Release CodeTruss CLI v0.2.45

[DeliriumPulse]

Syncs the 0.2.45 source from the private monorepo, byte for byte against the monorepo git objects (198 files compared by blob hash, 0 mismatches).

codetruss-cli-0.2.45.tgz
sha256 0ced9ca92b28a96faf997a1c45911fd2dd77bb4107fdd3153d88692139c714ce

That is the digest the website serves today and the digest now in release-reference.json. It was not copied into the reference: pnpm release:artifact was run against this tree and the rebuilt archive cmps clean against both codetruss.com/downloads/codetruss-cli-0.2.45.tgz and the monorepo's copy. The same cmp against 0.2.44 exits 1, so the comparison is capable of failing.

What 0.2.45 is

codetruss-ignore: <reason> makes one promise — that a PASS can never be reached by editing text — and it did not hold. markerFor checked comment-only placement on the line above a finding, so on the finding's own line the marker counted wherever those characters appeared, including inside a string literal. A minified bundle is one physical line, so a single planted string dismissed every finding in the file, and dismissed findings stop gating the verdict.

Markers are now read only from a comment, decided by the same classifier the comment analyzers ship. Where no classifier covers the language, the marker is honored only on a line whose every preceding character is whitespace or comment punctuation. Generated, vendored, and excluded content is no longer read at all — that text had no author who could have meant it. And the reason, which runs to end of line and lands verbatim on a signed receipt and in the hosted database, is redacted against the credential patterns before it is quoted.

This is release-blocking rather than routine: every user on 0.2.44 or older has a verdict that can be edited into a pass.

Two more defects ride along. The size analyzer measured non-blank lines and printed the number as "lines of code", which manufactured severity a reader can disprove with wc — two of this repository's own HIGH findings existed only because of it. And the open-redirect rule matched two method names, so it could not see <Link href={returnTo}>, location.href = next or router.push(next), which is how redirects are written here; it missed a live open redirect in this codebase on that basis.

Not touched

package.json, pnpm-lock.yaml, pnpm-workspace.yaml and .npmrc are unchanged — 0.2.45 moves no dependency. public/downloads/grammars/ is carried verbatim, and no previously published artifact is modified.

Checked locally before opening

pnpm validate passes against this branch: typecheck, release:artifact, pnpm test (34 files, 425 tests), release:verify, and test:install. The rebuilt archive reproduced 0ced9ca9… exactly, and release-reference.json's three digests were each recomputed from the files rather than transcribed.

🤖 Generated with Claude Code