codetruss 0.2.51

[DeliriumPulse]

Points the formula at the v0.2.51 release archive.

url    https://github.com/CodeTruss/codetruss-cli/releases/download/v0.2.51/codetruss-cli-0.2.51.tgz
sha256 0dbd333a638376aa68e4a2f330c6d59cd0e852700104a7dd5444232a2278a862

That digest was measured off the downloaded release asset, not copied from the release notes. The asset cmps byte-identical to public/downloads/codetruss-cli-0.2.51.tgz in the monorepo, to the bytes codetruss.com serves, and to the archive rebuilt independently in the mirror from its own lockfile. gh attestation verify codetruss-cli-0.2.51.tgz --repo CodeTruss/codetruss-cli passes, and the release carries all three attestations: SLSA provenance v1, CycloneDX, and the in-toto release predicate — the last confirmed through the attestations API, since gh 2.85 cannot verify a predicate signed by GitHub's release identity under --repo.

The same cmp against 0.2.50 — the version this formula pointed at until now — exits 1, so the comparison is capable of failing. gh attestation verify was likewise checked against a tampered copy of the archive and against a wrong --repo; both exit 1, so its exit 0 above is not vacuous.

Nothing else changes. .github/workflows/test.yml derives the expected version from brew info rather than a literal, so it needs no edit; the version assertion in CI is what proves the installed binary matches the formula.

Why this bump matters more than the last few

0.2.50 and earlier are unusable on large real TypeScript repositories. Appending a single comment line to sindresorhus/ky returns FAILED, exit 2 — because our own bundled grammar cannot parse a unique symbol declaration in source/utils/merge.ts, and the receipt named no file. Reproduced identically on honojs/hono and colinhacks/zod; on zod the analyzer never finished at all, spending minutes at full CPU on catastrophic backtracking in our own literal-stripping regex, reachable from a commented-out line in any user's file. Because codetruss setup installs a pre-commit hook, an affected user also had every commit blocked.

0.2.51 reclassifies "we could not read this file" as REVIEW_REQUIRED (exit 1, which the hook allows) rather than FAILED, names the file it could not read, and makes the regex alternatives disjoint. Verified against the published 0.2.51 archive on a fresh ky clone: the same one-line comment change now returns REVIEW_REQUIRED, exit 1, naming source/utils/merge.ts — while a synthetic committed credential in the same tree still returns exit 2, so real failures remain reachable.

🤖 Generated with Claude Code