penthera 1.8.0 → 1.8.1

package/CHANGELOG.md

@@ -4,6 +4,75 @@ All notable changes to Penthera are documented here. Versioning follows [SemVer]
 
 ## [Unreleased]
 
+## [1.8.1] - 2026-10-22
+
+A fixes-only release. Runtime advisories are more careful: pre-release builds
+are never reported as having the fix, a banner without a distribution token is
+at most `potential`, release lines older than a flaw are not reported as
+affected, and two more banner formats are read. `penthera ui` now stops
+cleanly under `npx`.
+
+### Fixed
+
+- Runtime advisories no longer claim `likely` for a banner that may be a
+  patched distribution package. Debian 11 to 13, Ubuntu 24.04 and later, and
+  RHEL print plain upstream PHP versions, so a patched Ubuntu 24.04
+  `X-Powered-By: PHP/8.3.6` behind nginx or a CDN was reported as critical
+  and likely affected. For PHP, Apache httpd, nginx, Python and OpenSSL,
+  "affected" and "end of life" findings from a banner with no distribution
+  token are now `potential`, with a "check on server" note and the check
+  command. Severity is unchanged. Official images and version files are
+  upstream builds and stay `likely`. Found by the runtime-strings test set
+  (L1 in [#97](https://github.com/danoszz/penthera/pull/97)).
+
+- Runtime advisories resolve Node.js LTS codenames to their release line:
+  nvm's `lts/iron` in `.nvmrc` and the node image's `iron`, `jod-alpine`
+  and `hydrogen` tags. They read as no version before, so `lts/iron` (Node.js
+  20, end of life 30 April 2026) went unreported. Found by the
+  runtime-strings test set (B4 in
+  [#97](https://github.com/danoszz/penthera/pull/97)).
+- Runtime advisories read aiohttp's `Server: Python/3.9 aiohttp/3.8.6`.
+  aiohttp prints only the Python release line, and the banner pattern needed
+  x.y.z, so an end-of-life Python behind aiohttp went unreported. Found by
+  the runtime-strings test set (B3 in
+  [#97](https://github.com/danoszz/penthera/pull/97)).
+- Runtime advisories honour `introduced` on older release lines. CVE-2021-41773
+  and CVE-2021-42013 exist only in httpd 2.4.49 and 2.4.50. Yet
+  `Apache/2.2.34` and `httpd:2.2` were reported critical, "end of life, no
+  fix", and CentOS 6's `Apache/2.2.15 (CentOS)` was "check on server". A line
+  older than the one the flaw was introduced on now gets no verdict for it.
+  The end-of-life finding stays. Found by the runtime-strings test set (B1 in
+  [#97](https://github.com/danoszz/penthera/pull/97)).
+- Runtime advisories read pre-releases correctly. `PHP/8.4.27-dev`, a PHP-8.4
+  branch build from before 8.4.27, was taken for a distribution build of
+  8.4.27 and reported as having the 21 October fix. Now `-dev`, alpha, beta
+  and RC builds (`8.5.0RC1`, `3.15.0rc1`, `4.1.0-beta2`, `php:8.6.0RC4-fpm`)
+  sort below their release, so a pre-release of the fixed version is
+  affected. A pre-release of the version after the fix (`8.4.28-dev`) is
+  "check on server", never "has the fix". Found by the runtime-strings test set
+  (B2 in [#97](https://github.com/danoszz/penthera/pull/97)).
+- **`npx penthera ui` stops cleanly on Ctrl-C and SIGTERM.** npm forwards
+  the signal to penthera right after the terminal delivered it, and the
+  second copy could kill the dashboard before it printed "Stopped." and
+  closed its server. Repeated signals are now ignored while it stops. This
+  was the intermittent macOS failure in the install-matrix smoke check.
+
+### Site
+
+- penthera.org counts anonymous page views and load times with Vercel Web
+  Analytics and Speed Insights (cookieless, served from the same origin). The
+  CSP now allows connections only to those two paths on penthera.org; the
+  browser check still sends nothing, and the page says so. The CLI, the
+  dashboard and the npm package have no telemetry, unchanged.
+
+### Docs
+
+- The PHP case study and `docs/runtime-advisories.md` cite OpenAI's
+  php2shell-checker as an independent cross-check. A test pins that Penthera
+  agrees with its table on all 14 PHP branches.
+- The website is live at [penthera.org](https://penthera.org): the README links
+  it, and the npm package's homepage points to it from the next release.
+
 ## [1.8.0] - 2026-10-21
 
 1.8.0 is 1.8.0-rc.1 plus the changes below; there was no separate rc.2

package/README.md

@@ -8,6 +8,8 @@
 
 The security review you never had time for. Offline, rule-based, and you can verify every finding yourself.
 
