From 549e17ccc4bc54aae24f45a467b38996b1394d05 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 23:45:31 +0000 Subject: [PATCH] Version Packages --- ...phi-scan-refuse-an-unobserved-scan-root.md | 22 ---------- .changeset/phi-scan-widen-the-walk-roots.md | 40 ------------------- docs-content/installation.md | 2 +- package.json | 2 +- src/core/version.ts | 2 +- 5 files changed, 3 insertions(+), 65 deletions(-) delete mode 100644 .changeset/phi-scan-refuse-an-unobserved-scan-root.md delete mode 100644 .changeset/phi-scan-widen-the-walk-roots.md diff --git a/.changeset/phi-scan-refuse-an-unobserved-scan-root.md b/.changeset/phi-scan-refuse-an-unobserved-scan-root.md deleted file mode 100644 index 0808a0e..0000000 --- a/.changeset/phi-scan-refuse-an-unobserved-scan-root.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -"@cosyte/cli": patch ---- - -The PHI scanner refuses (exit 2) when a declared scan root was never observed, instead of printing -`OK, no hits` and exiting 0 over a corpus it never opened. - -In all-mode (`pnpm phi-scan` with no arguments, which is what CI runs) each root's walk is now -reconciled against `git ls-files`, and two independent conditions refuse: the root contributed -nothing, or git tracks an in-scope file under the root that the walk did not open. Six states -previously reported clean, all measured on this repository: the root missing, the root emptied, the -root a dangling symbolic link, the root a live symbolic link to an outside directory, one tracked -fixture removed from the working tree, and the source root moved away. The dangling case is the one -no kind check could reach, because `existsSync` follows the link and answers false before anything -about the entry is inspected. - -Also fixed: a present-but-unreadable `phi-scan-overrides.md` threw past every handler and exited 1, -which is this scanner's code for "hits found". It now exits 2 with a diagnostic, matching the -allow-list reader beside it. - -Scoped to the all-mode sweep. `--staged` is a diff rather than a corpus and is unchanged, and so is -the behaviour of naming paths explicitly. diff --git a/.changeset/phi-scan-widen-the-walk-roots.md b/.changeset/phi-scan-widen-the-walk-roots.md deleted file mode 100644 index beb590d..0000000 --- a/.changeset/phi-scan-widen-the-walk-roots.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -"@cosyte/cli": patch ---- - -The PHI scanner's all-mode walk now covers this package's whole authored corpus. It was rooted at -`test/__fixtures__` and `src` only, so 89 of 123 tracked files were scanned by neither of its two -routes; it now roots at `src`, `test` and `scripts`, opening 72 tracked files instead of 34. - -Measured back to back on the base commit rather than inferred: a dashed SSN and an off-domain address -written into a file under `test/`, in this package's own inline-message shape (a whole HL7 message as -one TypeScript string literal with escape sequences between its segments), exited 0 with `OK, no -hits` in all mode while naming the same file explicitly reported both at exit 1 over the same bytes. -A file written under `scripts/` behaved identically. Both routes now report both. Every one of the 38 -newly opened files was read by hand: every message literal is a placeholder and the only SSN and -email shapes anywhere are the scanner's own declared synthetic payload, so the gap was one of -enumeration rather than a live exposure. - -`test` replaces `test/__fixtures__` rather than joining it, because the roots must stay disjoint: each -is walked independently and the results concatenated, so a nested root would enumerate every file -beneath it twice. The fixture directory is still watched, through the other condition of the -unobserved-root rule, wherever the repository tracks files under it. One cover was lost and is stated -rather than implied away: where nothing is tracked under it, an empty fixture directory no longer -refuses. `scripts/` is included because the scanner, its allow-list and its override log all live -there, so the one directory guaranteed to hold identifier-shaped text was the one nothing enumerated; -all nine files there were measured against the detector before the root was declared. - -Scanning `scripts/` has one consequence worth knowing before it surprises someone: the allow-list -documents an id entry as matching a social-security, medical-record or member-id shape, and the -dashed-id check consults no allow-list, so declaring one in the dashed shape now reports a hit on the -allow-list itself. Nothing shipped is affected, and the remedy is to write the synthetic id in a shape -the check does not match, never to weaken the check or to exempt the file. - -The scanner's own test file carries violator literals on purpose and is the single exempt path. That -exemption is applied after the file is read, so it still counts as observed and an unreadable one -still refuses; it is scoped to the sweep, so naming the file explicitly still reports every hit; and -it is per path rather than a pattern. - -What this does not change: the detector is still the cross-cutting SSN and email floor, now over 38 -more files, and structured field-level detection remains unimplemented. A test pins that limit. -`--staged` is unchanged, because widening it would change what a commit is blocked on. diff --git a/docs-content/installation.md b/docs-content/installation.md index c56a565..cf0feb8 100644 --- a/docs-content/installation.md +++ b/docs-content/installation.md @@ -102,7 +102,7 @@ autodetector, the exit-code contract, and the value-free diagnostic types: ```ts runnable import { VERSION } from "@cosyte/cli"; -VERSION; // => "0.0.5" +VERSION; // => "0.0.6" ``` If that resolves and prints the release you installed, the install is good: head to the diff --git a/package.json b/package.json index a7ed7ee..ab7f206 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@cosyte/cli", - "version": "0.0.5", + "version": "0.0.6", "description": "The cosyte CLI: a PHI-safe developer front door over the @cosyte/* healthcare parsers. Parse HL7 v2 / FHIR from a file or stdin to typed JSON, with a documented exit-code contract.", "keywords": [ "cli", diff --git a/src/core/version.ts b/src/core/version.ts index c9c1c14..e83e38c 100644 --- a/src/core/version.ts +++ b/src/core/version.ts @@ -23,4 +23,4 @@ * console.log(`cosyte ${VERSION}`); * ``` */ -export const VERSION: string = "0.0.5"; +export const VERSION: string = "0.0.6";