Release v3.8.19 (#3526)

* chore(release): open v3.8.19 development cycle

* chore(release): sync electron lockfile to 3.8.19

* feat(quality): quality-gate ratchet + anti-hallucination/rule-enforcement guardrails (Phases 0-6) (#3471)

* feat(quality): generic ratchet comparator (multi-metric, regression-only)

* chore(ci): Fase 0 quality-gate fixes — reconcile coverage gate (40->60), tier npm audit, wire orphaned contract gates, re-enable cheap husky pre-commit

* feat(quality): ratchet engine (collector + frozen baseline + CI job) and provider-consistency gate

- collect-metrics.mjs: emits quality-metrics.json (ESLint warnings + coverage when present)
- quality-baseline.json: frozen baseline (eslintWarnings=3482, regression-only)
- ci.yml: quality-gate job (ratchet + step summary + artifact) and check:provider-consistency in lint job
- check-provider-consistency.ts: every REGISTRY id must be a canonical provider (found krutrim half-registered → allowlisted as known pre-existing, blocks any NEW orphan)
- TDD: 9 tests (5 ratchet + 4 provider-consistency)

* feat(quality): Fase 2 anti-hallucination gates — fetch-targets, openapi-routes, deps allowlist

- check-fetch-targets: every dashboard fetch(/api/...) resolves to a real route.ts; found 7 pre-existing dashboard->route mismatches frozen as KNOWN_MISSING for triage
- check-openapi-routes: every openapi.yaml path resolves to a real route; found 1 stale spec entry (agent-bridge agents/{id}/state) frozen as KNOWN_STALE_SPEC
- check-deps: anti-slopsquatting allowlist (105 deps); new deps need explicit human-reviewed entry
- all wired into CI lint/docs jobs; TDD +12 tests (21 total across 5 gates)

* docs(quality): add quality-gates report + implementation plan to repo root

* feat(quality): Fase 3a — file-size ratchet (freeze 91 files >800 LOC, cap 800 for new)

- check-file-size.mjs: frozen files can only shrink; new files must be <= cap (kills the next 12k-line god-component)
- file-size-baseline.json: 91 files frozen at current LOC (largest 12883)
- wired into CI lint job; TDD 5 tests; --update ratchets the baseline down on shrink

* feat(quality): Fase 3b — duplication ratchet (jscpd@4, baseline 5.72%)

- check-duplication.mjs: runs jscpd@4 (pinned; v5 is an incompatible Rust rewrite) over src+open-sse, fails if duplication % rises vs frozen baseline (5.72%, measured: 1358 clones / 22967 dup lines). Targets the executor copy-paste (48/50 override execute() wholesale)
- wired into the parallel quality-gate CI job (off the lint critical path); TDD 4 tests; --update ratchets down
- snapshot now complete: coverage ~82.6%, eslint 3482 (98.5% no-explicit-any), duplication 5.72%, 91 files >800 LOC

* feat(quality): Fase 4a — anti test-masking gate

- check-test-masking.mjs: for each MODIFIED test file in a PR, flags net assert removal + new assert.ok(true) tautologies (base...HEAD diff). Directly enforces CLAUDE.md 'never weaken asserts to go green'
- wired into pr-test-policy CI job (reuses base fetch); no-op outside PR; TDD 5 tests

* feat(quality): Fase 4b — coverage ratchet (conservative floors, CI consumes merged coverage)

- quality-baseline.json: coverage.{statements,lines,functions,branches} floors (80/80/82/73, real ~82.58/82.58/84.23/75.22 with margin; tighten via --update after a green main run)
- check-quality-ratchet.mjs: --allow-missing (local quality:gate skips coverage.* without a coverage run; CI runs strict)
- ci.yml quality-gate job: needs test-coverage + downloads merged coverage-report so the ratchet enforces 'coverage cannot drop'
- TDD +1 test (6 total)

* feat(quality): Fase 6 — 8 new gates (Rule #11/#12, migrations, known-symbols, route-guard, complexity, docs-symbols, db-rules)