+**[penthera.org](https://penthera.org)**: try the check in your browser. Nothing you paste leaves the page.
+
 <br/>
 
 [![npm](https://img.shields.io/npm/v/penthera?color=0000ed)](https://www.npmjs.com/package/penthera)
@@ -265,8 +267,8 @@ What changed, what we are measuring, and what comes next, in one place.
 
 | | Where it stands | Read more |
 |---|---|---|
-| **Latest release** | 1.8.0 (2026-10-21): runtime advisories starting with PHP's critical release, fixes from a second security review, a fix loop that cannot edit its own tests, the redesigned dashboard | [CHANGELOG](CHANGELOG.md) |
-| **On main, unreleased** | Whatever lands after 1.8.0 | [Unreleased](CHANGELOG.md#unreleased) |
+| **Latest release** | 1.8.1 (2026-10-22): more careful runtime advisories (pre-releases, distribution builds, older lines) on top of 1.8.0's runtime advisories, security-review fixes and redesigned dashboard | [CHANGELOG](CHANGELOG.md) |
+| **On main, unreleased** | Toward 1.9: AI mode (opt-in, local model, rules verify), new detection rules, the E10 benchmark | [Unreleased](CHANGELOG.md#unreleased) |
 | **Now** | Toward 1.9: accuracy on real code (E1) and an MCP server, so coding agents can call Penthera | [Roadmap](ROADMAP.md#next) |
 | **Research** | E1, accuracy on real code, is pre-registered; the benchmark tooling is in review. After the 2026 agent incidents: a checklist for running agents safely and a draft experiment (E8) | [E1 pre-registration](docs/research/prereg/E1-real-world-accuracy.md), [agents safely](docs/agents-safely.md), [what the incidents mean](docs/research/agent-incidents-2026.md) |
 | **Next** | Real-world precision and recall with intervals, published whatever the result | [Roadmap: next](ROADMAP.md#next), [research plan](docs/vision-2.0.md) |

package/lib/advisories/evidence.js

@@ -15,6 +15,8 @@
  *            "present" the product is in use, the version is not visible
  *   where    the header, cookie or file it came from
  *   raw      the text it was read from (a header value, a line), for the report
+ *   banner   true for black-box evidence (a header), which may come from a
+ *            distribution package even without a distribution token
  *
  * Nothing here decides whether anything is vulnerable; that is index.js.
  */
@@ -27,6 +29,7 @@ const clip = (s, n = 200) => (s.length > n ? `${s.slice(0, n)}…` : s);
 
 function kindOf(product, v, distro) {
   if (!v) return "present";
+  // A pre-release is an upstream build, not a distribution one.
   if (v.patch !== null) return distro || v.suffix ? "distro" : "exact";
   // "php:8" spans release lines; "php:8.3" and "node:20" name one.
   return PRODUCTS[product].branchOf(v) ? "branch" : "present";
@@ -55,7 +58,7 @@ export function evidenceFromResponse(fp = {}, more = {}) {
       if (m) {
         const v = parseVersion(m[1]);
         if (v) {
-          out.push({ product: id, version: v, kind: kindOf(id, v, distro), where: `${name} header`, raw: clip(`${name}: ${value}`) });
+          out.push({ product: id, version: v, kind: kindOf(id, v, distro), where: `${name} header`, raw: clip(`${name}: ${value}`), banner: true });
           found = true;
           continue;
         }
@@ -135,6 +138,12 @@ function walk(dir, depth, files) {
   }
 }
 
