Release CodeTruss CLI v0.2.62

CHANGELOG.md

@@ -3,7 +3,7 @@
 CodeTruss CLI follows semantic versioning. Release artifacts and their SHA-256
 checksums are published at <https://codetruss.com/downloads/codetruss-cli-latest.json>.
 
-The current public release is [v0.2.61 on GitHub](https://github.com/CodeTruss/codetruss-cli/releases/tag/v0.2.61),
+The current public release is [v0.2.62 on GitHub](https://github.com/CodeTruss/codetruss-cli/releases/tag/v0.2.62),
 distributed from <https://codetruss.com/downloads/codetruss-cli-latest.json>.
 npm publication is a separate, manually dispatched step, so the npm `latest`
 tag can trail the website and the GitHub release; the dispatch for this
@@ -13,6 +13,32 @@ were superseded before distribution.
 
 ## Unreleased
 
+## 0.2.62 — 2026-08-09
+
+- **The comment analyzer learned the difference between deferring with a
+  placeholder and documenting one.** A bare match on the word reported this
+  engine's own docs for its placeholder detector as six comments describing
+  unfinished work — the same self-reference failure the secrets scanner had
+  with its own examples, fixed the same way. Backtick code spans are stripped
+  before narration matching (a quoted term is vocabulary under discussion),
+  and the placeholder pattern now requires the deferral sense: "is a
+  placeholder", "placeholder for", "placeholder until".
+
+  Measured on six outside repositories before shipping: thirteen findings
+  moved, and each was read. Eleven were prose about placeholder machinery —
+  redaction engines, template resolvers, detection logic — reported as
+  unfinished work, which is precisely the false positive this closes. Two
+  were stub files literally titled "Placeholder … example" that no longer
+  report; that loss is accepted and recorded here rather than patched with a
+  pattern that would re-open the other eleven.
+
+- **Three dead exports are gone**: `CLI_SAST_LANGUAGES` and
+  `CLI_SAST_LANGUAGE_NAMES` from the local profile, and the `TaintFlow`
+  interface. All three had zero consumers anywhere — found by this
+  repository's own audit after the graph resolver learned to see
+  workspace-package imports, which cleared the ten false "unused export"
+  findings and left these three real ones.
+
 ## 0.2.61 — 2026-08-08
 
 - **Two path-traversal findings on the hook-result writer are dismissed with

packages/analyzer-engine/src/comment-slop.ts

@@ -142,7 +142,12 @@ const NARRATION_TAGS = [
     patterns: [
       /\bin a real (?:app|application|implementation|system|world)\b/i,
       /\bfor now,/i,
-      /\bplaceholder\b/i,
+      // The deferral SENSE only: "this is a placeholder", "placeholder for X",
+      // "placeholder until". A bare \bplaceholder\b also matched prose ABOUT
+      // placeholder machinery — this engine's own docs for its placeholder
+      // detector were reported as six comments describing unfinished work.
+      /\b(?:is|as|just|a)\s+placeholders?\b/i,
+      /\bplaceholders?\s+(?:for|until|value)\b/i,
       /\bmock(?:ed)? (?:data|implementation)\b/i,
       /\bimplement(?: this)? later\b/i,
       /\byou (?:would|should|may) want to\b/i,
@@ -242,7 +247,10 @@ function opensSentence(lines: ClassifiedLine[], index: number): boolean {
 function narrationHit(lines: ClassifiedLine[], raw: string, index: number): NarrationHit | null {
   const line = lines[index]
   if (line.kind === 'code' || line.kind === 'blank') return null
-  const text = line.text
+  // Backtick code spans quote vocabulary; a term under discussion is not the
+  // narration the term describes. Without this, docs ABOUT the placeholder
+  // machinery matched the placeholder-deferral patterns.
+  const text = line.text.replace(/`[^`]*`/g, '')
   if (!text || DIRECTIVE.test(text)) return null
   const sentenceStart = opensSentence(lines, index)
   for (const family of NARRATION_TAGS) {

packages/analyzer-engine/src/security/local-profile.ts

@@ -1,4 +1,3 @@
-import type { SastLanguage } from './lang'
 