Deterministic gates, each freezing pre-existing violations in a documented allowlist (ratchet) so they pass now and block only NEW regressions:
- check-error-helper (Rule #12): 7 executors/handlers forwarding raw err.message frozen
- check-public-creds (Rule #11): 5 literal client_ids (Claude/Codex/Qwen/Kimi/Copilot) frozen
- check-migration-numbering: gaps 026/055 + dup 041 frozen (prevents the git-rm-deleted-migration incident)
- check-known-symbols: 93 executors conformance + 15 combo strategies + 18 translator pairs
- check-route-guard-membership (#15/#17): all 25 spawn-capable routes verified local-only (0 gaps)
- check-complexity: cyclomatic>15 / fn-length>80 ratchet (baseline 1739)
- check-docs-symbols: 30 stale doc /api refs frozen (docs hallucination)
- check-db-rules (#2/#5): 25 unexported db modules + 15 raw-SQL routes frozen
Wired into CI (lint / docs-sync-strict / quality-gate jobs). 115 TDD tests, all green. ESLint ratchet held at 3482.

* docs(quality): Phase 7 plan (security/dead-code/mutation/community tooling) — GATED to 2026-06-16

Stored, not active. 7 suggested gates + all discussed OSS/Community tools (SonarQube Community + osv-scanner + CodeQL + knip + sonarjs + type-coverage + lockfile-lint + Stryker + size-limit + axe-core + semcheck + agent-lsp + Qlty). Activation gate: do not start before 2026-06-16 (use Phases 0-6 in production for 1 week, validate in practice, then evolve).

* docs(quality): Phase 6A critical-audit plan + Phase 7 additions — gated to 2026-06-16 (#3530)

PLANO-QUALITY-GATES-FASE6A.md (12-task audit of Phases 0-6: orphan tests, stale-allowlist enforcement, scope gaps) + Phase 7 additions (gitleaks, actionlint+zizmor, license compliance). Both stored, activation gated to 2026-06-16. Tasks 6A.1/6A.2 were fast-tracked separately (#3536).

* feat(quality): 6A.1+6A.2 — test-discovery gate, 135 orphan tests re-wired, 2 production bug fixes, vitest in CI (#3536)

check-test-discovery gate (TDD; 195 orphans found, 135 re-wired into the node runner, 60 frozen+annotated). Triage fixed 2 real production bugs: missing BYPASS_PREFIX_NOT_ALLOWED zod refine (spawn-capable prefixes accepted into the bypass list, Hard Rules #15/#17) and resetDbInstance not firing stateReset resetters (stale schema memo → 503 instead of 403; also hit backup-restore). New test-vitest CI job: test:vitest blocking (146/146), test:vitest:ui informational (14 pre-existing fails, triage 2026-06-16).

* chore: ignore generated yt-downloader artifact files

Add dated yt-downloader output files to .gitignore to prevent
local automation artifacts from being accidentally committed.

* chore(quality): green-light the quality-gate — conscious file-size + eslintWarnings re-baselines (#3538)

file-size: 9 files frozen at current sizes (v3.8.18-era growth + core.ts +7 from #3536 fix). eslintWarnings 3482→3501: the published v3.8.18 tag already measures 3501 (delta predates the quality-gate job); v3.8.19 cycle is neutral. Reduction + --require-tighten = Phase 6A (2026-06-16).

* fix(check): exclude internal planning docs (docs/superpowers/) from the docs-symbols gate

docs/superpowers/plans/*.md are historical implementation-plan snapshots that
may cite planned/abandoned routes — not claims about the current code. Three
such refs entered during the v3.8.18 cycle, before this gate was on the
pipeline, and would have blocked the v3.8.19 release merge.

* chore(release): v3.8.19 — 2026-06-09

CHANGELOG section for the quality-infrastructure release (7 commits, 1:1
coverage), [3.8.18] label corrected to its real release date, local prompt
artifacts ignored.