+/** The release line a codename stands for (`lts/iron`, `iron` → "20"), or null. */
+function aliasLine(product, value) {
+  const name = value.toLowerCase().replace(/^lts\//, "");
+  return Object.hasOwn(PRODUCTS[product].lineAliases || {}, name) ? PRODUCTS[product].lineAliases[name] : null;
+}
+
 const imageProduct = new Map(Object.entries(PRODUCTS).flatMap(([id, p]) => p.dockerImages.map((img) => [img, id])));
 
 /**
@@ -151,8 +160,11 @@ export function parseImageRef(ref) {
   const path = repo.toLowerCase().replace(/^(?:docker\.io\/)?(?:library\/)?/, "");
   const product = imageProduct.get(path);
   if (!product) return null;
-  const m = /^(\d+(?:\.\d+){0,2})(?:$|-)/.exec(tag);
-  const v = m ? parseVersion(m[1]) : null;
+  // `8.6.0RC4-fpm` and `3.15.0rc1-slim` are pre-release images; `iron` and
+  // `jod-alpine` are Node.js LTS codenames.
+  const m = /^(\d+(?:\.\d+){0,2}(?:(?:RC|rc|a|b)\d+)?)(?:$|-)/.exec(tag);
+  const alias = m ? null : aliasLine(product, tag.split("-")[0]);
+  const v = m ? parseVersion(m[1]) : alias ? parseVersion(alias) : null;
   return { product, version: v, kind: kindOf(product, v, false), tag: tag || "latest" };
 }
 
@@ -179,7 +191,7 @@ function fromCompose(text, where) {
 }
 
 function versionLine(product, value, where, raw) {
-  const v = parseVersion(value);
+  const v = parseVersion(aliasLine(product, value) ?? value);
   return { product, version: v, kind: kindOf(product, v, false), where, raw: clip(raw) };
 }
 

package/lib/advisories/index.js

@@ -17,14 +17,17 @@
  *
  * A distro build (8.1.2-1ubuntu2.19, or any version behind a Server header
  * that names a distribution) is never "affected": distributions backport fixes
- * without changing the upstream number. An advisory with a `condition` (an OS,
+ * without changing the upstream number. A banner with no distribution token
+ * for a product distributions backport (PHP/8.3.6 from Ubuntu 24.04 looks
+ * exactly like upstream 8.3.6) gives at most `potential`, with a note to check
+ * on the server; a pinned image or version file is upstream and stays `likely`. An advisory with a `condition` (an OS,
  * a SAPI, a module) gives at most `potential`, since neither a banner nor a pin
  * shows the condition. Matching uses only the pack's data and dates, never the
  * scan's clock, so the same input and packs give the same findings.
  */
 import { rulesOf } from "../rules/index.js";
 import { PRODUCTS } from "./products.js";
-import { compareVersions, compareBranches } from "./versions.js";
+import { parseVersion, compareVersions, compareBranches } from "./versions.js";
 import { evidenceFromResponse, evidenceFromRepo } from "./evidence.js";
 
 export { evidenceFromResponse, evidenceFromRepo };
@@ -76,9 +79,13 @@ export function verdictFor(adv, ev, eol) {
   const fix = branch ? adv.fixed.find((f) => f.branch === branch) : null;
   const newest = adv.fixed.map((f) => f.branch).sort(compareBranches).at(-1);
   const newerLine = branch && !fix && newest && compareBranches(branch, newest) > 0;
+  // The flaw came in on the oldest listed line (`introduced`), so a line older
+  // than that one never had it: httpd 2.2 and CVE-2021-41773 (2.4.49 only).
+  const oldest = adv.fixed.reduce((a, f) => (!a || compareBranches(f.branch, a.branch) < 0 ? f : a), null);
+  const olderLine = branch && !fix && oldest?.introduced && compareBranches(branch, oldest.branch) < 0;
 
   if (ev.kind === "present") return { verdict: "check", why: "the version is not visible" };
-  if (newerLine) return { verdict: "none" };
+  if (newerLine || olderLine) return { verdict: "none" };
 
