wize-dev-kit 0.26.0 → 0.26.1

package/CHANGELOG.md

@@ -7,6 +7,12 @@ Format inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 > **0.10.0 and earlier are in Brazilian Portuguese** and are kept verbatim as a
 > historical record (not back-translated).
 
+## [0.26.1] — 2026-10-19
+
+### Fixed
+
+- **`wize-sec-recon` pointed at a script that does not exist.** `skill.md` and `scripts/run-recon.js` referenced `scripts/run-sast.js`; the SAST checks actually live in `scripts/run-gitleaks.js` (secrets) and `scripts/run-osv.js` (dependencies). Both references now name the real scripts, and a test keeps every `scripts/*.js` reference in the security overlay resolvable.
+
 ## [0.26.0] — 2026-10-19
 
 **Review hardening.** Bot comments and PR-body screenshots stop counting as evidence, `wize-code-review` learns what to do once a review bot has commented on the open PR, and two small gaps close in Shuri's reuse ladder and the architecture structure step. Ideas from [michaelshimeles/skills](https://github.com/michaelshimeles/skills) (greploop, MIT, Greptile AI), rewritten in kit voice; no code ported.

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "wize-dev-kit",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Full-lifecycle AI-assisted development kit with Test Architect and Whiteport Design Studio embedded. Inspired by BMAD Method and WDS.",
   "keywords": [
     "ai",

package/src/security-overlay/skills/wize-sec-recon/scripts/run-recon.js

@@ -1,10 +1,10 @@
 'use strict';
 
 // run-recon.js — the nmap portion of the wize-sec-recon skill.
-// SAST (gitleaks, osv/grype) is implemented in E05 and lives in
-// scripts/run-sast.js (sibling). The orchestrator (wize-sec-pentest) and
-// any caller can invoke either script directly; this file only handles
-// recon.
+// SAST is implemented in E05 and lives in the sibling scripts
+// run-gitleaks.js (secrets) and run-osv.js (dependencies). The orchestrator
+// (wize-sec-pentest) and any caller can invoke them directly; this file only
+// handles recon.
 
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');

package/src/security-overlay/skills/wize-sec-recon/skill.md

@@ -27,7 +27,7 @@ Runs nmap against the targets in the `scope.md` allowlist and writes `recon.md`.
 - Detects nmap via `command -v`. If absent, writes a `partial_status: incomplete` recon.md with a `degraded_checks` section and exits 0 — the pipeline continues.
 - Calls `assertTargetInScope` for the target. Out-of-scope targets produce an `incomplete` partial and a refusal entry in `.refusals.log`; nmap is **not** invoked.
 - Active vs passive flag set is recorded in the partial's `mode:` frontmatter.
-- The SAST portion of recon (gitleaks, osv/grype) is implemented in a sibling script `scripts/run-sast.js` and is invoked separately or by the orchestrator — see E05.
+- The SAST portion of recon lives in two sibling scripts: `scripts/run-gitleaks.js` (secrets) and `scripts/run-osv.js` (dependencies via osv-scanner, grype fallback). Both write `.wize/security/sast.md` and are invoked separately or by the orchestrator — see E05.
 
 ## Output