* test: hermetic auth context for 2 re-wired suites + real headroom on the breaker reset-timeout flake

CI shards exposed what the dev DATA_DIR was masking locally: detect.test.ts
and managementCliToken.test.ts asserted 401/403/reject outcomes that only
exist when login protection is configured — on a fresh CI DB isAuthRequired()
is false and the policy anonymous-allows. Both now create an isolated
DATA_DIR with requireLogin+password (the established pattern).

observability-fase04: the breaker reset-timeout test ran with a 5ms margin
(resetTimeout 10 / sleep 15) — lazy HALF_OPEN refresh under shard contention
flipped the first OPEN assert. Now 250/300ms.

* test: align bypass-prefix schema test to the restored layer-1 contract + real waitFor headroom

appearance-widget-settings-schema asserted that /api/cli-tools/runtime/ was
ACCEPTED into the bypass list — written against the buggy schema (missing
BYPASS_PREFIX_NOT_ALLOWED refine, restored in #3536) and consecrating the
bug the AC-8 orphan test guards against. Split into accept-safe +
reject-spawn-capable cases. chatcore waitFor ceiling 1500→10000ms (green
runs return immediately; observed 1580ms expiry on 2-core CI runners).

* test(chatcore): fix structurally-broken pending-detail predicate (flatten before find)

pendingRequests.details[connectionId] is Record<modelKey, PendingRequestDetail[]>
— the upstream-timeout test's waitFor tested each ARRAY's .providerRequest
(always undefined), so it could never resolve and expired (failed on 3 CI jobs;
reproduced deterministically isolated, including at the published v3.8.18 tag).
Flatten to the actual details + declare the call_log_pipeline_enabled dependency
explicitly + waitFor ceiling with real CI headroom.

* chore(quality): re-baseline coverage floors to the honest post-re-wire denominator + changelog coverage for the stabilization commits

The 135 re-wired tests import modules that were never loaded before, so the
c8 denominator grew: the old ~82.5% was inflated by never-imported modules
being invisible. CI merged coverage now measures 78.4/78.4/83.84/75.73 —
floors set ~2pt below (76.5/76.5; functions/branches floors already hold).
Tightening via --require-tighten is Phase 6A work (2026-06-16).

