fix: merge latest dev updates into main

[nadav-node9]

Auto-generated PR

Merge latest dev changes into main to trigger a release.

⚠️ Important: When you click Squash and Merge, ensure the commit message starts with:

• fix: to publish a Patch release (0.0.X)
• feat: to publish a Minor release (0.X.0)
  If it starts with chore:, no NPM package will be published!

[github-actions]

🤖 Claude Code Review

Review

.github/workflows/release.yml — Homebrew tap notification

Security concern: The VERSION is extracted via node -p "require('./package.json').version" and interpolated directly into a JSON string with shell variable expansion ("${VERSION}"). If package.json ever contains a malformed or adversarially crafted version string, this could break the JSON payload or, in a worst case, enable injection. Use jq or pipe through a JSON encoder rather than bare shell interpolation. A simpler fix: use jq -n --arg v "$VERSION" '{event_type:"new-release",client_payload:{version:$v}}'.

Minor: The AUTO_PR_TOKEN is reused for both semantic-release and the homebrew dispatch. If the homebrew tap lives in a different org or requires different scopes, this could silently fail (the -s curl flag suppresses output). Consider adding --fail to the curl call so a bad response fails the step visibly rather than silently.

---

README.md

Bug: The image src has been changed to "an" — this is clearly a broken/accidental edit and will render a broken image in the README. Must be reverted.

---

src/cli.ts — undo --all flag

Correctness: getSnapshotHistory() is called once and stored as allHistory, with history filtered from it. This is correct and avoids a double call — good.

Edge case: parseInt(options.steps, 10) || 1 will silently treat --steps 0 as 1, which is reasonable, but --steps -5 gets clamped by Math.max(1, ...). That's fine, but worth a comment so future maintainers don't wonder why negative values are accepted without error.

Type safety: options.all is typed as boolean | undefined, which is correct for an optional flag. The options.all ? ternary handles undefined as falsy — no issue.

UX/security: The hint message leaks the count of other projects' snapshot directories implicitly (by checking allHistory.length > 0). In a multi-user or shared environment this is low risk, but worth noting since this is a security tool — snapshot metadata could reveal project paths.

No concerns with the logic path itself; the filtering is straightforward and the messaging improvement is genuinely useful.

---

Summary

Two issues require action before merge:

1. Broken image src ("an") in README — likely an accidental edit, must be fixed.
2. Shell injection risk in the curl JSON payload — use jq for safe serialization.

The undo --all CLI change is clean. No functional issues found in the core security path (no changes to core.ts, daemon/index.ts, or native.ts).

---

Automated review by Claude Sonnet

[github-actions]

🤖 Claude Code Review

Review

CI/CD — Homebrew notification step

Security concern (medium): AUTO_PR_TOKEN is being reused for both semantic-release (which likely needs write access to this repo) and dispatching to the Homebrew tap repo. If the tap dispatch only needs repo:dispatch scope on node9-ai/homebrew-node9, this is over-privileged. Consider a separate narrowly-scoped token for the tap notification.

Correctness: The VERSION extraction runs after npx semantic-release, but semantic-release may bump package.json on disk during the run — this should be fine. However, if semantic-release fails or produces no release (e.g. no releasable commits), this step still fires and will dispatch with whatever the current version is. The step should be conditional on a release actually occurring:

if: steps.release.outputs.new_release_published == 'true'

Without this, spurious dispatches to the Homebrew tap will occur on every CI run against the release branch.

Minor: --fail on curl is good practice. No issues there.

---

CLI — undo --all flag

Correctness: The cwd comparison uses s.cwd === process.cwd() — this is a strict string equality check. On macOS, symlinks or path normalization differences (e.g. /private/tmp vs /tmp) could cause snapshots to be silently excluded even without --all. Consider normalizing both paths with path.resolve() before comparing.

Edge case: parseInt(options.steps, 10) || 1 — if a user passes --steps 0, parseInt returns 0, falsy, so it becomes 1. Then Math.max(1, 1) gives 1. The Math.max guard makes the || 1 redundant but they're at least consistent. Low risk, but worth a comment.

Type safety: options.all typed as boolean | undefined is correct for Commander's optional flag. No issues.

UX correctness: The improved empty-state message is a genuine improvement — no issues.

---

README

No functional issues. The Homebrew install path is now the recommended one, which is fine once the tap is published and stable.

---

Summary

Two actionable items:

1. Guard the Homebrew dispatch step on new_release_published == 'true'
2. Use a separate, scoped token for the tap dispatch, or at minimum document why the shared token is acceptable
3. Normalize cwd paths in the undo filter to avoid symlink-related mismatches

The core proxy logic (core.ts, daemon/index.ts, native.ts) is untouched — no concerns there.

---

Automated review by Claude Sonnet

[github-actions]

🤖 Claude Code Review

Review

CI/Workflow (release.yml)

Security concern: AUTO_PR_TOKEN is reused for both semantic-release (needs repo write access) and the Homebrew dispatch call. If the Homebrew tap repo is compromised or the dispatch endpoint is abused, the token's broader permissions are exposed. Consider a scoped, separate token (HOMEBREW_DISPATCH_TOKEN) with only repo dispatch rights on the tap repo.

Minor: The curl step has no timeout flag (--max-time). A hung GitHub API call will block the release job indefinitely. Add --max-time 30.

Version extraction: node -p "require('./package.json').version" runs after npx semantic-release, which is correct — semantic-release has already bumped package.json by this point. No issue here.

---

src/cli.ts (undo --all)

Correctness — cwd field assumption: The filter s.cwd === process.cwd() assumes every snapshot object has a cwd property. If getSnapshotHistory() returns snapshots created before this field was added (e.g., older snapshot files on disk), s.cwd will be undefined, and those snapshots will be silently excluded from the default (non---all) view without any indication. This could confuse users who have valid snapshots but see the "no snapshots found" message. At minimum, document the migration behavior or fall back to including snapshots with no cwd.

Type safety: The s.cwd field should be reflected in the snapshot type definition. If cwd is not in the type, this compiles only because of implicit any or an overly loose type — worth checking that noImplicitAny / strict are enforced and the type is updated.

Edge case: process.cwd() can vary based on how the CLI is invoked (symlinks, shell cd behavior). path.resolve(process.cwd()) would be safer for comparison.

---

README (README.md)

No issues. The Homebrew install instructions and related-projects section are straightforward documentation changes.

---

What's missing / test gaps

• No test coverage for the --all flag path or the new "snapshots exist in other dirs" hint message.
• No test for the s.cwd === undefined (legacy snapshot) case.

---

Summary

The CI token scoping is the most important issue to address before merging. The cwd undefined fallback in the undo command is a real correctness bug affecting users upgrading from older versions. Everything else is minor.

---

Automated review by Claude Sonnet

[nadav-node9]

🎉 This PR is included in version 1.0.12 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