ai-saas-guard 0.26.0 → 0.26.1

package/README.md

@@ -76,9 +76,9 @@ The CLI is published on npm as `ai-saas-guard`, and the GitHub Action is availab
 | JSON and SARIF output | Available |
 | Composite GitHub Action | Available |
 | Project config | `.ai-saas-guard.json` rule toggles, severity overrides, and fail thresholds |
-| Versioned Action tags | `v0.26.0`, `v0` |
-| npm package | `ai-saas-guard@0.26.0` |
-| Current release | `0.26.0` launch-risk expansion |
+| Versioned Action tags | `v0.26.1`, `v0` |
+| npm package | `ai-saas-guard@0.26.1` |
+| Current release | `0.26.1` launch-risk expansion |
 | npm publishing | Trusted Publisher/OIDC, no long-lived publish token |
 | Repository trust hardening | Strict branch protection, Dependabot, CodeQL, fast-check fuzzing, signed release provenance assets, private vulnerability reporting, secret scanning, and push protection |
 | Runtime hardening | Per-file and total text scan caps, escaped markdown evidence, 1 MiB hosted webhook payload cap, stricter hosted deployment blockers |
@@ -299,7 +299,7 @@ Use `suppressions` for narrower false-positive handling when one rule is noisy o
 
 ## GitHub Action
 
-The repo includes a composite Action. Use `v0` for the latest compatible pre-1.0 Action, a specific release tag such as `v0.26.0` for controlled upgrades, or pin a reviewed commit SHA for stricter supply-chain control:
+The repo includes a composite Action. Use `v0` for the latest compatible pre-1.0 Action, a specific release tag such as `v0.26.1` for controlled upgrades, or pin a reviewed commit SHA for stricter supply-chain control:
 
 ```yaml
 name: ai-saas-guard

package/README.zh-CN.md

@@ -65,7 +65,7 @@ AI 能很快把一个 SaaS 从想法做成可运行的产品。真正难的是
 
 这个仓库是公开 GitHub 仓库。
 
-CLI 已发布到 npm：`ai-saas-guard@0.26.0`。GitHub Action 支持 `v0` 浮动标签，也支持固定版本标签，例如 `v0.26.0`。
+CLI 已发布到 npm：`ai-saas-guard@0.26.1`。GitHub Action 支持 `v0` 浮动标签，也支持固定版本标签，例如 `v0.26.1`。
 
 | 模块 | 状态 |
 | --- | --- |
@@ -76,8 +76,8 @@ CLI 已发布到 npm：`ai-saas-guard@0.26.0`。GitHub Action 支持 `v0` 浮动
 | Markdown PR summary | 已可用 |
 | GitHub Action | 已可用 |
 | 项目配置 | `.ai-saas-guard.json` 支持规则开关、severity 覆盖和 fail threshold |
-| 当前版本 | `0.26.0` launch-risk expansion |
-| Action 标签 | `v0.26.0`、`v0` |
+| 当前版本 | `0.26.1` launch-risk expansion |
+| Action 标签 | `v0.26.1`、`v0` |
 | npm 发布 | GitHub Actions Trusted Publisher/OIDC，无需长期 npm token |
 | 仓库可信度加固 | 严格 branch protection、Dependabot、CodeQL、fast-check fuzzing、signed release provenance assets、private vulnerability reporting、secret scanning 和 push protection |
 | 运行时加固 | 单文件和总扫描文本预算、markdown evidence 转义、1 MiB hosted webhook payload 上限、更严格的 hosted deployment 阻断 |

package/dist/hosted/app.js

@@ -261,7 +261,7 @@ function isValidSecretRef(value) {
     return /^secret:[A-Za-z0-9._:/@-]+$/.test(value);
 }
 function normalizePublicBaseUrl(publicBaseUrl) {
-    return publicBaseUrl.trim().replace(/\/+$/, "");
+    return trimTrailingSlashes(publicBaseUrl.trim());
 }
 function isSafePublicHttpsUrl(value) {
     try {
@@ -279,6 +279,13 @@ function isUnsafeHostedHostname(hostname) {
         isUnsafeIpv4Hostname(normalized) ||
         isUnsafeIpv6Hostname(normalized));
 }
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === "/") {
+        end -= 1;
+    }
+    return value.slice(0, end);
+}
 function normalizeHostname(hostname) {
     const lower = hostname.toLowerCase().replace(/\.$/, "");
     return lower.startsWith("[") && lower.endsWith("]") ? lower.slice(1, -1) : lower;

package/dist/hosted/contracts.js

@@ -1156,7 +1156,7 @@ function getHostedCheckRunFiles(report) {
     return [...new Set(report.evidence.map((finding) => finding.file))].slice(0, 10);
 }
 function escapeMarkdownTableCell(value) {
-    return value.replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
+    return value.replaceAll("\\", "\\\\").replaceAll("|", "\\|").replaceAll("\r", " ").replaceAll("\n", " ");
 }
 function capitalize(value) {
     return `${value.charAt(0).toUpperCase()}${value.slice(1)}`;

package/dist/hosted/production-adapters.js

@@ -190,7 +190,14 @@ function safeApiUrlBlockedReasons(apiBaseUrl) {
 }
 function normalizeApiBaseUrl(apiBaseUrl) {
