sjh9714 · sjh9714 · Aug 6, 2026 · Aug 6, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,54 @@ this file.
 This project follows the spirit of
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## v0.10.2 - 2026-08-06
+
+### Fixed
+
+- **`mergewarden triage` counted its own failures as work waiting for a
+  maintainer.** Run against a public repository with no token, it printed
+  `20 open pull request(s) read. 14 have something a maintainer checks by hand.`
+  where nine of those fourteen rows read `could not be read`. They were not pull
+  requests needing attention; they were GitHub refusing the request after 60
+  unauthenticated calls an hour. The process exited `0`.
+
+  Every failure became `notes: ["could not be read"]`, the same shape a finding
+  has, so it was counted in the headline and sorted among real findings. This
+  repository fails closed rather than presenting a partial pass and ships an
+  `ANALYSIS INCOMPLETE` state for exactly this; the command people run first was
+  the one place that ignored it.
+
+  Unreadable pull requests are now tracked separately, reported on their own
+  line, excluded from the count, and the run exits non-zero. An exhausted quota
+  stops the loop instead of attempting every remaining pull request, and the
+  advice differs by cause: set `GH_TOKEN` when unauthenticated, wait or lower
+  `--limit` when it was the token's own quota.
+
+- The listing no longer retries an exhausted hourly quota. That backoff waited
+  20, 40 and 60 seconds, so an unauthenticated caller sat through two minutes of
+  silence before getting the error anyway. GitHub marks this case with
+  `x-ratelimit-remaining: 0`, which the secondary rate limit, still retried,
+  does not. It also no longer tells somebody who has not set a token that GitHub
+  is rate limiting "this token".
+
+- `runTriageCli` was never executed by the test suite, which is why the above
+  shipped. All 90 tests passed while the command's error handling was wrong.
+  `packages/cli/test/triageRun.test.ts` now runs it against stubbed GitHub
+  calls; five of its cases fail against the previous code.
+
+### Documentation
+
+- The README leads with the check nothing else appears to make: a pull request
+  that edits the files coding agents read as instructions. Verified against a
+  real run before the copy was written, not after. It also says in the first
+  three lines that nothing is ever closed.
+- Install drops from four options to one. `github-token`, `mode: warn` and
+  `fail-on-block: false` were all doing nothing: the first is already the
+  Action's default, the second is already the schema's default, and the third
+  only fires on a `block` decision, which warn mode never produces.
+- `triage`'s token requirement moved above the command, with a link to create
+  one and the fact that no scopes are needed.
+
 ## v0.10.1 - 2026-08-06
 
 v0.10.0 was tagged and never published. The release workflow audits dependencies

diff --git a/README.md b/README.md
@@ -60,7 +60,7 @@ jobs:
   mergewarden:
     runs-on: ubuntu-latest
     steps:
-      - uses: sjh9714/mergewarden@v0.10.1
+      - uses: sjh9714/mergewarden@v0.10.2
         with:
           comment: auto
 ```
@@ -144,7 +144,7 @@ with **no scopes selected** is enough, since nothing here writes.
 
 ```bash
 export GH_TOKEN=github_pat_...
-npx --yes mergewarden@0.10.1 triage owner/repository
+npx --yes mergewarden@0.10.2 triage owner/repository
 ```
 
 ```

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -45,7 +45,7 @@ Next: Review the agent instruction/tooling change before merging.
 不需要令牌、不需要仓库、不联网，先看看它能抓到什么：
 
 ```bash
-npx --yes mergewarden@0.10.1 demo
+npx --yes mergewarden@0.10.2 demo
 ```
 
 这条命令会分析一个内置在 CLI 里的示例 PR，用的是**默认策略**——也就是说，它输出的 13 条检查结果，就是零配置安装时你实际会得到的东西。
@@ -57,8 +57,8 @@ _上图是真实的 `npx` 执行（用 `head` 截断以便完整显示开头）
 然后扫描一个真实的 PR，用 `owner/repo#number` 或完整 URL 都可以：
 
 ```bash
-npx --yes mergewarden@0.10.1 scan owner/repository#123
-npx --yes mergewarden@0.10.1 scan https://github.com/owner/repository/pull/123
+npx --yes mergewarden@0.10.2 scan owner/repository#123
+npx --yes mergewarden@0.10.2 scan https://github.com/owner/repository/pull/123
 ```
 
