@blamejs/exceptd-skills 0.19.33 → 0.19.35

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.19.35 — 2026-08-25
+
+A scan that could not read something no longer reports that it found nothing there. The evidence collectors treated an unreadable file the same as an absent one: a credential store over the size cap, a workflow file without read permission, a lockfile that failed to parse all produced the output of a clean scan. A credential store that exists but went unread now reports its indicator as inconclusive rather than a miss, and its artifact as uncaptured with the reason attached. An unparseable Google Cloud credentials file reports the same way, since a parse that failed says nothing about what the file holds. A file read successfully but empty stays a completed scan, because the collector did read it and there was nothing in it — the two cases were previously indistinguishable, and both read as clean.
+
+The same failure closed in the pipeline collector, where it ran deeper. A workflow file too large or unreadable was skipped in silence, and every indicator it would have flipped stayed at miss. Read, parse and directory-walk failures now travel to the operator as warnings — but a warning changes no verdict on its own, so the gap reaches the indicators too: where the workflow or trust-policy inventory is incomplete, the indicators drawn from it report inconclusive rather than a clean miss, the inventory is marked uncaptured, and the readability precondition no longer attests a file the collector could not open. A repository whose one vulnerable workflow was the file that could not be read was previously reported clean.
+
+Release workflows that resolve dependencies at build time are detected for pip, pnpm and Bundler alongside npm and cargo, so a Python or Ruby publisher no longer reads as clean. Each install command is judged on its own flags: a hash-pinned install no longer vouches for an unpinned one elsewhere in the same file, and commands chained on one line or split across lines with a trailing backslash are read as the commands they are. The requirement file is recognised whether it is attached to the short option or separated from it, and an install is not reported when the file it names is itself hash-pinned, since one hashed requirement puts pip into hash-checking mode for all of them. A bare `pnpm install` is no longer reported, because pnpm enforces the frozen lockfile whenever CI is set; only an explicit opt-out is. Bundler's job-wide frozen setting suppresses the finding only when it is switched on — `bundle config set frozen false` named the setting and disabled it, and was read as though it enabled it. A requirement file is resolved against the job's working directory as well as the repository root, so a hash-pinned file in a subdirectory is no longer reported as unpinned; where copies resolve in several directories, every one of them has to be pinned. Findings point at the line their command starts on.
+
+Capping an upstream-catalog refresh now bounds every source. The RFC index, ATLAS and ICS-ATT&CK commands accepted the cap and discarded it, so a run asked to import a bounded batch imported the whole upstream index — and the RFC index is an order of magnitude larger than any other source the refresh reads. The cap bounds new additions only; context fields on rows already curated are still completed. The ICS-ATT&CK refresh also stops importing a cross-listed enterprise technique it cannot assign an ICS tactic to. Those rows arrived with an empty tactic and were counted as missing context by the next audit, so the import spent the gap budget on itself; they are skipped now, and the run reports how many and which.
+
+A mistyped flag on the upstream freshness probe is refused with a non-zero exit instead of being ignored. A misspelled air-gap flag previously left the check running as though nothing had been passed, so a run believed to be offline reached the network.
+
+Diagnostics no longer disappear when output is piped. The catalog validator's enum-mismatch and entry-count-drift messages and the skill linter's help and unknown-argument text were written to a stream the process could exit before draining, which a terminal hid and a CI log collector did not.
+
+A malformed analyze result no longer aborts the closing phase. The evidence bundle, notification deadlines, exception language and downstream chaining are still produced, and the shape problem is reported alongside them naming the part of the result that was wrong. That holds for a single unusable entry among good ones as well as for a malformed result overall: the unusable entries are dropped and counted, the rest still reach the advisory. Catalog scoring validation likewise reports a null or non-object entry and continues through the rest of the catalog rather than stopping at the first one, and asking for the documented gaps behind an attack pattern without supplying a gap catalog returns the same answer an empty one gives instead of raising.
+
+The manifest snapshot gate reports where it used to crash or wave through. A baseline written before a surface field existed ended the run with a stack trace on precisely the case the gate exists to report; it is now recorded as an additive change. A corrupt value where a list belongs stops the gate with the skill and field named, rather than reporting that skill's entire surface as newly added and passing.
+
+## 0.19.34 — 2026-08-23
+
+Comment volume across the shipped JavaScript falls from 16,627 lines to 5,585, against 36,875 lines of code that are byte-for-byte unchanged. What went is the reasoning that produced a line rather than the constraint on it: pull-request references, version histories, "this used to", and module docblocks that toured a file's exports above the exports themselves. What stayed is what the code cannot say for itself — units and nullability on an exported function, the specification clause an emitter satisfies, the trap whose deletion invites a specific dangerous edit, and the cross-file coupling no grep will surface.
+
+Some of it described behavior the code does not have, and those comments are deleted rather than reworded. `readCached` in the prefetch module documented its `source` argument as one of `kev`, `nvd`, `epss`, `ietf` or `github`, where the registry defines `kev`, `nvd`, `epss`, `rfc` and `pins` — a caller following the documentation would ask for two keys that cannot exist and never learn of two that do. The kernel collector claimed a cross-check against `uname -s` that it does not run. A discovery function documented its spill counter under a field name that has never existed.
+
+The technique-reference gate no longer carries an allowlist. Its one entry excused a placeholder identifier inside a comment describing the extraction pattern; that comment is gone, so the exemption is too, and the next placeholder has to be declared rather than inherited.
+
+The diff-coverage gate no longer reads a command-line flag out of wrapped prose. It scans a file whole, so a comment that broke `--attest-ownership` across a line contributed `--attest-` as a flag in its own right; deleting that comment then registered as removing surface a test still covered. A token ending in a hyphen stopped mid-name and is never a flag, and is now excluded.
+
 ## 0.19.33 — 2026-08-23
 
 The catalog reaches 1,417 CVEs with 94 additions from CISA KEV, weighted to the years the vendors in question were shipping fastest: 25 from 2017, 18 from 2018, 11 from 2015, and ten each from 2016 and 2019. Cisco accounts for 38, Microsoft 28 and Adobe 12. Sixteen carry CISA's ransomware designation, 42 have an obtainable public exploit, and 61 need a restart before the fix is running — the entries keep that separate from the update being installed, because a remediation record keyed to the deployed version reports a host as done while the pre-patch code is still executing.