psadt-deploy-skill 0.42.0 → 0.43.0

package/README.md

@@ -15,8 +15,7 @@
 <p align="center"><sub><a href="#quick-start">Quick start</a> · <a href="#how-it-works">How it works</a> · <a href="#what-makes-it-different">What makes it different</a> · <a href="#go-deeper">Go deeper</a> · <a href="#security">Security</a> · <a href="#changelog">Changelog</a></sub></p>
 
 ---
-
-<img width="3200" height="2000" alt="psadt-workflow-v035" src="https://github.com/user-attachments/assets/d9b1c137-3e0a-4a80-a40f-9a234903bb97" />
+<img width="3200" height="1637" alt="psadt-workflow" src="https://github.com/user-attachments/assets/6a0eff79-8165-4994-83e0-d2476f204ff8" />
 
 ## What is this?
 
@@ -171,8 +170,12 @@ installed.
 **[CHANGELOG.md](CHANGELOG.md)** carries the complete history, every release since 0.1.0, and nothing is
 ever removed from it.
 
-Latest: **0.42.0 - Finding the logo cost as long as testing the package.** Acquiring one app logo took
-about as long as the whole Phase 6 gate - the same search and the same two name traps every time, none of
-which changes between versions. A per-product source catalog now records where each logo comes from and
-why that file rather than the one beside it, and `Get-PsadtAppLogo.ps1` rasterises an SVG through headless
-Edge in under three seconds. An unknown product returns a miss, never a guessed URL.
+Latest: **0.43.0 - The command that writes to the tenant could not bind.** A deep analysis of 0.42.0 read
+every control `SECURITY.md` claims, packaged an app end to end and ran the suite; its five stop-ship
+findings are fixed here. The Phase 9 upload command shown in `SKILL.md` could not bind, because
+`-IntuneWinPath` was mandatory while the artifact had been in the manifest since Phase 7 - and a new guard
+now binds every invocation the control plane shows against the real parameter sets. The third-party WinGet
+module that ships inside the `.intunewin` is pinned by SHA256 instead of a two-byte header. Three operator
+values that reached scripts running as SYSTEM are escaped or validated. A legacy config can no longer be
+written to, so the secret cannot be created inside the skill folder. The dossier template no longer names a
+customer.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "psadt-deploy-skill",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "description": "Installer for the psadt-deploy Claude Code skill: build, test and deploy PSADT v4.x Intune Win32 packages.",
   "keywords": [
     "psadt",