 私有仓库或需要更高 API 速率限制时，用 `GH_TOKEN` 或 `GITHUB_TOKEN` 环境变量。MergeWarden 有意不提供传令牌的命令行参数。
@@ -84,7 +84,7 @@ jobs:
   mergewarden:
     runs-on: ubuntu-latest
     steps:
-      - uses: sjh9714/mergewarden@v0.10.1
+      - uses: sjh9714/mergewarden@v0.10.2
         with:
           comment: auto
 ```

diff --git a/docs/cli.md b/docs/cli.md
@@ -17,7 +17,7 @@ mergewarden --version
 Run without installing:
 
 ```bash
-npx --yes mergewarden@0.10.1 scan owner/repository#123
+npx --yes mergewarden@0.10.2 scan owner/repository#123
 ```
 
 ## Demo

diff --git a/docs/getting-started.md b/docs/getting-started.md
@@ -9,7 +9,7 @@ You can run MergeWarden against any public pull request without installing
 anything and without a token:
 
 ```bash
-npx --yes mergewarden@0.10.1 scan owner/repository#123
+npx --yes mergewarden@0.10.2 scan owner/repository#123
 ```
 
 Try it on a pull request you already know well. If the report tells you nothing
@@ -21,7 +21,7 @@ open pull request and lists only the ones with something a maintainer checks by
 hand:
 
 ```bash
-npx --yes mergewarden@0.10.1 triage owner/repository
+npx --yes mergewarden@0.10.2 triage owner/repository
 ```
 
 It needs no write access and writes nothing back, but it does need `GH_TOKEN`
@@ -57,7 +57,7 @@ jobs:
   mergewarden:
     runs-on: ubuntu-latest
     steps:
-      - uses: sjh9714/mergewarden@v0.10.1
+      - uses: sjh9714/mergewarden@v0.10.2
         with:
           comment: auto
 ```

diff --git a/docs/history/releases/release-notes-v0.10.2.md b/docs/history/releases/release-notes-v0.10.2.md
@@ -0,0 +1,60 @@
+# v0.10.2
+
+**Released 2026-08-06.**
+
+A bug fix for the command this project tells people to run first.
+
+## What was wrong
+
+Run against a public repository with no token, `triage` printed this:
+
+```
+20 open pull request(s) read. 14 have something a maintainer checks by hand.
+
+#10586  gci-fun-1                    could not be read
+#12046  feat/detect-nested-any-in-…  could not be read
+#12086  strict-void-return-fixer     could not be read
+...
+```
+
+With a token the same repository returns five rows. Nine of those fourteen were
+not pull requests needing attention. They were GitHub refusing the request:
+60 unauthenticated calls an hour, which one queue uses up.
+
+Every failure became a note in the same shape a finding has, so the tool's own
+broken state was counted as the repository's problem, sorted among real
+findings, and the process exited `0`.
+
+## What it does now
+
+Unreadable pull requests are counted separately, reported on their own line, and
+the run exits non-zero:
+
+```
+9 open pull request(s) read. 3 have something a maintainer checks by hand.
+11 could not be read, so this is a partial answer. GitHub allows 60
+unauthenticated requests an hour, which one repository's queue exhausts.
+Set GH_TOKEN to a personal access token and run it again.
+```
+
+An exhausted quota stops the run rather than attempting every remaining pull
+request, and the hourly quota is no longer retried: that backoff spent two
+minutes on a wait that could not have helped.
+
+## Why it shipped in the first place
+
+`runTriageCli` was never executed by the test suite. Every triage test was a
+pure function or an assertion about the source text, so all 90 passed while the
+command's error handling was wrong. There is now an integration test that runs
+it against stubbed GitHub calls, and five of its cases fail against the previous
+code.
+
+## Documentation
+
+The README leads with the one check nothing else appears to make: a pull request
+that edits the files coding agents read as instructions. It was verified against
+a real run before the copy was written.
+
+Install drops from four options to one. Three of them were doing nothing.
+
+The full list is in the [changelog](../../../CHANGELOG.md).
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mergewarden-repo",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@11.5.0",

