v1.3.1 — Core Engine Wiring, False-Positive Elimination & Concurrency Hardening

GhostCheck v1.3.1 Release Notes

• Core Engine Plugin Wiring: Wired CIAuditor, SilentPackageInstallRulesDetector, and AgencyAuditor in Scanner._process_single_file, added �nabled_checks parameter to Scanner.init, shallow-copied cached findings, and refined _is_self_scan_exempt on ghostcheck.toml.
• CLI Bare Invocation Fix: Running ghostcheck with no subcommand now defaults to scan . instead of skipping scanning.
• False-Positive Elimination & Precision Hardening:
  • DataExfiltrationDetector: Exempted benign LLM token parameters (max_tokens, prompt_tokens, completion_tokens, okenizer) while preserving plural secret detection (�uth_tokens, �pi_tokens).
  • MCPAuditor: Allowed official
    egistry.npmjs.org, *.pypi.org, and iles.pythonhosted.org registries and ignored leading UTF-8 BOM (\uFEFF).
  • EnvEgressGuard: Scoped docker-compose volume checks across all AI service blocks.
  • RagMemoryAuditor: Bounded defensive keyword exemptions to the same clause preceding directive matches.
  • FirebaseRulesAuditor, DockerRiskChecker, AISupplyChainScanner, CIAuditor: Eliminated parenthesized auth, multiline ENV, pinned package, and generic $VAR echo false positives.
• Resilience & Observability: Hardened VulnScanner requirements parsing and 4xx circuit-breaker handling, added .ghostcheckignore UTF-8 BOM/non-UTF8 resilience, fixed single-file GitDiffScanner CWD resolution, and replaced all remaining silent �xcept Exception: pass blocks with logger.debug.
• Verification: 469/469 tests passing, Grade A (100/100) self-scan.