 /**
  * What the CLI's local SAST pass is allowed to report.
@@ -37,16 +36,6 @@ export const CLI_SAST_RULE_IDS: ReadonlySet<string> = new Set([
   'sql-injection',
 ])
 
-/** Languages the CLI's zero-dependency parser covers. */
-export const CLI_SAST_LANGUAGES: ReadonlySet<SastLanguage> = new Set<SastLanguage>([
-  'javascript',
-  'typescript',
-  'tsx',
-])
-
-/** Display names of {@link CLI_SAST_LANGUAGES}, matching the indexer's labels. */
-export const CLI_SAST_LANGUAGE_NAMES: ReadonlySet<string> = new Set(['TypeScript', 'JavaScript'])
-
 /**
  * Classes the local pass STILL does not check, named so a receipt can say so.
  *

packages/analyzer-engine/src/security/taint.ts

@@ -430,14 +430,6 @@ function evalOrigins(node: SyntaxNode, env: Env, depth = 0): Origins {
 
 // ---- function-level analysis ----------------------------------------------
 
-export interface TaintFlow {
-  sourceKind: string
-  sourceNode: SyntaxNode
-  interprocedural: boolean
-  /** Intermediate variable names the value passed through, in order. */
-  via: string[]
-}
-
 /** Which param indexes of a function reach a sink (for the interprocedural hop). */
 export interface FnSummary {
   name: string

packages/cli/CHANGELOG.md

@@ -5,6 +5,32 @@ checksums are published at <https://codetruss.com/downloads/codetruss-cli-latest
 
 ## Unreleased
 
+## 0.2.62 — 2026-08-09
+
+- **The comment analyzer learned the difference between deferring with a
+  placeholder and documenting one.** A bare match on the word reported this
+  engine's own docs for its placeholder detector as six comments describing
+  unfinished work — the same self-reference failure the secrets scanner had
+  with its own examples, fixed the same way. Backtick code spans are stripped
+  before narration matching (a quoted term is vocabulary under discussion),
+  and the placeholder pattern now requires the deferral sense: "is a
+  placeholder", "placeholder for", "placeholder until".
+
+  Measured on six outside repositories before shipping: thirteen findings
+  moved, and each was read. Eleven were prose about placeholder machinery —
+  redaction engines, template resolvers, detection logic — reported as
+  unfinished work, which is precisely the false positive this closes. Two
+  were stub files literally titled "Placeholder … example" that no longer
+  report; that loss is accepted and recorded here rather than patched with a
+  pattern that would re-open the other eleven.
+
+- **Three dead exports are gone**: `CLI_SAST_LANGUAGES` and
+  `CLI_SAST_LANGUAGE_NAMES` from the local profile, and the `TaintFlow`
+  interface. All three had zero consumers anywhere — found by this
+  repository's own audit after the graph resolver learned to see
+  workspace-package imports, which cleared the ten false "unused export"
+  findings and left these three real ones.
+
 ## 0.2.61 — 2026-08-08
 
 - **Two path-traversal findings on the hook-result writer are dismissed with

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codetruss/cli",
-  "version": "0.2.61",
+  "version": "0.2.62",
   "description": "Local-first scope, quality, and verification receipts for coding agents",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

