chore(release): prepare v0.4.2

[kunaldhongade]

Release

Prepare CodeDecay v0.4.2 for publication.

Included production fixes

• GitHub Action input hardening from fix(github-action): harden action input handling #767.
• Correct Judge Lab CI snippet: SubmuxHQ/CodeDecay/packages/github-action@v0.
• Bump CLI and engine version to 0.4.2.
• Regenerate versioned Judge Lab evidence and update rendered/browser release assertions.

Release-candidate validation

• pnpm test — 903 tests across 169 files
• pnpm docs:build
• pnpm build:packages
• pnpm --filter @submuxhq/codedecay pack --dry-run
• pnpm test:child-repo-e2e -- --run-id v0.4.2-release-candidate
• Judge Lab: API/build tests, browser acceptance (10/10), and high-severity dependency audit

Closes #768

[github-actions]

CodeDecay PR Check

Lead catch: Config area changed — packages/cli/package.json:3

packages/cli/package.json touches a config area and should be reviewed for regression impact.

Risk: Low · Merge 30/100 · Decay 28/100 · Security 0/100

Full CodeDecay report

CodeDecay Report

Overall risk: Low

Score	Value
Merge risk	30/100
Decay risk	28/100
Security risk	0/100

Findings	Count
High	7
Medium	3
Low	5

Changed Files

• judge-lab/app/judge-lab.tsx modified (+3/-3)
• judge-lab/public/evidence/weak-test-report.json modified (+1/-1)
• judge-lab/tests/judge-lab.spec.ts modified (+1/-1)
• judge-lab/tests/rendered-html.test.mjs modified (+4/-4)
• packages/cli/package.json modified (+1/-1)
• packages/core/src/version.ts modified (+1/-1)

Likely Impacted Areas

• Medium UI route (ui): judge-lab/app/judge-lab.tsx
• Low Package metadata (config): packages/cli/package.json
• Low Source code (source): packages/core/src/version.ts
• Low Tests (test): judge-lab/tests/judge-lab.spec.ts, judge-lab/tests/rendered-html.test.mjs

Normalized Impact Graph

Graph artifact: .codedecay/local/impact-graph.json (4968 node(s), 10028 edge(s))

• Confidence: Direct: 10028, inferred: 0, heuristic: 0
• codedecay-js-babel-symbols via @babel/parser (available, adapter 1.0.0)
  • Limitation: Call expressions are not connected to target symbols in this adapter version.
  • Limitation: Only JavaScript and TypeScript files parsed by @babel/parser are represented.
  • Limitation: Static import resolution does not resolve runtime dependency injection or dynamic imports.
• codedecay-python-lezer via @lezer/python (available, adapter 1.0.0)
  • Limitation: Dynamic imports, dependency injection, decorators without literal routes, and framework route registries are not resolved.
  • Limitation: Python impact evidence uses the @lezer/python grammar and conservative module-to-file resolution.
  • Limitation: Static test imports do not prove execution or assertion quality.
• Graph limitation: A static test import does not prove the symbol executed or that assertions cover its behavior.

Symbol Impact Evidence

Graph artifact: .codedecay/local/symbol-impact-graph.json (1030 file(s), 6174 edge(s))

• judge-lab/app/judge-lab.tsx#JudgeLab -> judge-lab/app/page.tsx
• packages/core/src/version.ts#CODEDECAY_VERSION -> judge-lab/app/api/health/route.ts, judge-lab/app/page.tsx, judge-lab/lib/engine.ts, judge-lab/lib/source.ts, packages/agent/src/preflight/report.ts, packages/agent/src/session/lifecycle.ts, packages/cli/src/commands/dashboard/report.ts, packages/cli/src/commands/differential/report.ts, packages/cli/src/commands/execute/report.ts, packages/cli/src/commands/llm-review.ts, packages/cli/src/commands/maintenance.ts, packages/cli/src/memory/setup.ts, packages/cli/src/product/runtime.ts, packages/cli/src/renderers/memory.ts, packages/cli/src/renderers/snapshot.ts, packages/core/src/index.ts, packages/core/src/report.ts, packages/core/src/revalidate/index.ts, packages/core/test/version.test.ts, packages/mcp/src/execution/report.ts, packages/mcp/src/handlers/product/failures.ts, packages/mcp/src/handlers/product/plan.ts, packages/mcp/src/handlers/product/rerun.ts, packages/mcp/src/handlers/product/run.ts, packages/mcp/src/index.ts, packages/redteam/src/report.ts
  • Likely tests: packages/core/test/version.test.ts

Language And Parser Coverage

• Source files classified: 4
• Fully supported parser files: 4
• Limited files: 0
• Unsupported files: 0

Merge Risk Breakdown

• Score: 30/100
• Raw score before dampeners: 30/100
• Adjusted score before severity cap: 30/100
• Highest contributing severity: Medium

Top contributors:

• +10 Ui area changed (heuristic): judge-lab/app/judge-lab.tsx touches a ui area and should be reviewed for regression impact.
• +6 Config area changed (direct): packages/cli/package.json touches a config area and should be reviewed for regression impact.
• +4 Source area changed (heuristic): packages/core/src/version.ts touches a source area and should be reviewed for regression impact.
• +4 Test area changed (heuristic): judge-lab/tests/judge-lab.spec.ts touches a test area and should be reviewed for regression impact.
• +4 Test area changed (heuristic): judge-lab/tests/rendered-html.test.mjs touches a test area and should be reviewed for regression impact.

Notes:

• Untrusted memory context is visible but contributes 0 score until trusted evidence corroborates it.

