Merge pull request #166 from nucliweb/chore/cli-0.4.0

chore(cli): release 0.4.0

Author: nucliweb

cli/CHANGELOG.md

@@ -8,6 +8,10 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The CL
 
 ## [Unreleased]
 
+---
+
+## [0.4.0] — 2026-10-04
+
 ### Added
 - Decision-tree follow-ups for Core Web Vitals: an image LCP adds `LCP-Image-Entropy` and `Image-Element-Audit`, a video poster LCP adds `LCP-Video-Candidate` and `Video-Element-Audit`, LCP over 4 s adds `LCP-Trail`, CLS over 0.1 adds `Layout-Shift-Loading-and-Interaction`, and CLS over 0.25 adds the lazy images, fonts, critical CSS and image checks. A follow-up that is a tracking snippet is read through its data function.
 - `interaction` workflow (`--workflow interaction`): `long-tasks`, `long-frames`, `scroll`, `layout-shifts`, `forced-layout`, `interactions` and `input-latency`. It runs the steps of `--interact-script`, or a scroll of its own when there is none. `interactions` and `input-latency` are `skipped`, with the reason and without failing the run, when the interactions have no click or type step.
@@ -19,6 +23,12 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The CL
 - `--snippet` accepts the name of any snippet (`--snippet Compression-Audit`), in any case, besides the short aliases and `Category/Name` paths. An unknown name exits with code `2` and lists the closest snippets.
 
 ### Changed
+- The snippets the CLI runs include changes since 0.3.0 that alter their results:
+  - `First-And-Third-Party-Script-Timings` returns `null` for the DNS, connection, request and response phases of a cross-origin script without `Timing-Allow-Origin`, instead of numbers computed against zero (a response time larger than the total).
+  - `First-And-Third-Party-Script-Info`, `First-And-Third-Party-Script-Timings`, `Script-Loading`, `TTFB-Resources`, `Cache-Strategy-Analysis` and `Fonts-Preloaded-Loaded-and-used-above-the-fold` count the domains listed in `OWN_DOMAINS`, declared at the top of the snippet, as first party. Without it, a site's own CDN on another root domain is third party.
+  - `Resource-Hints-Validation` lists each unused hint in `items`, and a preload for a viewport that does not match is no longer counted as unused.
+  - `Image-Element-Audit` audits the image the browser reports as the LCP element, and none when the LCP is text, a CSS background or a video, instead of the largest image in the viewport.
+  - `Cache-Strategy-Analysis` reports uncompressed text and duplicates that need no headers, and how much of the page it could analyze; `Third-Party-Impact-by-Domain` notes the long animation frames that no third-party script accounts for.
 - A follow-up runs once: a snippet two rules ask for, or that the workflow already ran, is not repeated. Before, the render-blocking check ran twice in the `loading` workflow when FCP was over 1.8 s.
 - The `error` issues of a follow-up show in the report and no longer change the exit code, so the default `core-web-vitals` workflow keeps failing only on budgets. A follow-up that itself fails (`status: "error"`) still counts.
 

cli/README.md

@@ -5,7 +5,7 @@ Run curated [WebPerf Snippets](https://webperf-snippets.nucliweb.net) headlessly
 <img width="1820" height="1442" alt="webperf-snippets-CLI" src="https://github.com/user-attachments/assets/af7e6b02-8877-407e-87a4-db063468b5fb" />
 
 
-> **Status:** v0.2. Core Web Vitals, loading audit, and structural checks. See [Roadmap](#roadmap) for what's next.
+> **Status:** v0.4. Core Web Vitals, loading, interaction and structural audit workflows, and every snippet of the collection by name. See the [Roadmap](#roadmap).
 
 ## Why
 
@@ -132,7 +132,7 @@ Without `--report-to` the CLI makes no external calls. With it, the results are
   "timestamp": "2026-05-06T10:00:00.000Z",
   "navMs": 1240,
   "results": [],
-  "meta": { "viewport": "mobile", "waitMs": 3000, "cli_version": "0.3.0" }
+  "meta": { "viewport": "mobile", "waitMs": 3000, "cli_version": "0.4.0" }
 }
 ```
 
@@ -300,8 +300,8 @@ The `NPM_TOKEN` secret must be set in the repository settings with publish acces
 ## Roadmap
 
 - ~~v0.2: Loading workflow (TTFB, FCP, render-blocking, scripts, fonts), shared page session, synthetic interactions for INP, markdown reporter for PR comments.~~ ✓ Released
-- v0.3: GitHub Action wrapper.
-- v0.4: Auth flows (login + measure logged-in pages), CrUX field-data enrichment.
+- ~~v0.3: GitHub Action wrapper, auth flows (login + measure logged-in pages), CrUX field-data enrichment, `--report-to`.~~ ✓ Released
+- ~~v0.4: Every snippet by name, a 22-step audit, an 11-step loading workflow, the interaction workflow and decision-tree follow-ups for Core Web Vitals.~~ ✓ Released
 
 ## How it works
 

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webperf-snippets",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Run curated WebPerf Snippets headlessly via Playwright. Diagnose Core Web Vitals beyond what Lighthouse exposes.",
   "type": "module",
   "bin": "./src/bin.js",

package-lock.json

@@ -140,7 +140,7 @@ Without `--report-to` the CLI makes no external calls. With it, the results are
   "timestamp": "2026-05-06T10:00:00.000Z",
   "navMs": 1240,
   "results": [],
-  "meta": { "viewport": "mobile", "waitMs": 3000, "cli_version": "0.3.0" }
+  "meta": { "viewport": "mobile", "waitMs": 3000, "cli_version": "0.4.0" }
 }
 ```