This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+2 more
Affected surfaces
Summary
AI summaryRemoved many CLI commands and bumped to a major version.
Full changelog
Major Changes
-
e9efbd7: Trim aware CLI surface to the 3 core commands.
The wrapper's MCP only exposes
aware_sync; the other commands were
CLI-only conveniences for editing.aware.json, toggling fragments,
or diagnosing setup. Per the complexity audit most had no test
coverage and overlapped with the 3 core commands.Removed commands:
watch(IDE/editor file watchers already do this)validate(overlaps with config load + startup checks)doctor(duplicatesdiff --check)add/remove(users edit .aware.json directly)fragments list|disable|enable(fragment registry is internal)plugin add|remove|list(plugins[] declared in .aware.json directly)install-hooks(3-line bash snippet is simpler)sync --refresh-conventionsflag (Phase-3 upgrade path, no current callers)
Kept:
init,sync,diff. The library API (detector registry,
fragment resolver, generator base classes, monorepo scanner, plugin
loader, conventions extractor) is untouched — those are internal to
sync/diff today and removing them is a larger refactor than this cut
scopes.Major version bump.
Patch Changes
-
4360845: Post-trim cleanup: sync READMEs with the actual command surface, drop a dead
chokidardep, and fix stale's summarypassedcount.- READMEs rewritten for the 5 trimmed tools so they match what the CLI actually ships. Removed references to commands and flags that no longer exist (
vow fix|hook|audit|diff|policy,vow --offline|--api-key|ANTHROPIC_API_KEY;stale fix|watch,stale --deep,STALE_AI_KEY, SARIF format;aware watch|validate|doctor|add,--exit-code;envalid onboard|hook|export|watch|fix|migrate, plugins, secret providers, framework adapters). Documented the flags each command actually accepts today (e.g.aware diff --check|--json|--target|--quiet,vow check --ignore). - aware: removed unused
chokidardependency (carried over from the droppedaware watchcommand —grep chokidar src/had zero hits). - stale: fixed
summary.passedgoing negative on reports with many issues.buildSummarywas computingtotalChecks - errors - warnings - infos, wheretotalCheckswas per (doc × analyzer) but issues are per finding, so a heavy report trivially overflowed it.totalChecksnow counts analyzers run, andpassedcounts analyzers whose category produced zero issues. Per-categorypassedis now1when that analyzer ran and produced no issues,0otherwise. Test fixture + snapshot updated for the post-trim DriftCategory set. - vow: deleted
docs/workflows/— the three example workflow YAMLs and their README referencedvow check --offline,vow diff,vow policy compile,ANTHROPIC_API_KEY, and the archivedwhenlabs-org/vow@v1composite action, none of which exist anymore.
- READMEs rewritten for the 5 trimmed tools so they match what the CLI actually ships. Removed references to commands and flags that no longer exist (
Breaking Changes
- Removed CLI commands: watch, validate, doctor, add, remove, fragments list|disable|enable, plugin add|remove|list, install-hooks, and the --refresh-conventions flag.
- Bumped major version (e.g., from v1.x to v2.0) requiring migration.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About WhenLabs-org/when
Developer toolkit: auto-detect stack for AI context files, catch port conflicts, validate .env schemas, spot docs drift, audit dependency licenses, and time coding tasks — 7 MCP tools, one install.
Related context
Related tools
Beta — feedback welcome: [email protected]