scripts/quality/check-quality-ratchet.mjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+// scripts/quality/check-quality-ratchet.mjs
+// Catraca genérica multi-métrica. Clona o espírito de check-t11-any-budget.mjs:
+// um baseline congelado por métrica; falha em qualquer regressão; só anda num sentido.
+import fs from "node:fs";
+import path from "node:path";
+
+const cwd = process.cwd();
+function getArg(name, fallback) {
+  const i = process.argv.indexOf(name);
+  return i >= 0 && process.argv[i + 1] ? process.argv[i + 1] : fallback;
+}
+const BASELINE = path.resolve(getArg("--baseline", path.join(cwd, "quality-baseline.json")));
+const METRICS = path.resolve(getArg("--metrics", path.join(cwd, "quality-metrics.json")));
+const SUMMARY = getArg("--summary", null);
+const UPDATE = process.argv.includes("--update");
+// --allow-missing: pula métricas do baseline ausentes do metrics (em vez de falhar).
+// Uso local: cobertura só existe no CI; localmente quality:gate roda com este flag.
+// No CI o job quality-gate roda SEM o flag (estrito — baixa o coverage mergeado antes).
+const ALLOW_MISSING = process.argv.includes("--allow-missing");
+const EPS = 0.01;
+
+function load(p) {
+  if (!fs.existsSync(p)) {
+    console.error(`[quality-ratchet] arquivo ausente: ${p}`);
+    process.exit(2);
+  }
+  return JSON.parse(fs.readFileSync(p, "utf8"));
+}
+
+const baseline = load(BASELINE);
+const metrics = load(METRICS);
+const failures = [];
+const improvements = [];
+const rows = [];
+
+for (const [key, spec] of Object.entries(baseline.metrics)) {
+  const current = metrics[key];
+  const base = spec.value;
+  const dir = spec.direction; // "down" = menor-é-melhor | "up" = maior-é-melhor
+  if (current === undefined) {
+    if (ALLOW_MISSING) {
+      rows.push([key, base, "—", "SKIP (ausente)"]);
+    } else {
+      failures.push(`métrica "${key}" ausente em ${path.basename(METRICS)}`);
+      rows.push([key, base, "—", "MISSING"]);
+    }
+    continue;
+  }
+  let status = "ok";
+  if (dir === "down") {
+    if (current > base + EPS) {
+      failures.push(`${key}: ${current} > baseline ${base} (não pode aumentar)`);
+      status = "REGRESSÃO";
+    } else if (current < base - EPS) {
+      improvements.push([key, current]);
+      status = "↑ melhorou";
+    }
+  } else {
+    if (current < base - EPS) {
+      failures.push(`${key}: ${current} < baseline ${base} (não pode cair)`);
+      status = "REGRESSÃO";
+    } else if (current > base + EPS) {
+      improvements.push([key, current]);
+      status = "↑ melhorou";
+    }
+  }
+  rows.push([key, base, current, status]);
+}
+
+if (SUMMARY) {
+  const md = [
+    "# Quality Ratchet",
+    "",
+    "| Métrica | Baseline | Atual | Status |",
+    "|---|---|---|---|",
+    ...rows.map(([k, b, c, s]) => `| ${k} | ${b} | ${c} | ${s} |`),
+    "",
+    failures.length
+      ? `**${failures.length} regressão(ões) — gate BLOQUEADO.**`
+      : "**Sem regressões — gate OK.**",
+  ].join("\n");
+  fs.mkdirSync(path.dirname(SUMMARY), { recursive: true });
+  fs.writeFileSync(SUMMARY, md + "\n");
+}
+
+if (UPDATE && failures.length === 0 && improvements.length) {
+  for (const [key, val] of improvements) baseline.metrics[key].value = val;
+  fs.writeFileSync(BASELINE, JSON.stringify(baseline, null, 2) + "\n");
+  console.log(`[quality-ratchet] baseline ratcheado: ${improvements.length} métrica(s) melhoraram`);
+}
+
+if (failures.length) {
+  console.error("[quality-ratchet] FALHOU:\n" + failures.map((f) => "  ✗ " + f).join("\n"));
+  process.exit(1);
+}
+console.log(`[quality-ratchet] OK (${rows.length} métricas, ${improvements.length} melhoraram)`);

scripts/quality/collect-metrics.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+// scripts/quality/collect-metrics.mjs — emite quality-metrics.json
+// Coletores incrementais: Fase 1 traz ESLint warnings + cobertura.
+// Fases 3/4 estendem com duplicação (jscpd), tamanho de arquivo e cobertura por módulo.
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+
+const cwd = process.cwd();
+const out = {};
+
+// 1) ESLint: contagem de warnings (errors devem ser 0; o lint já gata isso)
+function eslintCounts() {
+  let stdout;
+  try {
+    stdout = execFileSync("npx", ["eslint", ".", "--format", "json"], {
+      encoding: "utf8",
+      maxBuffer: 256 * 1024 * 1024,
+    });
+  } catch (e) {
+    // eslint sai com código != 0 quando há errors; o JSON ainda vem no stdout
+    stdout = e.stdout?.toString() || "[]";
+  }
+  const results = JSON.parse(stdout);
+  out.eslintWarnings = results.reduce((n, r) => n + (r.warningCount || 0), 0);
+  out.eslintErrors = results.reduce((n, r) => n + (r.errorCount || 0), 0);
+}
+
+// 2) Cobertura: lê coverage/coverage-summary.json se existir (gerado por c8)
+function coverage() {
+  const p = path.join(cwd, "coverage", "coverage-summary.json");
+  if (!fs.existsSync(p)) return;
+  const t = JSON.parse(fs.readFileSync(p, "utf8")).total;
+  out["coverage.statements"] = t.statements.pct;
+  out["coverage.lines"] = t.lines.pct;
+  out["coverage.functions"] = t.functions.pct;
+  out["coverage.branches"] = t.branches.pct;
+}
+
+eslintCounts();
+coverage();
+fs.writeFileSync(path.join(cwd, "quality-metrics.json"), JSON.stringify(out, null, 2) + "\n");
+console.log("[collect-metrics]", JSON.stringify(out));