   if (ev.kind === "branch") {
     if (!fix && eol) return { verdict: "unsupported", why: `release line ${branch} is end of life` };
@@ -88,6 +95,15 @@ export function verdictFor(adv, ev, eol) {
   // exact or distro: the upstream version is known.
   if (fix) {
     if (fix.introduced && compareVersions(ev.version, fix.introduced) < 0) return { verdict: "none" };
+    // A pre-release of the version after the fix may predate the fix: PHP-8.4
+    // says 8.4.28-dev from 8.4.27's RC until well after its release, while the
+    // fix is merged only at release. Two patches on, it is in. (A pre-release
+    // of the fixed version sorts below it and is affected.)
+    if (ev.version.pre && compareVersions(ev.version, fix.version) >= 0) {
+      const f = parseVersion(fix.version);
+      const safe = !f.letters && compareVersions(ev.version.upstream, `${f.major}.${f.minor}.${f.patch + 2}`) >= 0;
+      if (!safe) return { verdict: "check", fix, why: `it is a pre-release build (${ev.version.raw}), which may predate the fix` };
+    }
     if (compareVersions(ev.version, fix.version) >= 0) return { verdict: "patched", fix };
     if (ev.kind === "distro") return { verdict: "check", fix, why: "it is a distribution build, which may carry the fix as a backport under the same upstream version" };
     return { verdict: "affected", fix };
@@ -97,6 +113,14 @@ export function verdictFor(adv, ev, eol) {
   return { verdict: "check", why: `the advisory lists no fix for release line ${branch}` };
 }
 
+// An exact version from a banner with no distribution token, for a product
+// distributions backport: it may be a patched package under the same number.
+const unmarked = (ev, p) => ev.kind === "exact" && ev.banner === true && p.backports;
+
+function unmarkedNote(p, label) {
+  return `Check on server: your distribution may have patched this under the same version number. The banner names no distribution, and Debian 11 to 13, Ubuntu 24.04 and later, and RHEL print plain upstream version numbers, so ${label} may be a distribution package. Run \`${p.checkCommand}\` on the server and ask the package manager which package provides it (\`dpkg -S\` or \`rpm -qf\` on the binary). For a package, look the CVE up in your distribution's security tracker.`;
+}
+
 function evidenceText(ev) {
   return ev.raws.map((r) => `- ${r}`).join("\n");
 }
@@ -122,6 +146,7 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
     const checks = [];
     const patched = [];
     const start = findings.length;
+    const note = unmarked(ev, p) ? unmarkedNote(p, label) : "";
 
     for (const adv of advisories.filter((a) => a.product === ev.product).sort(bySeverity)) {
       const v = verdictFor(adv, ev, eol);
@@ -129,12 +154,13 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
         findings.push({
           ...base,
           severity: adv.severity,
-          confidence: adv.condition ? "potential" : "likely",
+          confidence: adv.condition || note ? "potential" : "likely",
           title: `${label} is affected by ${adv.title}`,
           description: [
             `${label} (seen in ${ev.wheres.join(", ")}) is below ${v.fix.version}, the first fixed version on the ${v.fix.branch} line, for ${advLine(adv)}.`,
             adv.kev ? `CISA lists it as exploited in the wild (Known Exploited Vulnerabilities catalog, added ${adv.kev}).` : "",
             adv.condition ? `It only applies when: ${adv.condition}. A version alone cannot show that, so confirm it on the server.` : "",
+            note,
             adv.description || "",
             `Evidence:\n${evidenceText(ev)}`,
           ].filter(Boolean).join("\n\n"),
@@ -150,8 +176,9 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
           title: `${label} is on an end-of-life line with no fix for ${adv.title}`,
           description: [
             `${label} (seen in ${ev.wheres.join(", ")}) is on release line ${branch}, which ${p.name} stopped supporting on ${eol.eol} (${eol.rule.source}). The advisory ${advLine(adv)} lists fixes only for ${adv.fixed.map((f) => f.branch).join(", ")}, so this line gets none. Whether the flaw exists on ${branch} is not stated; treat it as affected.`,
+            note,
             `Evidence:\n${evidenceText(ev)}`,
-          ].join("\n\n"),
+          ].filter(Boolean).join("\n\n"),
           remediation: `Move to a supported ${p.name} line (${adv.fixed.map((f) => `${f.branch}: ${f.version}+`).join(", ")}).`,
           cves: adv.cves,
           rule: adv.id,
@@ -186,13 +213,14 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
       findings.push({
         ...base,
         severity: distro ? "medium" : "high",
-        confidence: distro ? "needs-human-review" : "likely",
+        confidence: distro ? "needs-human-review" : note ? "potential" : "likely",
         title: distro
           ? `${label} is a distribution build of an end-of-life ${p.name} line`
           : `${label} is end of life: no more security fixes`,
         description: [
           `${p.name} ${branch} reached end of support on ${eol.eol} (${eol.rule.source}). Upstream publishes no security fixes for it, including for future advisories.`,
           distro ? "This is a distribution build, and some distributions keep patching a line after upstream stops. Check your distribution's support period for this package." : "",
+          note,
           `Evidence:\n${evidenceText(ev)}`,
         ].filter(Boolean).join("\n\n"),
         remediation: `Upgrade to a supported ${p.name} release line.`,
@@ -205,7 +233,7 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
       findings.push({
         ...base,
         severity: "info",
-        confidence: ev.kind === "exact" ? "likely" : "potential",
+        confidence: ev.kind === "exact" && !ev.version.pre ? "likely" : "potential",
         title: `${label} has the fix for ${patched.length === 1 ? patched[0].title : `${patched.length} known advisories`} (as advertised)`,
         description: [
           `The version ${ev.kind === "distro" ? "string" : "banner or pin"} is at or above the fixed version for: ${patched.map((a) => ids(a)).join(", ")}. This is what ${ev.wheres.join(", ")} says; a proxy or a stale banner can differ from what runs.`,