Decay Risk Breakdown

• Score: 28/100
• Raw score before dampeners: 37/100
• Adjusted score before severity cap: 28/100
• Highest contributing severity: High
• Evidence mode: heuristic-only

Top contributors:

• +18 High complexity in changed function (heuristic): JudgeLab has estimated cyclomatic complexity 23.
• +18 Large changed function (heuristic): JudgeLab spans 488 lines, which increases review and regression risk.
• +1 File spread (structural): Change breadth spans 6 file(s).

Dampeners:

• -9 Heuristic-only dampener: Decay stays conservative until direct evidence exists.

Notes:

• Heuristic-only decay is capped at 54/100 until direct evidence exists.

Security Risk Breakdown

• Score: 0/100
• Raw score before dampeners: 0/100
• Adjusted score before severity cap: 0/100

Security Matcher Coverage

• Changed source files scanned: 2
• Security candidates found: 0
• Skipped files: 0

Test Evidence

• Mode: heuristic-only
• Sources: none
• Changed source coverage:
• judge-lab/app/judge-lab.tsx: not measured (no measurable changed lines)
• packages/core/src/version.ts: not measured (no measurable changed lines)
• Notes:
• No runtime coverage artifact was found. Test audit remains heuristic-only.

Changed Path Test Proof

Status	Count
Runtime-proven	0
Static-only	2
Weakened by mocks	0
Unproven	0

• Static-only judge-lab/app/judge-lab.tsx#JudgeLab (static-reference, deterministic)
  • Evidence: Referenced by judge-lab/tests/judge-lab.spec.ts, judge-lab/tests/rendered-html.test.mjs, but no runtime coverage artifact proves changed lines executed.
  • Static references: judge-lab/tests/judge-lab.spec.ts, judge-lab/tests/rendered-html.test.mjs
  • Repair task: Strengthen judge-lab/tests/judge-lab.spec.ts so it executes judge-lab/app/judge-lab.tsx#JudgeLab with assertions; static import alone is not proof.
• Static-only packages/core/src/version.ts#CODEDECAY_VERSION (static-reference, deterministic)
  • Evidence: Referenced by packages/core/test/version.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/core/test/version.test.ts
  • Repair task: Strengthen packages/core/test/version.test.ts so it executes packages/core/src/version.ts#CODEDECAY_VERSION with assertions; static import alone is not proof.

Untrusted Memory Context

• Project invariant may be impacted (packages/cli/package.json:3): Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
• Project invariant may be impacted (packages/cli/package.json:3): Untrusted memory context: invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
• Project invariant may be impacted (packages/core/src/version.ts:1): Untrusted memory context: invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
• Project invariant may be impacted (packages/cli/package.json:3): Untrusted memory context: invariant "Package remains installable from npm" applies to this change. The published package must include README, LICENSE, package.json, dist/index.js, and dist/index.d.ts without workspace-only dependency leaks.
• Past regression area changed (packages/cli/package.json:3): Untrusted memory context: past regression "Published npm package leaked workspace protocol" may be relevant. Published package installation failed when workspace protocol dependencies leaked into the npm package.
• Project invariant may be impacted (judge-lab/tests/judge-lab.spec.ts:80): Untrusted memory context: invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.
• Past regression area changed (packages/cli/package.json:3): Untrusted memory context: past regression "NPM tarball missed release hygiene files" may be relevant. The package previously needed fixes to include README and LICENSE in the npm tarball.
• Architecture note applies (packages/cli/package.json:3): Untrusted architecture context: CLI is the published surface: The public npm package is @submuxhq/codedecay and the binary is codedecay. Internal workspace packages are implementation details.

High Risk Findings

• High complexity in changed function (judge-lab/app/judge-lab.tsx:21): JudgeLab has estimated cyclomatic complexity 23.
• Large changed function (judge-lab/app/judge-lab.tsx:21): JudgeLab spans 488 lines, which increases review and regression risk.

Medium Risk Findings

• Ui area changed (judge-lab/app/judge-lab.tsx:270): judge-lab/app/judge-lab.tsx touches a ui area and should be reviewed for regression impact.

Low Risk Findings

• Config area changed (packages/cli/package.json:3): packages/cli/package.json touches a config area and should be reviewed for regression impact.
• Source area changed (packages/core/src/version.ts:1): packages/core/src/version.ts touches a source area and should be reviewed for regression impact.
• Test area changed (judge-lab/tests/judge-lab.spec.ts:80): judge-lab/tests/judge-lab.spec.ts touches a test area and should be reviewed for regression impact.
• Test area changed (judge-lab/tests/rendered-html.test.mjs:40): judge-lab/tests/rendered-html.test.mjs touches a test area and should be reviewed for regression impact.

Recommended Checks

• Flow check (CLI release smoke): Run built CLI smoke tests
• Flow check (CLI release smoke): Run package dry-run
• Flow check (CLI release smoke): Run published-package or tarball demo before release
• Flow check (Pull request redteam review): Check weak or missing test proof
• Flow check (Pull request redteam review): Keep deterministic evidence separate from AI suggestions
• Flow check (Pull request redteam review): Review edge cases and agent fix tasks
• Flow check (Pull request redteam review): Run codedecay redteam against the PR diff
• judge-lab/tests/judge-lab.spec.ts
• packages/core/test/version.test.ts
• packages/knowledge/test/fixtures/resilience/mixed-version.json
• Re-run likely impacted test packages/core/test/version.test.ts for packages/core/src/version.ts#CODEDECAY_VERSION
• Regression check: Install @submuxhq/codedecay in a fresh project and run codedecay --help.

Notes

CodeDecay is deterministic and local-first. This report was generated without telemetry, API keys, LLMs, or model calls.

---

Found by CodeDecay - deterministic, local-first, no telemetry.