderer core, text output, findings/policy gate (Phase 1) (#151)
• @sverka/sarif-viewer-tui — standalone Ink TUI for SARIF files (Wave 1, PR1) (#152)
• @sverka/sarif-viewer-web — standalone HTML report generator for SARIF (Wave 1, PR2) (#153)
• SARIF pipeline — serializeSarif + --format sarif/web + sverka view (#155)
• @sverka/ui — local web dashboard for SARIF findings + sverka ui command (#156)
• @sverka/playground — browser sandbox for building and running check pipelines (#158)
• run shell steps from project root + dogfood SARIF findings (#167)
• warn on unknown config props in sverka validate/run (#168)
• make repo installable as a Devin plugin (#185)
• dogfood sverka pipeline + bun audit fixes (#188)
• OIDC trusted publishing release pipeline (#190)
• cli: add sverka compile command for github/gitlab targets (#35)
• deploy: switch website deploy to GitHub Pages (c5b10b6)
• nx: onboard @nx-devkit plugins — typescript preset, skill tooling, release (#187)
• nx-cloud: setup nx cloud workspace (c61acaa)
• nx-cloud: setup nx cloud workspace (#58)
• website: migrate to Starlight docs site with engdocs and specs (3e5306f)

🩹 Fixes

• address CodeRabbit review threads (b92ba98)
• address code review findings in packages/ (76f1f83)
• add legacy eslint engine name to .codacy.yml disable_rules (1fcb720)
• add .eslintrc.json to disable es-x rules for Codacy ESLint 8 (0f7210f)
• use exclude_paths instead of invalid disable_rules in .codacy.yml (0ac1b58)
• runtime safety and condition handling in planner (e14bb06)
• make outcomes required, add RuntimeFinalization type, widen OperandValue (5a1305c)
• escape delimiters in matrix child IDs and reject duplicate values (ff14e45)
• resolve SonarCloud and Codacy complexity findings (a09ab0a)
• Add ESLint 9 flat config + fix per-package lint scripts (sv-ei2) (d0393a3)
• Core ID assignment — SHA-256 content-addressed IDs per ADR-006 (b2570e4)
• address Codacy review threads and typecheck after merge (3b8690a)
• address Qodo review findings and thread issues (c233d24)
• address CodeRabbit review threads (security, CI, planner, compilers) (1a119c4)
• address Amazon Q and Codacy review findings on PR #28 (#28)
• address CodeRabbit and Qodo iteration-2 findings on code files (e0e41ff)
• address CodeRabbit and Qodo doc review findings on PR #28 (#28)
• scope wisp/nudge filter to bead ID prefix in watchdog (7e165a2)
• configure Codacy and SonarCloud to exclude scripts/ utility directory (48eca56)
• address CodeRabbit iteration-3 findings on PR #28 (#28)
• address Codacy post-merge findings on PR #28 (#28)
• use urllib.parse for URI normalization, anchor Suspended grep (48186b5)
• literal grep for harness.mayor, handle file:/ URI scheme (0995018)
• address qodo post-merge findings on PR #28 (#28)
• rebrand from 'AI-first' to 'code-first TypeScript pipeline engine' (eb477d7)
• remove stale Nx Cloud org, ignore .worktrees from project graph (fdd46b6)
• restore green typecheck baseline (81 pre-existing errors → 0) (#116)
• MCP server typecheck errors (exactOptionalPropertyTypes + noUncheckedIndexedAccess) (#125)
• bump Bun to 1.4.0 in CI and deploy-website workflows (#140)
• audit fixes — stdout/stderr in JSON, findings pipeline, dead code removal (#166)
• e2e verify graph/plan/compile — declare @sverka/workflow at root, lower exportStdout for CI targets (#177)
• publish readiness — arena manifest, lockstep release (#189)
• 04-decorators: align decorators with spec, remove @output, add method-step support (8dec135)
• cdk-split: address coderabbitai review threads (0ea77ff)
• checks: sanitize output.path in extractFindings to prevent path traversal (9c3bc7c)
• checks: wrap readFile in try/catch and skip only ENOENT (cad0d00)
• checks: address v0-j-checks review threads (27853b9)
