weavatrix 0.2.18 → 0.2.19

package/README.md

@@ -28,7 +28,7 @@ Enterprise deployment through one source-free wire contract. It is a thin
 extension of this package, not a fork of the parser/graph/Health engine, so core
 updates arrive as normal dependency updates.
 
-Version 0.2.18 still contains the explicit opt-in compatibility profiles
+Version 0.2.19 still contains the explicit opt-in compatibility profiles
 documented below. The paired 0.3/0.1 release removes their network
 implementations from this package; until then the new connector is not
 publishable. The decision and release gates are in
@@ -430,6 +430,18 @@ metrics are not persisted or transmitted by Weavatrix. If a source checkout's pa
 while an old daemon remains alive, `initialize`, `tools/list`, and tool calls fail loudly with
 `STALE_RUNTIME` until the client reconnects; the opt-out is reserved for deliberate development.
 
+### 0.2.19 supply-chain signal precision
+
+- Installed-package URL literals and ordinary standalone network calls no longer become malware
+  findings without a separate security signal. They remain bounded co-evidence beside behavior such
+  as environment harvesting, while exfil endpoints, public raw IPs and fetch-plus-exec stay active.
+- Unicode variation selectors used for emoji/presentation are no longer confused with hidden text
+  controls. Bidirectional override/isolate controls remain covered.
+- Real Hosted dogfood now completes OSV over 651 package versions and the local malware sweep over
+  535 installed packages with zero critical/high/medium/low findings.
+
+Full patch notes: [docs/releases/v0.2.19.md](docs/releases/v0.2.19.md).
+
 ### 0.2.18 repository-root and self-audit trust patch
 
 - A directory nested under an ignored parent Git repository is no longer mistaken for an empty

package/docs/releases/v0.2.19.md

@@ -0,0 +1,33 @@
+# Weavatrix 0.2.19
+
+0.2.19 is a supply-chain signal-precision patch. It was produced after the complete Hosted
+installed-package scan exposed false positives in otherwise ordinary dependency content.
+
+## Malware evidence precision
+
+- A hardcoded external URL is no longer sufficient for a malware finding.
+- A standalone `fetch`, Axios, request, curl or wget call to an ordinary external URL is also weak
+  evidence by itself. It remains attached as bounded co-evidence when the same package has a
+  separate security signal, such as whole-environment serialization.
+- Strong URL and execution evidence is unchanged: known exfil/webhook hosts, public raw-IP URLs,
+  cloud metadata endpoints, download-plus-exec lifecycle scripts, reverse shells and miners still
+  produce review findings.
+- Unicode variation selectors (`U+FE00`–`U+FE0F`) are presentation controls commonly used with
+  emoji and no longer trigger hidden-Unicode review. Bidirectional override/isolate controls remain
+  covered because they can conceal source order.
+
+## Verification
+
+- Synthetic end-to-end fixtures prove ordinary URL literals, standalone network calls and variation
+  selectors stay quiet while multi-signal and strong malicious families remain detectable.
+- Real Weavatrix Hosted dogfood checked 651/651 pinned package versions through OSV with no known
+  advisories and scanned 535 installed npm packages with zero malware findings.
+- The same audit reports complete npm declaration/import verification, zero missing dependencies,
+  zero unused dependencies, zero duplicate declarations and zero runtime cycles.
+- Full release tests, release-manifest checks, npm/MCPB pack/runtime smoke and supported Node CI remain
+  mandatory before publication.
+
+## Product boundary
+
+The offline package remains MIT. The accepted 0.3 split and the separate permission-licensed online
+connector are unchanged by this patch.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -27,7 +27,7 @@
     "scripts/run-agent-task-benchmark.mjs",
     "docs/agent-task-benchmark.md",
     "docs/adr/0001-v0.3-offline-online-split.md",
-    "docs/releases/v0.2.18.md",
+    "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",
     "LICENSE"

package/src/security/malware-scoring.js

@@ -22,6 +22,10 @@ function addTyposquatCoSignals(byPkg) {
 function visibleSignals(signals, allow) {
   const kept = signals.filter((s) => !(allow && s.noisy));
   if (!kept.length) return [];
+  // A literal URL, or even a network call to one, is ordinary package behavior without a second
+  // security signal. Keep those weak observations available as co-evidence (for example beside
+  // environment harvesting), but never create a standalone malware finding from them.
+  if (!kept.some((s) => !s.weak)) return [];
   const hasStrongerUrl = kept.some((s) => STRONG_URL_KEYS.has(s.key));
   return hasStrongerUrl ? kept.filter((s) => s.key !== "hardcoded-url") : kept;
 }

