v2.25.0

2.25.0 (2026-09-27)

Bug Fixes

• action: an incomplete scan says "node9 could not read everything" and what, never ✅ (7dfd9a3)
• action: make repo text inert where the PR comment is rendered (4551ac2)
• scan-repo: a project with a root SKILL.md is not one big skill; an override is a finding only when emitted (6266314)
• scan-repo: a suppression added in the same change does not open the DEFAULT gate either (b46f3de)
• scan-repo: apply the plain-link rule at its edges (submodules, links via links, dependency names) (fbb6d62)
• scan-repo: cap a skill's allowed-tools grant at medium (73a88b7)
• scan-repo: close the final review's blocker and three should-fix issues (4f8cf67)
• scan-repo: close the suppression bypasses the adversarial review reproduced (fcf17e5)
• scan-repo: follow plain links only; any other link where agent config lives is a finding (185f5ae)
• scan-repo: grade an app-root skill's docs when its SKILL.md names them (0776995)
• scan-repo: judge a file by the path the agent opens and follow links wherever they lead in the repo (f400463)
• scan-repo: narrow the command-shape guards to the exact harmless command (5c88a06)
• scan-repo: no crafted input can stall a scan (linear fetch/upload finders, linear YAML duplicate check) (f86992b)
• scan-repo: read local files through one handle and never follow a symlink (76bb12f), closes #377
• scan-repo: read the working tree from disk and resolve links the way the OS does (f35aa21)
• scan-repo: say node9 did not run under pull_request_target; stop reading an app's docs as skill files (bbec993)

Features

• scan-repo: a committed .node9-ignore.json suppresses findings — except the ones added with it (7cfecaf)
• scan-repo: every finding points at its line (9ff4e5d)
• scan-repo: grade allowed-tools in skills and commands; read lowercase skill.md (f7a600e)
• scan-repo: one reading layer for the working tree, the PR base and the GitHub API (c98c086), closes github/#aw
• scan-repo: read the scripts an agent runs, lift the surface cap, close six hermes false positives (c028e87)