package/lib/advisories/products.js

@@ -1,6 +1,9 @@
 /**
  * The runtimes and servers runtime advisories can name, and how to recognize
- * each one. Detection is code; which versions are affected is data, in signed
+ * each one. `backports`: distributions commonly ship it with security fixes
+ * backported under the upstream number, so a banner with no distribution
+ * token may still be a patched package (Debian 11-13, Ubuntu 24.04+ and RHEL
+ * print plain PHP versions; Debian's and RHEL's nginx add no OS token). Detection is code; which versions are affected is data, in signed
  * rule packs (kind `runtime-advisory`, see lib/rules/pack.js).
  */
 
@@ -12,6 +15,7 @@ export const PRODUCTS = Object.freeze({
   php: {
     branchOf: minorLine,
     name: "PHP",
+    backports: true,
     // On the server itself, the version and any distro build string.
     checkCommand: "php -v",
     banner: /\bPHP\/(\d+\.\d+(?:\.\d+)?[^\s,;()]*)/i,
@@ -24,6 +28,7 @@ export const PRODUCTS = Object.freeze({
   "apache-httpd": {
     branchOf: minorLine,
     name: "Apache HTTP Server",
+    backports: true,
     checkCommand: "httpd -v (or apache2 -v)",
     banner: /\bApache\/(\d+\.\d+\.\d+[^\s,;()]*)/,
     // not Apache-Coyote (Tomcat) or Apache-HttpClient
@@ -35,6 +40,7 @@ export const PRODUCTS = Object.freeze({
   nginx: {
     branchOf: minorLine,
     name: "nginx",
+    backports: true,
     checkCommand: "nginx -v",
     banner: /\bnginx\/(\d+\.\d+\.\d+[^\s,;()]*)/i,
     present: /^nginx\b/i,
@@ -45,19 +51,26 @@ export const PRODUCTS = Object.freeze({
   nodejs: {
     branchOf: (v) => String(v.major),
     name: "Node.js",
+    // Node.js has no version banner, and official images and binaries are upstream.
+    backports: false,
     checkCommand: "node -v",
     banner: null,
     present: null,
     dockerImages: ["node"],
     toolVersions: ["nodejs", "node"],
     versionFiles: [".nvmrc", ".node-version"],
+    // LTS codenames, as in nvm's `lts/iron` and the node image's `iron` tag
+    // (the `lts` field of https://nodejs.org/dist/index.json).
+    lineAliases: { argon: "4", boron: "6", carbon: "8", dubnium: "10", erbium: "12", fermium: "14", gallium: "16", hydrogen: "18", iron: "20", jod: "22", krypton: "24" },
   },
   python: {
     branchOf: minorLine,
     name: "Python",
+    backports: true,
     checkCommand: "python3 --version",
-    // Werkzeug and http.server print "Python/3.12.1" in Server
-    banner: /\bPython\/(\d+\.\d+\.\d+[^\s,;()]*)/,
+    // Werkzeug and http.server print "Python/3.12.1" in Server; aiohttp only
+    // "Python/3.12 aiohttp/3.9.5", which still names the release line
+    banner: /\bPython\/(\d+\.\d+(?:\.\d+)?[^\s,;()]*)/,
     present: null,
     dockerImages: ["python"],
     toolVersions: ["python"],
@@ -66,6 +79,7 @@ export const PRODUCTS = Object.freeze({
   openssl: {
     branchOf: (v) => (v.major >= 3 ? minorLine(v) : v.patch === null ? null : `${v.major}.${v.minor}.${v.patch}`),
     name: "OpenSSL",
+    backports: true,
     checkCommand: "openssl version",
     banner: /\bOpenSSL\/(\d+\.\d+\.\d+[a-z]{0,2}[^\s,;()]*)/,
     present: null,

