pqcheck 0.16.29 → 0.16.30

package/README.md

@@ -8,7 +8,7 @@
 [![npm downloads](https://img.shields.io/npm/dm/pqcheck.svg?style=flat-square&color=06b6d4)](https://www.npmjs.com/package/pqcheck)
 [![license](https://img.shields.io/npm/l/pqcheck.svg?style=flat-square&color=06b6d4)](./LICENSE)
 
-> **Latest: v0.16.29** — Fixed a high-volume false positive caught by external testing: WAF-mitigated 403s on `/wp-admin` (and any `expect: missing` default) were firing as "WordPress leak" on every Vercel/Cloudflare-hosted non-WP app. The probe now detects `x-vercel-mitigated` / `cf-mitigated` headers and classifies them as `blocked` (not `protected`). And `expect: missing` now semantically means "not reachable to anonymous users" — 404/401/403/3xx/WAF-block all satisfy; only 200-serving-content fails. Every catastrophic catch (`.env` leak at 200, real WP at 200, public `/api/admin`) preserved. Verified with 23 new tests covering all classification × expectation combinations. [Full changelog →](./CHANGELOG.md)
+> **Latest: v0.16.30** — Three asks from external dogfood feedback after a draft-route resolver bug shipped 9 new `/preview/*` routes to prod undetected. **(1)** Broader surface-diff: sitemap.xml + homepage-anchor discovery feed into the snapshot so "+9 new public routes since baseline" surfaces at info severity (default-quiet, never gates). **(2)** Glob support: `.cipherwake.json` now accepts `/preview/*` and `/admin/**` patterns — escalation is opt-in via declared assertion. **(3)** Scope honesty: `scope_note` now explicit that `pass` doesn't claim every-route inventory is current. The customer's "low-noise discipline is the asset" preserved: route-surface drift is info-only; gating requires explicit declared assertions. [Full changelog →](./CHANGELOG.md)
 
 ## Two ways to use it
 

package/bin/pqcheck.js

@@ -4004,7 +4004,7 @@ async function runTrustDiffCommand(args) {
       scanned_at: new Date().toISOString(),
       advisory_only: "true",
       scope: strictPosture ? "trust_surface_drift_plus_absolute_posture_plus_route_assertions_plus_health" : "trust_surface_drift_plus_route_assertions_plus_health",
-      scope_note: "ship_decision = worst-of(drift, route_assertions, deploy_health, secret_scan, cookie_invariants" + (strictPosture ? ", absolute_posture)" : ")") + ". Cipherwake checked the public trust surface independently of what your AI coder claims; this is the gate that should fire before the AI announces a deploy. Cipherwake does NOT verify app functionality.",
+      scope_note: "ship_decision = worst-of(drift, route_assertions, deploy_health, secret_scan, cookie_invariants" + (strictPosture ? ", absolute_posture)" : ")") + ". `pass` means: trust/crypto posture stable + declared assertions hold + homepage healthy + no leaked secrets found + declared sensitive paths still gated. `pass` does NOT mean: every public-route inventory is current, nor that no content/authorization leak exists outside the assertion set. Surface-diff additions (new routes / scripts) emit at info severity for human review — they never gate. To make a route class gate, declare a glob assertion (e.g. `/preview/* expect:missing`). Cipherwake does NOT verify app functionality.",
       narrative: routeAssertions
         ? buildTrustDiffNarrative({
             deltaCount: deltas.length,
@@ -4029,9 +4029,17 @@ async function runTrustDiffCommand(args) {
         const { recordResults, recordSurfaceSnapshot } = await import(new URL("./statsTracker.js", import.meta.url).href);
         await recordResults(extractStatsEntries(routeAssertions));
         // Extract publicRoutes + thirdPartyHosts from the report for snapshot
-        const publicRoutes = Array.isArray(currentReport?.publicRoutes?.paths)
+        // R91 (2026-06-06) — broader discovery: merge common-public probe
+        // results with sitemap + homepage-anchor discovered routes so the
+        // surface-diff catches NEW marketing/preview routes (the seatcheck
+        // case from external dogfood feedback).
+        const probedPublic = Array.isArray(currentReport?.publicRoutes?.paths)
           ? currentReport.publicRoutes.paths.filter((p) => p.classification === "public").map((p) => p.path)
           : [];
+        const discovered = Array.isArray(routeAssertions?.discoveredRoutes)
+          ? routeAssertions.discoveredRoutes
+          : [];
+        const publicRoutes = [...new Set([...probedPublic, ...discovered])].sort();
         const thirdPartyHosts = Array.isArray(currentReport?.publicDeps?.thirdParties)
           ? [...new Set(currentReport.publicDeps.thirdParties.map((t) => t.host).filter(Boolean))]
           : [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pqcheck",
-  "version": "0.16.29",
+  "version": "0.16.30",
   "description": "Deploy gate for AI-coded web apps. `pqcheck deploy-check --ai` returns ship_decision=pass|review|block for Claude Code / Cursor / Copilot / Aider to gate deploys before they ship. Anonymous, no signup, free for first use.",
   "keywords": [
     "ai-coder",