package/src/security/registry-sig.rules.js

@@ -90,6 +90,7 @@ export const CONTENT_RULES = [
     severity: "low",
     nearZeroFp: false,
     noisy: true,
+    weak: true,
     pattern: "(fetch|axios\\.|XMLHttpRequest|sendBeacon|https?\\.request|request\\(|curl\\b|wget\\b).{0,220}https?://",
     re: new RegExp(`\\b(fetch|axios\\.(get|post|put|patch|request)|XMLHttpRequest|sendBeacon|https?\\.request|http\\.request|request\\(|curl\\b|wget\\b)[\\s\\S]{0,220}?${PLAIN_EXTERNAL_URL}`, "i"),
     what: "network call to hardcoded external URL",
@@ -172,9 +173,9 @@ export const CONTENT_RULES = [
     key: "hidden-unicode",
     severity: "medium",
     nearZeroFp: false,
-    pattern: "[\\x{202A}-\\x{202E}\\x{2066}-\\x{2069}\\x{FE00}-\\x{FE0F}]",
-    re: new RegExp("\\u202A|\\u202B|\\u202C|\\u202D|\\u202E|\\u2066|\\u2067|\\u2068|\\u2069|\\uFE00|\\uFE01|\\uFE02|\\uFE03|\\uFE04|\\uFE05|\\uFE06|\\uFE07|\\uFE08|\\uFE09|\\uFE0A|\\uFE0B|\\uFE0C|\\uFE0D|\\uFE0E|\\uFE0F", "u"),
-    what: "hidden Unicode control/variation character in package source",
+    pattern: "[\\x{202A}-\\x{202E}\\x{2066}-\\x{2069}]",
+    re: new RegExp("\\u202A|\\u202B|\\u202C|\\u202D|\\u202E|\\u2066|\\u2067|\\u2068|\\u2069", "u"),
+    what: "hidden bidirectional Unicode control character in package source",
   },
   {
     key: "obfuscated-code",

package/docs/releases/v0.2.18.md

@@ -1,41 +0,0 @@
-# Weavatrix 0.2.18
-
-0.2.18 is the publishable repository-root and self-audit trust patch. The `v0.2.17` source tag was
-created, but its release validation exposed the nested-root discovery regression before an npm
-package was published. The tag remains immutable; 0.2.18 contains that release plus the fix.
-
-## Repository discovery
-
-- The internal builder distinguishes an actual Git root from a directory that merely lives below
-  another Git repository.
-- When the selected nested directory is ignored by its parent and Git returns an ambiguous empty
-  file universe, Weavatrix uses its boundary-safe filesystem walker instead of building a zero-node
-  graph.
-- A real Git root with an empty tracked/unignored universe stays empty, so ignored build output and
-  secrets are not reintroduced.
-- The live stdio hot-reload regression now exercises the corrected path and passes independently,
-  matching the Linux release runner rather than depending on full-suite ordering.
-
-## Included 0.2.17 trust work
-
-- Drizzle configuration roots its schema modules in production reachability.
-- Scoped typosquat review compares only compatible scoped targets.
-- Executable regular expressions retain equality anchors for clone fingerprints without exposing
-  their source text.
-- Obsolete test-only dependency parsers were removed and repeated dependency, graph and architecture
-  helpers were consolidated under shared owners.
-- Hosted evidence applies the same production-first classification and recomputes bounded summaries
-  after filtering.
-
-## Product boundary
-
-- `weavatrix` remains MIT and offline-first. No license change is made here.
-- The accepted 0.3 split moves outbound HTTP into the separately versioned `weavatrix-online`
-  connector, whose permission-required license remains a release gate.
-
-## Verification
-
-Release validation covers the full Node test suite on supported Node versions, independent hot
-reload execution, release-manifest checks, npm/MCPB packing and runtime smoke tests. The paired
-Hosted deployment is rebuilt from this graph, then verified through its live Health and History
-views.