public/downloads/codetruss-cli-0.2.62.sbom.cdx.json

@@ -0,0 +1,170 @@
+{
+  "$schema": "https://cyclonedx.org/schema/bom-1.6.schema.json",
+  "bomFormat": "CycloneDX",
+  "serialNumber": "urn:uuid:4db60289-e4d1-5336-82e9-d4493a35b1d1",
+  "specVersion": "1.6",
+  "version": 1,
+  "metadata": {
+    "component": {
+      "type": "application",
+      "bom-ref": "pkg:npm/%40codetruss/cli@0.2.62",
+      "name": "@codetruss/cli",
+      "version": "0.2.62",
+      "description": "Local-first scope, quality, and verification receipts for coding agents",
+      "licenses": [
+        {
+          "license": {
+            "name": "CodeTruss CLI Proprietary License"
+          }
+        }
+      ],
+      "purl": "pkg:npm/%40codetruss/cli@0.2.62"
+    },
+    "properties": [
+      {
+        "name": "codetruss:distribution",
+        "value": "single-file JavaScript bundle"
+      },
+      {
+        "name": "codetruss:runtimeDependencies",
+        "value": "0"
+      }
+    ]
+  },
+  "components": [
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/%40codetruss/analyzer-engine@0.1.0",
+      "name": "@codetruss/analyzer-engine",
+      "version": "0.1.0",
+      "licenses": [
+        {
+          "license": {
+            "name": "CodeTruss CLI Proprietary License"
+          }
+        }
+      ],
+      "purl": "pkg:npm/%40codetruss/analyzer-engine@0.1.0",
+      "properties": [
+        {
+          "name": "codetruss:bundled",
+          "value": "true"
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/balanced-match@4.0.4",
+      "name": "balanced-match",
+      "version": "4.0.4",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "purl": "pkg:npm/balanced-match@4.0.4",
+      "properties": [
+        {
+          "name": "codetruss:bundled",
+          "value": "true"
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/brace-expansion@5.0.9",
+      "name": "brace-expansion",
+      "version": "5.0.9",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "purl": "pkg:npm/brace-expansion@5.0.9",
+      "properties": [
+        {
+          "name": "codetruss:bundled",
+          "value": "true"
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/minimatch@10.2.6",
+      "name": "minimatch",
+      "version": "10.2.6",
+      "licenses": [
+        {
+          "license": {
+            "id": "BlueOak-1.0.0"
+          }
+        }
+      ],
+      "purl": "pkg:npm/minimatch@10.2.6",
+      "properties": [
+        {
+          "name": "codetruss:bundled",
+          "value": "true"
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/yaml@2.9.0",
+      "name": "yaml",
+      "version": "2.9.0",
+      "licenses": [
+        {
+          "license": {
+            "id": "ISC"
+          }
+        }
+      ],
+      "purl": "pkg:npm/yaml@2.9.0",
+      "properties": [
+        {
+          "name": "codetruss:bundled",
+          "value": "true"
+        }
+      ]
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pkg:npm/%40codetruss/analyzer-engine@0.1.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:npm/%40codetruss/cli@0.2.62",
+      "dependsOn": [
+        "pkg:npm/%40codetruss/analyzer-engine@0.1.0",
+        "pkg:npm/minimatch@10.2.6",
+        "pkg:npm/yaml@2.9.0"
+      ]
+    },
+    {
+      "ref": "pkg:npm/balanced-match@4.0.4",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:npm/brace-expansion@5.0.9",
+      "dependsOn": [
+        "pkg:npm/balanced-match@4.0.4"
+      ]
+    },
+    {
+      "ref": "pkg:npm/minimatch@10.2.6",
+      "dependsOn": [
+        "pkg:npm/brace-expansion@5.0.9"
+      ]
+    },
+    {
+      "ref": "pkg:npm/yaml@2.9.0",
+      "dependsOn": []
+    }
+  ]
+}

public/downloads/codetruss-cli-0.2.62.tgz.sha256

@@ -0,0 +1 @@
+35ad8c84288014ced4a184e702480bd478310e9c990fe18498c0e1038388e8a9  codetruss-cli-0.2.62.tgz