     const value = apiBaseUrl?.trim() || "https://api.github.com";
-    return value.replace(/\/+$/, "");
+    return trimTrailingSlashes(value);
+}
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === "/") {
+        end -= 1;
+    }
+    return value.slice(0, end);
 }
 function permissionsForPurpose(purpose) {
     if (purpose === "worker_checkout") {

package/dist/scanners/gitDiff.js

@@ -166,12 +166,12 @@ function parseDiffFiles(diffText) {
     const files = [];
     let current;
     for (const line of diffText.split(/\r?\n/)) {
-        const fileMatch = /^diff --git a\/(.+?) b\/(.+)$/.exec(line);
-        if (fileMatch) {
+        const filePath = parseDiffHeaderPath(line);
+        if (filePath) {
             if (current)
                 files.push(finalizeDiffFile(current));
             current = {
-                path: fileMatch[2],
+                path: filePath,
                 score: 0,
                 categories: [],
                 added: 0,
@@ -192,6 +192,17 @@ function parseDiffFiles(diffText) {
         files.push(finalizeDiffFile(current));
     return files;
 }
+function parseDiffHeaderPath(line) {
+    const prefix = "diff --git a/";
+    if (!line.startsWith(prefix))
+        return undefined;
+    const separator = " b/";
+    const separatorIndex = line.lastIndexOf(separator);
+    if (separatorIndex === -1)
+        return undefined;
+    const path = line.slice(separatorIndex + separator.length);
+    return path || undefined;
+}
 function finalizeDiffFile(file) {
     const changedLines = file.lines
         .filter((line) => (line.startsWith("+") && !line.startsWith("+++")) || (line.startsWith("-") && !line.startsWith("---")))

package/docs/github-action.md

@@ -2,7 +2,7 @@
 
 `ai-saas-guard` ships as a composite GitHub Action for pull request and code scanning workflows.
 
-Use `zr9959/ai-saas-guard@v0` for the latest compatible pre-1.0 Action. Use a specific tag such as `v0.26.0` or a reviewed commit SHA when reproducibility is more important than automatic minor updates.
+Use `zr9959/ai-saas-guard@v0` for the latest compatible pre-1.0 Action. Use a specific tag such as `v0.26.1` or a reviewed commit SHA when reproducibility is more important than automatic minor updates.
 
 ## PR Summary
 

package/docs/npm-publishing.md

@@ -5,11 +5,11 @@
 ## Current State
 
 - Package name: `ai-saas-guard`
-- Current published version: `0.26.0`
+- Current published version: `0.26.1`
 - Next source candidate: none
 - npm registry state: published at <https://www.npmjs.com/package/ai-saas-guard>
 - First npm-published version: `0.1.1`
-- GitHub Release: `v0.26.0`
+- GitHub Release: `v0.26.1`
 - Publish workflow: `.github/workflows/npm-publish.yml`
 - Trusted Publisher: GitHub Actions, `zr9959/ai-saas-guard`, workflow `npm-publish.yml`, allowed action `npm publish`
 - Long-lived npm publish token: not required
@@ -18,7 +18,7 @@
 
 Use GitHub Actions with npm Trusted Publisher/OIDC:
 
-1. Create and review a release tag such as `v0.26.0`.
+1. Create and review a release tag such as `v0.26.1`.
 2. Publish from the GitHub Release or run the `Publish npm` workflow manually with `ref` set to that tag.
 3. Keep `permissions.id-token: write` in the workflow so npm can exchange the GitHub Actions OIDC identity for a short-lived publish credential.
 4. Run `npm publish --access public` from the workflow. Trusted publishing automatically generates provenance for this public package from this public repository.

package/docs/project-handoff.md

@@ -160,7 +160,7 @@ OpenSSF Best Practices:
 Publishing:
 
 - npm package: `ai-saas-guard`
-- Current published release line: `v0.26.0`
+- Current published release line: `v0.26.1`
 - Next source candidate: none
 - Publish workflow: `.github/workflows/npm-publish.yml`
 - Trusted Publisher: GitHub Actions for `zr9959/ai-saas-guard`, workflow `npm-publish.yml`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-saas-guard",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Repo-local launch-readiness scanner for AI-built SaaS apps.",
   "type": "module",
   "homepage": "https://github.com/zr9959/ai-saas-guard#readme",