chore(release): prepare v0.4.2

judge-lab/app/judge-lab.tsx

@@ -267,8 +267,8 @@ export function JudgeLab({ engineVersion, sourceCommit, scenarios }: JudgeLabPro
               readOnly
               rows={2}
               spellCheck={false}
-              value={`npx @submuxhq/codedecay@0.4.1 redteam --base main --head HEAD --format markdown
-npx @submuxhq/codedecay@0.4.1 agent --base main --head HEAD`}
+              value={`npx @submuxhq/codedecay@0.4.2 redteam --base main --head HEAD --format markdown
+npx @submuxhq/codedecay@0.4.2 agent --base main --head HEAD`}
             />
             <p>
               This is the real product path: local diff, local checks, no hidden upload, and
@@ -284,7 +284,7 @@ npx @submuxhq/codedecay@0.4.1 agent --base main --head HEAD`}
               readOnly
               rows={4}
               spellCheck={false}
-              value={`- uses: SubmuxHQ/CodeDecay/.github/actions/codedecay@v0.4.1
+              value={`- uses: SubmuxHQ/CodeDecay/packages/github-action@v0
   with:
     base: main
     head: HEAD`}

judge-lab/public/evidence/weak-test-report.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "generator": "scripts/generate-judge-lab-evidence.mjs",
-  "engineVersion": "0.4.1",
+  "engineVersion": "0.4.2",
   "generatedAt": "2026-07-27T00:00:00.000Z",
   "scenarioId": "weak-test",
   "findings": [

judge-lab/tests/judge-lab.spec.ts

@@ -77,7 +77,7 @@ test("publishes the captioned genuine Codex repair demo and evidence links", asy
   );
   await expect(demo.locator("source")).toHaveAttribute("src", "/demo/codedecay-codex-repair.mp4");
   await expect(demo.locator("track")).toHaveAttribute("src", "/demo/codedecay-codex-repair.vtt");
-  await expect(demo.getByText("v0.4.1 · fixture 36a38500031f", { exact: true })).toBeVisible();
+  await expect(demo.getByText("v0.4.2 · fixture 36a38500031f", { exact: true })).toBeVisible();
   await expect(demo.getByRole("link", { name: "Evidence index ↗" })).toHaveAttribute(
     "href",
     /docs\/hackathon\/demo\/evidence\/run-v3\.md/,

judge-lab/tests/rendered-html.test.mjs

@@ -37,16 +37,16 @@ test("server-renders the Judge Lab landing experience", async () => {
   assert.match(html, /CodeDecay turns Codex from a fast builder into a safer finisher\./);
   assert.match(html, /The risky path failed, got repaired, and now has proof\./);
   assert.match(html, /The web lab is the proof sandbox\. Your repo stays local\./);
-  assert.match(html, /npx @submuxhq\/codedecay@0\.4\.1 redteam/);
-  assert.match(html, /SubmuxHQ\/CodeDecay\/\.github\/actions\/codedecay@v0\.4\.1/);
+  assert.match(html, /npx @submuxhq\/codedecay@0\.4\.2 redteam/);
+  assert.match(html, /SubmuxHQ\/CodeDecay\/packages\/github-action@v0/);
   assert.match(html, /Watch CodeDecay catch it/);
   assert.match(html, /No login\. No repository upload\./);
   assert.match(html, /Don’t trust the green check\./);
   assert.match(html, /From false green to real proof\./);
   assert.match(html, /\/demo\/codedecay-codex-repair\.mp4/);
   assert.match(html, /\/demo\/codedecay-codex-repair\.vtt/);
   assert.match(html, /Edited for time from one genuine session/);
-  assert.match(html.replaceAll("<!-- -->", ""), /v0\.4\.1 · fixture 36a38500031f/);
+  assert.match(html.replaceAll("<!-- -->", ""), /v0\.4\.2 · fixture 36a38500031f/);
   assert.doesNotMatch(html, /Your site is taking shape|react-loading-skeleton/);
 });
 
@@ -93,7 +93,7 @@ test("live endpoint finds the curated anonymous admin route", async () => {
   assert.equal(response.status, 200);
   const payload = await response.json();
   assert.equal(payload.execution.mode, "live");
-  assert.equal(payload.links.release, "https://github.com/SubmuxHQ/CodeDecay/releases/tag/v0.4.1");
+  assert.equal(payload.links.release, "https://github.com/SubmuxHQ/CodeDecay/releases/tag/v0.4.2");
   assert.equal(payload.summary.riskLevel, "high");
   assert.equal(payload.impactedRoute.route, "/api/users");
   assert.ok(

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@submuxhq/codedecay",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Catch what your AI coding agent missed before merge with local PR safety checks",
   "license": "Apache-2.0",
   "author": "SubmuxHQ",

packages/core/src/version.ts

@@ -1 +1 @@
-export const CODEDECAY_VERSION = "0.4.1";
+export const CODEDECAY_VERSION = "0.4.2";