public/downloads/codetruss-cli-latest.json

@@ -1,13 +1,13 @@
 {
   "name": "@codetruss/cli",
-  "version": "0.2.61",
-  "url": "/downloads/codetruss-cli-0.2.61.tgz",
+  "version": "0.2.62",
+  "url": "/downloads/codetruss-cli-0.2.62.tgz",
   "latestUrl": "/downloads/codetruss-cli-latest.tgz",
-  "sha256": "b1d2f7c8f016cdade18ab67d9af68b82b1623546d1b221ed2727e5acf158aec6",
-  "sbomUrl": "/downloads/codetruss-cli-0.2.61.sbom.cdx.json",
-  "sbomSha256": "78ec407ebdb13be8025f6cca778107faf6a1dc320ecf2a9bad67948cca1662b7",
+  "sha256": "35ad8c84288014ced4a184e702480bd478310e9c990fe18498c0e1038388e8a9",
+  "sbomUrl": "/downloads/codetruss-cli-0.2.62.sbom.cdx.json",
+  "sbomSha256": "4d5b7fb2eeaf1a17bb9f9891161b098f5a6dffd53fa7650c30de045d7c456284",
   "node": ">=20.9.0",
   "repository": "https://github.com/CodeTruss/codetruss-cli",
-  "releaseUrl": "https://github.com/CodeTruss/codetruss-cli/releases/tag/v0.2.61",
-  "attestationCommand": "gh attestation verify codetruss-cli-0.2.61.tgz --repo CodeTruss/codetruss-cli"
+  "releaseUrl": "https://github.com/CodeTruss/codetruss-cli/releases/tag/v0.2.62",
+  "attestationCommand": "gh attestation verify codetruss-cli-0.2.62.tgz --repo CodeTruss/codetruss-cli"
 }

public/downloads/codetruss-cli-latest.sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "$schema": "https://cyclonedx.org/schema/bom-1.6.schema.json",
   "bomFormat": "CycloneDX",
-  "serialNumber": "urn:uuid:0744463b-fb3a-5cbf-858b-8224ba9c5137",
+  "serialNumber": "urn:uuid:4db60289-e4d1-5336-82e9-d4493a35b1d1",
   "specVersion": "1.6",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/%40codetruss/cli@0.2.61",
+      "bom-ref": "pkg:npm/%40codetruss/cli@0.2.62",
       "name": "@codetruss/cli",
-      "version": "0.2.61",
+      "version": "0.2.62",
       "description": "Local-first scope, quality, and verification receipts for coding agents",
       "licenses": [
         {
@@ -18,7 +18,7 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40codetruss/cli@0.2.61"
+      "purl": "pkg:npm/%40codetruss/cli@0.2.62"
     },
     "properties": [
       {
@@ -139,7 +139,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40codetruss/cli@0.2.61",
+      "ref": "pkg:npm/%40codetruss/cli@0.2.62",
       "dependsOn": [
         "pkg:npm/%40codetruss/analyzer-engine@0.1.0",
         "pkg:npm/minimatch@10.2.6",

public/downloads/codetruss-cli-latest.tgz.sha256

@@ -1 +1 @@
-b1d2f7c8f016cdade18ab67d9af68b82b1623546d1b221ed2727e5acf158aec6  codetruss-cli-latest.tgz
+35ad8c84288014ced4a184e702480bd478310e9c990fe18498c0e1038388e8a9  codetruss-cli-latest.tgz

release-reference.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
-  "version": "0.2.61",
-  "websiteArchive": "https://codetruss.com/downloads/codetruss-cli-0.2.61.tgz",
-  "archiveSha256": "b1d2f7c8f016cdade18ab67d9af68b82b1623546d1b221ed2727e5acf158aec6",
-  "sbomSha256": "78ec407ebdb13be8025f6cca778107faf6a1dc320ecf2a9bad67948cca1662b7",
-  "bundleSha256": "c135a12664418232c697430a96ab2d168bac4fb3c87159265f9ec1fc2d75ab38"
+  "version": "0.2.62",
+  "websiteArchive": "https://codetruss.com/downloads/codetruss-cli-0.2.62.tgz",
+  "archiveSha256": "35ad8c84288014ced4a184e702480bd478310e9c990fe18498c0e1038388e8a9",
+  "sbomSha256": "4d5b7fb2eeaf1a17bb9f9891161b098f5a6dffd53fa7650c30de045d7c456284",
+  "bundleSha256": "eedd132e3ed505ea00aa54b250e2c20caafd7fd30c438ae448fbee5e5ebfe52a"
 }