aidevops 3.39.53 → 3.39.55

package/README.md

@@ -25,7 +25,7 @@ token efficiency, and quality control built in.**
 [![Maintainability](https://qlty.sh/gh/marcusquinn/projects/aidevops/maintainability.svg)](https://qlty.sh/gh/marcusquinn/projects/aidevops)
 [![Codacy Badge](https://app.codacy.com/project/badge/Grade/2b1adbd66c454dae92234341e801b984)](https://app.codacy.com/gh/marcusquinn/aidevops/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/Version-3.39.53-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.39.55-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 

package/VERSION

@@ -1 +1 @@
-3.39.53
+3.39.55

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.39.53
+# Version: 3.39.55
 
 set -euo pipefail
 
@@ -1760,8 +1760,55 @@ _main_check_version() {
 	return 0
 }
 
+# Verify advisory metadata only during an explicit full security assessment.
+_security_check_advisories() {
+	local advisories_dir="$HOME/.aidevops/advisories"
+	local dismissed_file="$advisories_dir/dismissed.txt"
+	local tls_helper="tls-trust-helper.sh"
+	local advisory_file adv_id line check status
+	local -a check_args=()
+	for advisory_file in "$advisories_dir"/*.advisory; do
+		[[ -f "$advisory_file" ]] || continue
+		adv_id="${advisory_file##*/}"
+		adv_id="${adv_id%.advisory}"
+		if [[ -f "$dismissed_file" ]] && grep -qxF -- "$adv_id" "$dismissed_file"; then
+			continue
+		fi
+		check=""
+		while IFS= read -r line || [[ -n "$line" ]]; do
+			if [[ "$line" == '# check: '* ]]; then
+				check="${line#\# check: }"
+				break
+			fi
+		done <"$advisory_file"
+		[[ -n "$check" ]] || continue
+		# Split literal whitespace only: no evaluation, expansion or shell quoting.
+		IFS=$' \t' read -r -a check_args <<<"$check"
+		# Allow only the checking subcommand, never help/probe-script (also exit 0).
+		if [[ "${check_args[0]:-}" != tls-trust || "${check_args[1]:-}" != local ]] ||
+			{ [[ ${#check_args[@]} -ne 2 ]] &&
+				! { [[ ${#check_args[@]} -eq 4 && "${check_args[2]:-}" == --canary && "${check_args[3]:-}" != -* ]]; }; }; then
+			printf 'Keeping %s: unsupported advisory check\n' "$adv_id"
+			continue
+		fi
+		status=0
+		_dispatch_helper "$tls_helper" "$tls_helper" "${check_args[@]:1}" || status=$?
+		if [[ "$status" -eq 0 ]]; then
+			if printf '%s\n' "$adv_id" >>"$dismissed_file"; then
+				printf 'auto-dismissed %s: verified clean\n' "$adv_id"
+			else
+				printf 'Keeping %s: could not record dismissal\n' "$adv_id" >&2
+			fi
+		else
+			printf 'Keeping %s: advisory check exited %s\n' "$adv_id" "$status"
+		fi
+	done
+	return 0
+}
+
 # Route 'aidevops security [subcommand]' to appropriate helpers
 _cmd_security() {
+	local tls_helper="tls-trust-helper.sh"
 	case "${1:-}" in
 	"")
 		# No args: run ALL security checks (posture + hygiene + advisories)
@@ -1774,6 +1821,9 @@ _cmd_security() {
 		_dispatch_helper "secret-hygiene-helper.sh" "secret-hygiene-helper.sh" scan || true
 		echo ""
 		_dispatch_helper "supply-chain-advisory-helper.sh" "supply-chain-advisory-helper.sh" scan || true
+		echo ""
+		_dispatch_helper "$tls_helper" "$tls_helper" local || true
+		_security_check_advisories
 		;;
 	scan | scan-secrets | scan-pth | scan-deps)
 		_dispatch_helper "secret-hygiene-helper.sh" "secret-hygiene-helper.sh" "$@"
@@ -1808,6 +1858,11 @@ _cmd_security() {
 		shift || true
 		_dispatch_helper "supply-chain-advisory-helper.sh" "supply-chain-advisory-helper.sh" "${@:-scan}"
 		;;
+	tls-trust)
+		shift || true
+		_dispatch_helper "$tls_helper" "$tls_helper" "${@:-local}"
+		return $?
+		;;
 	*)
 		_dispatch_helper "security-posture-helper.sh" "security-posture-helper.sh" "$@"
 		;;
@@ -2111,7 +2166,7 @@ _main_dispatch_cleanup() {
 		shift || true
 		_dispatch_helper "local-branch-cleanup-helper.sh" "local-branch-cleanup-helper.sh" "$@"
 		;;
-	report | status | all | tmp | worktrees | opencode | observability)
+	report | status | all | tmp | worktrees | artefacts | opencode | observability)
 		# GH#35245: storage stores route to their existing owning cleaners.
 		_dispatch_helper "$storage_helper" "$storage_helper" "$@"
 		return $?
@@ -2122,7 +2177,7 @@ _main_dispatch_cleanup() {
 		echo "Storage (dry-run unless --apply):"
 		echo "  (no args), report Sizes of aidevops-owned stores and their cleaners"
 		echo "  all [--apply]     Preview or clean every store"
-		echo "  tmp|worktrees|opencode|observability [--apply]  One store"
+		echo "  tmp|worktrees|artefacts|opencode|observability [--apply]  One store"
 		echo "  Daily automatic run: routine r922 Storage hygiene (installed by setup)"
 		echo ""
 		echo "Branches (dry-run unless --apply):"
@@ -2137,7 +2192,7 @@ _main_dispatch_cleanup() {
 		echo "  --apply           Delete safe candidates"
 		echo ""
 		;;
-	*) print_error "Unknown cleanup subcommand: $cleanup_subcommand (try report|all|tmp|worktrees|opencode|observability|branches|local-branches|help)"; return 1 ;;
+	*) print_error "Unknown cleanup subcommand: $cleanup_subcommand (try report|all|tmp|worktrees|artefacts|opencode|observability|branches|local-branches|help)"; return 1 ;;
 	esac
 	return 0
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.39.53",
+  "version": "3.39.55",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "packageManager": "bun@1.3.11",

package/setup.sh

@@ -17,7 +17,7 @@ fi
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.39.53
+# Version: 3.39.55
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)