• checks,sdk: resolve Codacy findings on PR #25\n\n- extractFindings: use async readFile and extract path validation into\n resolveSafeOutputPath helper.\n- sverka.ts: pass context directly instead of conditional spread. (#25)
• checks,sdk: resolve wave-11 review threads (a75fe0e)
• ci: contents: write for nx fix-ci auto-apply (8b87c26)
• ci: pin all third-party actions to commit SHAs (fbea33c)
• ci: resolve SonarCloud findings + add dependabot (1fdcaaf)
• cli: propagate non-ENOENT unlink errors in baseline clear (#12)
• cli: address PR review — path resolution, outcomes serialization, version extraction (cf4998f)
• cli: address remaining review — TOCTOU init, test skip bug, type narrowing, function order (300bc50)
• cli: resolve absolute baseline paths and close TOCTOU in clear (5dfb9c4)
• cli: add 5s timeout to isBinaryAvailable spawnSync (c911d8f)
• cli: resolve Codacy complexity and line-count findings (9faa9a1)
• cli: add vitest aliases for runtime packages (bca9a41)
• cli: init config conflict check, workspace-aware dependency, entry validation, package.json error handling (dffa6fc)
• cli: prefer named project export over default in loadConfig (6c4f364)
• cli: avoid file-existence race in ensureConstructsDependency and isLocalWorkspace (09a2e21)
• cli: self-contained config loading and init --detect fixes (#179)
• cli: unify check/init --detect detection paths (#180)
• cli: actionable error when a @sverka/* dist is missing (#181)
• cli, runtime, sdk: resolve CodeRabbit review threads for wave-10-cli (3fe5312)
• cli,sdk: preserve all sdk re-exports by disabling tsdown tree-shaking (4d33da4)
• cli,ui,sarif-viewer-tui: e2e fixes for report/view surfaces (#178)
• codacy: replace broken disable_rules with engine exclude_paths (446def1)
• compiler-github: address PR #14 review — toKebab, idToken, setup-bun, execute cmd, interface order (#14)
• compiler-github: resolve CodeRabbit review threads for wave-12 (095dc11)
• compiler-gitlab: address PR #16 review — default image, execute cmd, empty rules (#16)
• compiler-gitlab: remove invalid regex flag in test (407ebbb)
• compiler-gitlab: align contract/docs with implementation\n\n- Default image is oven/bun:latest; document Bun requirement.\n- Remove stale positional .sverka/plan.json from docs and JSDoc.\n- Add type exports usage in public-api test.\n- Use a Bun-capable image in custom-config test. (28414d8)
• conformance: address review threads for v0-m-conformance (3ce3905)
• conformance: use pipelineV0 instead of compat pipeline from SDK (07edbe5)
• conformance: address coderabbitai review threads (e60fc3b)
• constructs,core: address PR #38 review threads (#38)
• core: remove JSON.stringify from canonical serialization and matrix/env encoding (bc9349d)
• core: align canonicalStringify with tests (Date, undefined, lone surrogates) and update runtime-modes expectations (fe92e6b)
• core: remove dead code in validateOutputCollisions, throw on missing artifact path (06ee98d)
• core: restore old API as compat layer for downstream packages (9c54133)
• core: condition dependency tests and docs lint; validate StepRef conditions (87a9b1c)
• core: correct pipeline output mapping in synthesize after rebase (bff0a0b)
• core,ir: align with main wave implementation to resolve SAST/review findings\n\nReplace the older core and ir source in the decouple branch with the\ncanonical versions from the main wave stack. This resolves SonarCloud/Codacy\ncomplexity and correctness findings and fixes the codeant/CodeRabbit\nthreads targeting the old core/ir code. (de87a63)
• core,ir: address CodeRabbit review findings (a9b7190)
• core,ir: address CodeRabbit review findings (000b6b8)
• core,runtime-docker: reduce Codacy complexity/line-count findings (11e2bad)
• decorators: allow number/boolean interpolation in planning methods (2cf7ca5)