diff --git a/packages/action/dist/index.cjs b/packages/action/dist/index.cjs
@@ -51617,7 +51617,7 @@ async function loadGitHubAnalysis(api, target, options) {
 }
 
 // src/version.ts
-var MERGEWARDEN_VERSION = "0.10.1";
+var MERGEWARDEN_VERSION = "0.10.2";
 
 // src/run.ts
 var MERGEWARDEN_COMMENT_MARKER = "<!-- mergewarden-report -->";

diff --git a/packages/action/package.json b/packages/action/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@mergewarden/action",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "private": true,
   "type": "module",
   "files": [

diff --git a/packages/action/src/version.ts b/packages/action/src/version.ts
@@ -1 +1 @@
-export const MERGEWARDEN_VERSION = "0.10.1";
+export const MERGEWARDEN_VERSION = "0.10.2";
diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mergewarden",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "private": false,
   "type": "module",
   "description": "Checkout-free policy scanning for AI-generated GitHub pull requests",

diff --git a/packages/cli/src/version.ts b/packages/cli/src/version.ts
@@ -1 +1 @@
-export const MERGEWARDEN_VERSION = "0.10.1";
+export const MERGEWARDEN_VERSION = "0.10.2";
diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@mergewarden/core",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "private": true,
   "type": "module",
   "exports": {

diff --git a/packages/core/src/version.ts b/packages/core/src/version.ts
@@ -1 +1 @@
-export const MERGEWARDEN_VERSION = "0.10.1";
+export const MERGEWARDEN_VERSION = "0.10.2";
diff --git a/packages/github/package.json b/packages/github/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@mergewarden/github",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "private": true,
   "type": "module",
   "exports": {

diff --git a/packages/mcp/package.json b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mergewarden-mcp",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "MCP server that checks whether a coding agent's changes stayed inside the scope it was given",
   "license": "MIT",
   "type": "module",

diff --git a/packages/mcp/server.json b/packages/mcp/server.json
@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.sjh9714/mergewarden",
   "description": "Check whether a coding agent's changes stayed inside the scope it was given.",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "repository": {
     "url": "https://github.com/sjh9714/mergewarden",
     "source": "github"
@@ -11,7 +11,7 @@
     {
       "registryType": "npm",
       "identifier": "mergewarden-mcp",
-      "version": "0.10.1",
+      "version": "0.10.2",
       "transport": {
         "type": "stdio"
       }

diff --git a/packages/mcp/src/version.ts b/packages/mcp/src/version.ts
@@ -1 +1 @@
-export const MERGEWARDEN_VERSION = "0.10.1";
+export const MERGEWARDEN_VERSION = "0.10.2";
diff --git a/templates/mergewarden-observe.yml b/templates/mergewarden-observe.yml
@@ -12,4 +12,4 @@ jobs:
   mergewarden:
     runs-on: ubuntu-latest
     steps:
-      - uses: sjh9714/mergewarden@v0.10.1
+      - uses: sjh9714/mergewarden@v0.10.2
-Original file line number
+Diff line change
@@ Expand Up / @@ -17,7 +17,7 @@ mergewarden --version @@
     Run without installing:
     ```bash
-    npx --yes mergewarden@0.10.1 scan owner/repository#123
+    npx --yes mergewarden@0.10.2 scan owner/repository#123
     ```
     ## Demo
@@ Expand Down @@
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		export const MERGEWARDEN_VERSION = "0.10.1";
		export const MERGEWARDEN_VERSION = "0.10.2";