diff --git a/CHANGELOG.md b/CHANGELOG.md index 86fd61b..a51cefc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,7 @@ CodeTruss CLI follows semantic versioning. Release artifacts and their SHA-256 checksums are published at . -The current public release is [v0.2.61 on GitHub](https://github.com/CodeTruss/codetruss-cli/releases/tag/v0.2.61), +The current public release is [v0.2.62 on GitHub](https://github.com/CodeTruss/codetruss-cli/releases/tag/v0.2.62), distributed from . npm publication is a separate, manually dispatched step, so the npm `latest` tag can trail the website and the GitHub release; the dispatch for this @@ -13,6 +13,32 @@ were superseded before distribution. ## Unreleased +## 0.2.62 — 2026-08-09 + +- **The comment analyzer learned the difference between deferring with a + placeholder and documenting one.** A bare match on the word reported this + engine's own docs for its placeholder detector as six comments describing + unfinished work — the same self-reference failure the secrets scanner had + with its own examples, fixed the same way. Backtick code spans are stripped + before narration matching (a quoted term is vocabulary under discussion), + and the placeholder pattern now requires the deferral sense: "is a + placeholder", "placeholder for", "placeholder until". + + Measured on six outside repositories before shipping: thirteen findings + moved, and each was read. Eleven were prose about placeholder machinery — + redaction engines, template resolvers, detection logic — reported as + unfinished work, which is precisely the false positive this closes. Two + were stub files literally titled "Placeholder … example" that no longer + report; that loss is accepted and recorded here rather than patched with a + pattern that would re-open the other eleven. + +- **Three dead exports are gone**: `CLI_SAST_LANGUAGES` and + `CLI_SAST_LANGUAGE_NAMES` from the local profile, and the `TaintFlow` + interface. All three had zero consumers anywhere — found by this + repository's own audit after the graph resolver learned to see + workspace-package imports, which cleared the ten false "unused export" + findings and left these three real ones. + ## 0.2.61 — 2026-08-08 - **Two path-traversal findings on the hook-result writer are dismissed with diff --git a/packages/analyzer-engine/src/comment-slop.ts b/packages/analyzer-engine/src/comment-slop.ts index fbdd48b..6b3e605 100644 --- a/packages/analyzer-engine/src/comment-slop.ts +++ b/packages/analyzer-engine/src/comment-slop.ts @@ -142,7 +142,12 @@ const NARRATION_TAGS = [ patterns: [ /\bin a real (?:app|application|implementation|system|world)\b/i, /\bfor now,/i, - /\bplaceholder\b/i, + // The deferral SENSE only: "this is a placeholder", "placeholder for X", + // "placeholder until". A bare \bplaceholder\b also matched prose ABOUT + // placeholder machinery — this engine's own docs for its placeholder + // detector were reported as six comments describing unfinished work. + /\b(?:is|as|just|a)\s+placeholders?\b/i, + /\bplaceholders?\s+(?:for|until|value)\b/i, /\bmock(?:ed)? (?:data|implementation)\b/i, /\bimplement(?: this)? later\b/i, /\byou (?:would|should|may) want to\b/i, @@ -242,7 +247,10 @@ function opensSentence(lines: ClassifiedLine[], index: number): boolean { function narrationHit(lines: ClassifiedLine[], raw: string, index: number): NarrationHit | null { const line = lines[index] if (line.kind === 'code' || line.kind === 'blank') return null - const text = line.text + // Backtick code spans quote vocabulary; a term under discussion is not the + // narration the term describes. Without this, docs ABOUT the placeholder + // machinery matched the placeholder-deferral patterns. + const text = line.text.replace(/`[^`]*`/g, '') if (!text || DIRECTIVE.test(text)) return null const sentenceStart = opensSentence(lines, index) for (const family of NARRATION_TAGS) { diff --git a/packages/analyzer-engine/src/security/local-profile.ts b/packages/analyzer-engine/src/security/local-profile.ts index fe6344a..d7085d2 100644 --- a/packages/analyzer-engine/src/security/local-profile.ts +++ b/packages/analyzer-engine/src/security/local-profile.ts @@ -1,4 +1,3 @@ -import type { SastLanguage } from './lang' /** * What the CLI's local SAST pass is allowed to report. @@ -37,16 +36,6 @@ export const CLI_SAST_RULE_IDS: ReadonlySet = new Set([ 'sql-injection', ]) -/** Languages the CLI's zero-dependency parser covers. */ -export const CLI_SAST_LANGUAGES: ReadonlySet = new Set([ - 'javascript', - 'typescript', - 'tsx', -]) - -/** Display names of {@link CLI_SAST_LANGUAGES}, matching the indexer's labels. */ -export const CLI_SAST_LANGUAGE_NAMES: ReadonlySet = new Set(['TypeScript', 'JavaScript']) - /** * Classes the local pass STILL does not check, named so a receipt can say so. * diff --git a/packages/analyzer-engine/src/security/taint.ts b/packages/analyzer-engine/src/security/taint.ts index 3f4a1a2..3985c74 100644 --- a/packages/analyzer-engine/src/security/taint.ts +++ b/packages/analyzer-engine/src/security/taint.ts @@ -430,14 +430,6 @@ function evalOrigins(node: SyntaxNode, env: Env, depth = 0): Origins { // ---- function-level analysis ---------------------------------------------- -export interface TaintFlow { - sourceKind: string - sourceNode: SyntaxNode - interprocedural: boolean - /** Intermediate variable names the value passed through, in order. */ - via: string[] -} - /** Which param indexes of a function reach a sink (for the interprocedural hop). */ export interface FnSummary { name: string diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index f84cd92..8c728e8 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -5,6 +5,32 @@ checksums are published at =20.9.0", "repository": "https://github.com/CodeTruss/codetruss-cli", - "releaseUrl": "https://github.com/CodeTruss/codetruss-cli/releases/tag/v0.2.61", - "attestationCommand": "gh attestation verify codetruss-cli-0.2.61.tgz --repo CodeTruss/codetruss-cli" + "releaseUrl": "https://github.com/CodeTruss/codetruss-cli/releases/tag/v0.2.62", + "attestationCommand": "gh attestation verify codetruss-cli-0.2.62.tgz --repo CodeTruss/codetruss-cli" } diff --git a/public/downloads/codetruss-cli-latest.sbom.cdx.json b/public/downloads/codetruss-cli-latest.sbom.cdx.json index 4c17eea..49aad24 100644 --- a/public/downloads/codetruss-cli-latest.sbom.cdx.json +++ b/public/downloads/codetruss-cli-latest.sbom.cdx.json @@ -1,15 +1,15 @@ { "$schema": "https://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", - "serialNumber": "urn:uuid:0744463b-fb3a-5cbf-858b-8224ba9c5137", + "serialNumber": "urn:uuid:4db60289-e4d1-5336-82e9-d4493a35b1d1", "specVersion": "1.6", "version": 1, "metadata": { "component": { "type": "application", - "bom-ref": "pkg:npm/%40codetruss/cli@0.2.61", + "bom-ref": "pkg:npm/%40codetruss/cli@0.2.62", "name": "@codetruss/cli", - "version": "0.2.61", + "version": "0.2.62", "description": "Local-first scope, quality, and verification receipts for coding agents", "licenses": [ { @@ -18,7 +18,7 @@ } } ], - "purl": "pkg:npm/%40codetruss/cli@0.2.61" + "purl": "pkg:npm/%40codetruss/cli@0.2.62" }, "properties": [ { @@ -139,7 +139,7 @@ "dependsOn": [] }, { - "ref": "pkg:npm/%40codetruss/cli@0.2.61", + "ref": "pkg:npm/%40codetruss/cli@0.2.62", "dependsOn": [ "pkg:npm/%40codetruss/analyzer-engine@0.1.0", "pkg:npm/minimatch@10.2.6", diff --git a/public/downloads/codetruss-cli-latest.tgz b/public/downloads/codetruss-cli-latest.tgz index f701ea9..41d7a26 100644 Binary files a/public/downloads/codetruss-cli-latest.tgz and b/public/downloads/codetruss-cli-latest.tgz differ diff --git a/public/downloads/codetruss-cli-latest.tgz.sha256 b/public/downloads/codetruss-cli-latest.tgz.sha256 index 73e92fa..fd5296f 100644 --- a/public/downloads/codetruss-cli-latest.tgz.sha256 +++ b/public/downloads/codetruss-cli-latest.tgz.sha256 @@ -1 +1 @@ -b1d2f7c8f016cdade18ab67d9af68b82b1623546d1b221ed2727e5acf158aec6 codetruss-cli-latest.tgz +35ad8c84288014ced4a184e702480bd478310e9c990fe18498c0e1038388e8a9 codetruss-cli-latest.tgz diff --git a/release-reference.json b/release-reference.json index 5622d99..91a0d2b 100644 --- a/release-reference.json +++ b/release-reference.json @@ -1,8 +1,8 @@ { "schemaVersion": 1, - "version": "0.2.61", - "websiteArchive": "https://codetruss.com/downloads/codetruss-cli-0.2.61.tgz", - "archiveSha256": "b1d2f7c8f016cdade18ab67d9af68b82b1623546d1b221ed2727e5acf158aec6", - "sbomSha256": "78ec407ebdb13be8025f6cca778107faf6a1dc320ecf2a9bad67948cca1662b7", - "bundleSha256": "c135a12664418232c697430a96ab2d168bac4fb3c87159265f9ec1fc2d75ab38" + "version": "0.2.62", + "websiteArchive": "https://codetruss.com/downloads/codetruss-cli-0.2.62.tgz", + "archiveSha256": "35ad8c84288014ced4a184e702480bd478310e9c990fe18498c0e1038388e8a9", + "sbomSha256": "4d5b7fb2eeaf1a17bb9f9891161b098f5a6dffd53fa7650c30de045d7c456284", + "bundleSha256": "eedd132e3ed505ea00aa54b250e2c20caafd7fd30c438ae448fbee5e5ebfe52a" }