• decorators: address SonarCloud reliability and code smell issues (a5f4d80)
• discover: resolve workspace globs to real dirs (#176)
• docs,agents,config: address CodeRabbit review threads on PR #19 (#19)
• engdocs: address review threads in v0 redesign foundation (b4e2825)
• engine-native: address review threads for v0-f-engine (38589a6)
• engine-native,runtimes: address PR #41 review threads (#41)
• findings: resolve SonarCloud quality gate findings (7e4cafa)
• findings: resolve Codacy quality gate findings (d858065)
• foundation: address PR #37 review threads (#37)
• github: reject unknown graph refs and preserve diagnostic messages (686f1c7)
• github: address SonarCloud reliability and code smell issues (097613f)
• github: revert replaceAll to replace with global flag for Codacy (4e79723)
• gitlab: address review threads for PR #49 (#49)
• gitlab: per-entry rules, import reachability, reserved keys, public API (96b7b9a)
• ir: address SonarCloud + codeant-ai review findings (b0956d5)
• ir: reduce cyclomatic complexity and mitigate ReDoS flag (de941e4)
• ir: replace regex validation with manual string parsing (78ee1d7)
• ir: reduce isValidMemoryString cyclomatic complexity below 10 (79176da)
• ir: address CodeRabbit review threads for PR #2 (#2)
• ir: reduce validateTopLevel cyclomatic complexity and pin typescript-eslint (e84641b)
• ir: address CodeRabbit review threads — ADR wording, markdown lint, validation order, ISO 8601 (39e8ebe)
• ir: complete dependsOn validation contract and align spec (cf29c59)
• ir: allow empty sourceContextHash for SDK manual plans (66aac7a)
• ir: add compat layer for old Plan API used by downstream packages (5e5a7d1)
• ir: address SonarCloud reliability and code smell issues (f676007)
• ir: fix ISO 8601 validation regression in compat/validate.ts (a0ba76d)
• ir: address coderabbitai review threads (a4a24b5)
• ir,core: address PR #39 review threads (#39)
• ir,runtime: resolve all SonarCloud SAST findings (c0e94a8)
• ir,runtime: resolve Codacy complexity and line-count findings (237731e)
• lock: restore @sverka/ir workspace dependency in bun.lock (23be76f)
• merge-stack: verify lower-branch content with trial 3-way merge (f2a4a90)
• merge-stack: fail closed on fetch, validate merge-tree OID, keep unverified PRs open (c93871c)
• merge-stack,watchdog: support SHA-256, source markers, grep -F (62d9481)
• merge-stack,watchdog: source-markers, case-insensitive bead regex, robust gc parsing, fetch once (4cefcc1)
• planner: resolve Codacy complexity and SonarCloud findings (c9b52b4)
• planner: resolve remaining SonarCloud test-assertion and PATH-hotspot findings (4fc3874)
• planner: revalidate resolved review threads (71fb3c0)
• planner: address review threads for v0-g-planner (d3ae989)
• planner: scope detection to root subtree for nested init --detect (#182)
• planner,core,ir: address v0-g-planner review threads (5b6a62e)
• plugin: clone nested CapabilityDetail, define connector diagnostic behavior (277bfea)
• plugin: reject arrays as capability manifests, document operation.import (08e00d3)
• policy: validate failOn rule shape before accessing severity (f80e05f)
• policy: reduce createPolicy cyclomatic complexity for Codacy (aae5437)
• policy,core,docs: resolve open CodeRabbit threads on #10 (#10)
• pr-stack-resolve: fix shell lint issues in stack resolve script (eeb34b9)
• pr-stack-resolve: fix shellcheck disable directive format (72dd255)
• release: repair actions/setup-node pin — sha didn't resolve (dd04ce2)
• release: drop --yes flag (#191)
• release: commit in version step, tag in changelog step (#192)
• release: pass version positionally to changelog (#193)
• review: address Codacy/Qodo feedback on watchdog, runbook, and tests (497fbf0)
• review: bind runbook head branch per PR and harden watchdog tests (15aeef3)
