WHOISleuth 2.8.0

Highlights

• Evaluate Discovery failure policies against all collected and resumed results, even when output filters hide a matching result.
• Make CLI danger evaluation use the canonical Risk model with an explicitly supplied local Brand Profile, shared comparison logic and retained evidence quality.
• Correct one-shot monitoring policies for failed constituent sources and incomplete requested comparisons, independently of the review headline.
• Keep parent registration evidence separate from the hostname actually observed. A newer child or sibling observation cannot displace valid service evidence for another hostname.
• Qualify Bulk and saved-Lookup diff/timeline web comparisons with collection quality. Incomplete or unknown collection no longer establishes equality or an observed change; genuine source-health changes remain visible.
• Clarify the homepage's illustrative preview, refresh the README image, and improve mobile console layout, workspace navigation, disclosure alignment and consistent link arrows.
• Refresh retained vulnerability/certificate intelligence and compatible dependencies.

Upgrade notes

• Node.js 24 or later remains required. The application and main CLI share version 2.8.0; optional companions retain their own versions and are not published by this main CLI release.
• Scripts selecting failure policies can now receive exit 4 for matches previously hidden by filtering or projection. Quiet and structured output retain their output contracts, and existing collection limits and request budgets are unchanged.
• For meaningful --fail-on danger evaluation, select --deep --brand-profile brand.json. The bounded local profile adds no collection requests and is not retained in checkpoints. Risk remains a heuristic review signal, not a finding of maliciousness; a non-match is not a safety verdict.
• monitor-once --fail-on source-failure includes failed current constituent sources in fulfilled Lookups. --fail-on inconclusive includes incomplete requested comparisons even alongside definite drift. Unconfigured expectations and historical source failures do not become current failures.
• One-shot monitoring accepts registrable-domain targets. Unsupported child-host targets return usage exit 2 before any request, rather than being silently retargeted. Wrong-host collector replies count as failed Lookups.
• Historical records without web collection-quality metadata remain unknown. Existing evidence readers, output formats and historical integrity verification remain supported. Back up saved work before changing versions.

Install

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.8.0

Or run without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.8.0 -- whoisleuth --help

Verification

• Post-merge CI passed all 16 jobs on 916d615e0d37180c1c14bb33946cd12ae76a1f28: 7,683 unit tests, 46 integration tests and 1,257 browser executions, including ten setup executions. Browser failures, retries, flakes and skips: zero.
• CodeQL passed both analyses. No open main-branch alerts were reported at the release readback.
• All three package formats passed 368 installed checks across Node.js 24.21.0 and 26.12.0 in post-merge CI.
• The production homepage identifies version 2.8.0 at the exact merged release revision and returns the expected security headers.
• Exact-tag package preparation passed 30 package-contract tests and 158 installed checks. Production and installed-candidate dependency audits each reported zero vulnerability entries. The downloaded archive, report and dependency evidence were verified again offline. The candidate contains 544 entries, 1,671,856 packed bytes and 7,208,084 unpacked bytes.
• Post-publication verification passed against npm 2.8.0, using the original candidate from release run 39050948850. Both the published gzip archive and decompressed tar payload are byte-identical to the approved candidate. Registry SHA-512/SHA-1 integrity metadata, archive measurements and exact runtime dependency pins passed verification. The retained candidate passed the same comparison locally. npm latest is 2.8.0.

Archive SHA-256: 3eb3a374fc8239c38e62449626051bde652fe6299fe7baf81c65d9d7b2b41b50.

CLI guide · Full changelog

WHOISleuth 2.7.0

Highlights

• Keep analyst work in context: review Bulk rows, Brand candidates, the inbox
  and Cases without silently losing selections, drafts or the current record.
• Follow evidence back to its source with scoped references, source trails,
  original-field explanations and retained collection receipts. Conflicting
  observations and analyst assessments remain separately attributed.
• Compare retained captures and checkpoints, inspect evidence in a gallery and
  arrange a temporary Caseboard without changing the underlying saved evidence.
• Prepare recipient-specific handoffs, compare disclosed material and inspect
  returned amendments. Selected evidence files retain their integrity and
  derived-image lineage without automatically sharing original pixels.
• Inspect workspace backup coverage and rehearse recovery in isolation before
  replacing saved work. Improve exact-object response, packet attachment,
  report-reading and printable-report workflows.
• Extend local intake explanations for structured findings and WACZ records,
  preserving duplicate origins instead of inventing a single source location.
• Improve mobile navigation, theme controls, keyboard focus, documentation,
  fictional practice and browser/CLI/local-application guidance.
• Refresh compatible dependencies and retained source data while preserving
  supported historical readers and verification paths.