package/lib/advisories/versions.js

@@ -7,20 +7,35 @@
  * means a distribution build, whose security fixes are backported without the
  * upstream number changing, so the number alone cannot say whether the fix is
  * in. That case is never reported as affected; see lib/advisories/index.js.
+ *
+ * A pre-release (`8.4.27-dev`, `8.5.0RC1`, `3.15.0rc1`, `3.16.0a1`,
+ * `4.1.0-beta2`) is not a suffix: it is a build from before that version was
+ * released, so it sorts below it. `pre` holds the marker, upstream the number.
  */
 
 const VERSION = /^(\d{1,4})(?:\.(\d{1,4})(?:\.(\d{1,6}))?)?([a-z]{1,2})?(.*)$/;
+// -dev, alpha, beta, RC and pre in any case, with or without a separator; a
+// bare a/b only with a number (Python's 3.16.0a1), since OpenSSL's 1.1.1a is
+// a release. The number may follow a dot (Node.js's 23.0.0-rc.1).
+const PRE = /^(\d{1,4}\.\d{1,4}(?:\.\d{1,6})?)[-._~]?((?:dev|alpha|beta|rc|pre)(?:\.?\d+)?|[ab]\.?\d+)(?=$|[-+~_ ])(.*)$/i;
+const PRE_RANK = { dev: 0, a: 1, alpha: 1, b: 2, beta: 2, pre: 3, rc: 3 };
 
 /**
  * Parse a version string.
  * @param {string} s
  * `20`, `v20` and `8.3` parse too, with the missing parts null.
  * @returns {{ major: number, minor: number|null, patch: number|null, letters: string,
- *   suffix: string, upstream: string, raw: string } | null}
+ *   pre: string, suffix: string, upstream: string, raw: string } | null}
  */
 export function parseVersion(s) {
   if (typeof s !== "string") return null;
-  const m = VERSION.exec(s.trim().replace(/^v(?=\d)/, ""));
+  const t = s.trim().replace(/^v(?=\d)/, "");
+  const p = PRE.exec(t);
+  if (p) {
+    const base = parseVersion(p[1]);
+    return { ...base, pre: p[2].toLowerCase().replace(/^\./, ""), suffix: p[3], raw: s.trim() };
+  }
+  const m = VERSION.exec(t);
   if (!m) return null;
   const [, major, minor, patch, letters = "", suffix = ""] = m;
   // "8.3.12abc" is not a version; letters only follow a full x.y.z.
@@ -33,13 +48,23 @@ export function parseVersion(s) {
     minor: minor === undefined ? null : Number(minor),
     patch: patch === undefined ? null : Number(patch),
     letters,
+    pre: "",
     suffix,
     upstream: parts.join(".") + letters,
     raw: s.trim(),
   };
 }
 