• review: harden deploy workflow and pre-alpha banner accessibility (ddb6c12)
• review: disable Bun cache and align banner text (5c8e31d)
• review: base-path root handling and 404 home link (b9f8b85)
• review: scope deployment permissions to the deploy job (37013d7)
• review: split build/deploy jobs and simplify base normalization (a13c727)
• runtime: address 6 codeant-ai review threads (720fb1e)
• runtime: restore old runtime packages as compat layer (b3342e2)
• runtime: export both old and new APIs from runtime-host and runtime-docker (b1bd02f)
• runtime-docker: extract validateRequest/runContainer/finalizeResult to reduce complexity (818a725)
• runtime-docker: address resolved review threads on socket policy, cache paths, and artifacts (f2e5bc8)
• runtime-docker, core, ir: address CodeRabbit review threads for wave-5 (474c118)
• runtime-host: extract validateRequest/finalizeResult to reduce complexity; pin devDeps (5908184)
• runtime-host: treat spawn failure as runtime error (c0e424f)
• sarif: normalize all URIs and reject boolean coordinates (af686af)
• sdk: resolve Codacy complexity and line-count findings (bbc8e14)
• sdk: extract resolveDefaults to reduce buildPlanOperation complexity (850e084)
• sdk: type buildPlanOperation return as PlanOperation for exactOptionalPropertyTypes (4d31305)
• sdk: address CodeRabbit review threads on PR #11 (#11)
• sdk: revalidate resolved review threads (bfbd3a4)
• sdk: reduce resolveDefaults cyclomatic complexity for Codacy (ac9c258)
• sdk: forward PATH to host executor (c47f227)
• sdk: address review findings for v0-c-sdk (cdbe6b8)
• sdk: address review findings for v0-c-sdk (source changes) (c80f2cc)
• sdk: remaining v0-c-sdk review threads (d3f2a05)
• sdk: add compat layer for old SDK API used by CLI (a1426aa)
• sdk: add runtime-host and runtime-docker to sdk deps (96ac85f)
• sdk: address coderabbitai review threads (d303dd5)
• sdk: make runtime imports lazy for waves that replace @sverka/runtime (31ff11a)
• sdk: make runtime imports lazy in root sverka.ts (8e441f3)
• sonar: scope workflow permissions to jobs (9dc60bd)
• watchdog: match wisp/nudge exclusions to complete bead IDs (e853eb1)
• watchdog: harden regex, use grep -m1, and add regression tests (826399f)
• wave-11-checks: resolve Qodo review threads on SDK auto-discovery and check resolver (9ee33e2)
• wave-9-sdk: provide explicit localeCompare compare function for sourceContextHash changedFiles sort (143e517)
• website: add @sverka/sdk to quick start install instructions (4c50bb3)
• website: address review feedback in sync-docs.ts (672262f)
• website: use relative links in splash page so BASE_PATH is respected (9572605)
• website: sync-docs refactor, per-page editUrl, runbooks, mermaid selector, deploy paths (dc70ff8)
• website: add sync-docs tests, warn on unresolved links, exclude tests from astro check (b0e303a)
• website: publish only user-facing docs, drop engineering/specs pages (c71781e)
• website: remove dead singleFiles loop to satisfy SonarCloud reliability gate (f9b9a59)
• website: run sync before asserting engineering/specs are absent in tests (844bccd)
• website: consistent sidebar labels and deduplicate page titles (7d5cee5)
• website: address SonarCloud reliability findings (ddbb2cf)
• website: address review threads for sidebar and frontmatter (13a13a3)
• website: harden sidebar generation and add order assertions (1d2a7b7)
• website: migrate Starlight sidebar to v0.39+ format, fix broken policy link (#113)
• website: switch deploy runner to ubuntu-latest (#114)
• website: remove concurrency group to unblock stuck deploy (#115)

🔥 Performance

• cli: lazy-import reporter and MCP SDK to cut startup ~60% (#183)

❤️ Thank You

• Devin @devin-ai-integration[bot]
• Devin AI @devin-ai-integration[bot]
• Petr Plenkov @ThePlenkov
• ThePlenkov @ThePlenkov