-/** Compare two parsed versions (or strings). A missing patch sorts as 0. */
+/** Kind and number of a pre-release marker: "rc1" → [3, 1], "dev" → [0, 0]. */
+function preKey(pre) {
+  const m = /^([a-z]+)\.?(\d*)$/.exec(pre);
+  return [PRE_RANK[m[1]], Number(m[2] || 0)];
+}
+
+/**
+ * Compare two parsed versions (or strings). A missing patch sorts as 0, and a
+ * pre-release sorts below its release: 8.4.27-dev < 8.4.27RC1 < 8.4.27.
+ */
 export function compareVersions(a, b) {
   const x = typeof a === "string" ? parseVersion(a) : a;
   const y = typeof b === "string" ? parseVersion(b) : b;
@@ -56,6 +81,13 @@ export function compareVersions(a, b) {
     if (x.letters.length !== y.letters.length) return x.letters.length < y.letters.length ? -1 : 1;
     return x.letters < y.letters ? -1 : 1;
   }
+  const ex = x.pre || "", ey = y.pre || "";
+  if (ex !== ey) {
+    if (!ex || !ey) return ex ? -1 : 1;
+    const [kx, nx] = preKey(ex), [ky, ny] = preKey(ey);
+    if (kx !== ky) return kx < ky ? -1 : 1;
+    if (nx !== ny) return nx < ny ? -1 : 1;
+  }
   return 0;
 }
 

package/lib/rules/pack.js

@@ -173,7 +173,7 @@ function product(v, where) {
 function branchName(prod, v, where) {
   text(v, where, { max: 20 });
   const parsed = parseVersion(v);
-  if (!parsed || parsed.suffix || PRODUCTS[prod].branchOf(parsed) !== v) fail(`${where}: not a ${PRODUCTS[prod].name} release line`);
+  if (!parsed || parsed.suffix || parsed.pre || PRODUCTS[prod].branchOf(parsed) !== v) fail(`${where}: not a ${PRODUCTS[prod].name} release line`);
   return v;
 }
 
@@ -181,7 +181,7 @@ function branchName(prod, v, where) {
 function exactVersion(prod, branch, v, where) {
   text(v, where, { max: 30 });
   const parsed = parseVersion(v);
-  if (!parsed || parsed.suffix || parsed.patch === null) fail(`${where}: expected an exact upstream version like 8.3.27`);
+  if (!parsed || parsed.suffix || parsed.pre || parsed.patch === null) fail(`${where}: expected an exact upstream version like 8.3.27`);
   if (PRODUCTS[prod].branchOf(parsed) !== branch) fail(`${where}: ${v} is not on release line ${branch}`);
   return v;
 }

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "penthera",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "type": "module",
   "description": "Offline cyber security agent for your apps and AI coding tools. Open R&D: measured in public, improved every release.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/danoszz/penthera.git"
   },
-  "homepage": "https://github.com/danoszz/penthera#readme",
+  "homepage": "https://penthera.org",
   "bugs": {
     "url": "https://github.com/danoszz/penthera/issues"
   },

package/skills/penthera/SKILL.md

@@ -19,7 +19,7 @@ compatibility: Node.js 22+, network access to target, Penthera CLI (npm link or
 allowed-tools: "Bash(node:*) Bash(npm:*) Bash(penthera:*) Read Write Edit"
 metadata:
   author: danoszz
-  version: 1.8.0
+  version: 1.8.1
   category: security
 ---
 

package/src/cli/ui.js

@@ -114,9 +114,19 @@ export async function runUi(argv, { version }) {
   if (opts.open) openBrowser(ui.url, ui.session);
 
   await new Promise((resolve) => {
-    const stop = () => { process.stdout.write("\n  Stopped.\n"); ui.close().then(resolve); };
-    process.once("SIGINT", stop);
-    process.once("SIGTERM", stop);
+    // The signal can arrive twice: npm (npx) forwards it to us right after the
+    // terminal or a process-group kill delivered it. Keep listening and ignore
+    // repeats, so the second copy cannot fall through to the default action
+    // and kill the process before it stops. The caller exits as soon as this
+    // resolves, so close only after "Stopped." is written.
+    let stopping = false;
+    const stop = () => {
+      if (stopping) return;
+      stopping = true;
+      process.stdout.write("\n  Stopped.\n", () => ui.close().then(resolve));
+    };
+    process.on("SIGINT", stop);
+    process.on("SIGTERM", stop);
   });
   return 0;
 }