Upgrade notes

• Node.js 24 or later remains required. The application and main CLI share
  version 2.7.0. Optional capture and local-application companions retain their
  own versions and are not published by this main CLI release.
• Back up saved work before upgrading. Supported earlier files retain their
  readers and historical verification, but new writers can emit newer versioned
  records. Rolling back the application does not downgrade those records.
• Existing collection remains explicit and bounded. Opening a comparison,
  arranging retained evidence or preparing a handoff does not itself submit a
  report or contact the observed destinations.
• Caseboard arrangements, workspace-folder shortlists and some comparison
  choices are session-only. Gallery support covers retained PNG images and
  bounded text, not arbitrary media. Offline compatibility checks do not claim
  acceptance by a live external server.

Install

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.7.0

Or run without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.7.0 -- whoisleuth --help

Verification

• Post-merge CI
  passed on revision 3b56e2a3b72134bf0579c524c218a383826c300e: 7,666 unit
  tests, 46 integration tests and 1,255 browser executions, including ten setup
  executions. Browser failures, retries, flakes and skips: zero.
• Coverage: 96.74% lines, 88.12% branches and 94.97% functions. All 18 critical
  mutations were killed, with zero survivors or errors.
• Code analysis
  passed. All three package formats passed 368 installed checks across Node.js
  24.21.0 and 26.12.0. The quality dependency audit reported zero vulnerabilities.
• The production website identifies the same release revision. Its homepage,
  CLI guide, Resources, demo and privacy-page bytes match the verified post-merge
  build, and expected security headers remain present.
• Exact-tag package preparation
  passed 30 package-contract tests and 158 installed checks. Both production and
  installed-candidate dependency audits reported zero vulnerability entries.
  The downloaded candidate's archive, report and dependency evidence were bound
  and verified again offline. It contains 542 entries: 1,666,372 packed bytes
  and 7,189,019 unpacked bytes.
• Post-publication verification
  passed against npm 2.7.0. The published archive and decompressed tar payload
  are byte-identical to the reviewed candidate; registry content integrity,
  archive measurements and exact runtime dependency pins were verified.
  npm latest is 2.7.0.

Archive SHA-256: 22b6f01267a6c44e1064b07a39935e1ee60426b6eb615f79aeab871e9e2311d9.

CLI guide · Full changelog

WHOISleuth 2.6.0

Highlights

• Review domain-feed candidates against Brand terms and exclusions, retain source editions and priorities, and deliberately add selected candidates to Watchlists. Local-file review is available in the website and CLI; the optional authenticated feed service remains separately configured.
• Keep infrastructure observations and comparisons linked to their sources. Distinguish registration changes, collection gaps and conflicting evidence without turning missing results into a removal verdict.
• Preserve the relationship between selected edited images and their originals through derivative declarations and original-file digests, without including the original pixels. Add missing-original recovery guidance and ordinary Case-report printing.
• Extend offline intake with source-linked IP and hash observations, explicitly selected phone observations, displayed/destination comparisons and supplied distribution context. Selected files remain local and destinations are not opened automatically.
• Prepare reviewed internal-containment handoffs and track response activity against exact objects. Record delivery corrections, retractions and conflicting receipts without rewriting prior history.
• Preserve newer drafts, Bulk queues and discovery selections during pending operations. Improve Case navigation, public-example readiness, WHOIS parsing bounds, DNS outcome distinctions and cancellation behavior.
• Update the shared visual identity, documentation and fictional practice, and migrate the website to SvelteKit 3 with compatible framework and dependency updates.

Upgrade notes

• Node.js 24 or later remains required. The application and main CLI share version 2.6.0; installed packages were checked on Node.js 24.21.0 and 26.10.0.
• Supported earlier formats retain their readers and historical verification. Current writers use newer versioned Case, Brand, Watchlist and workspace records. Back up saved work before upgrading: older applications may reject newly written formats, and application rollback does not downgrade stored data.
• No new service is required for the existing website. Feed-service hosting and activation remain separate from the always-available local-file adapter. Candidate matching does not automatically add domains to monitoring or collect their evidence.
• This npm release covers the main CLI only. Optional capture and standalone companions remain separate packages. Offline interoperability checks do not claim acceptance by a live external server.

Install

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.6.0

Or run without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.6.0 -- whoisleuth --help

Verification

• Post-merge CI passed on exact release revision 82f9a64ae3c4b5cf60fc71117a8f322ef0bb3870: 7,343 unit tests, 46 integration tests and 1,157 browser executions, including ten setup executions. Browser failures, retries, flakes and skips: zero.
• Coverage: 96.66% lines, 87.65% branches and 94.81% functions. All 18 critical mutations were killed, with no survivors or errors.
• Code analysis passed. Installed checks across all three package formats passed on Node.js 24 and 26. The production website identifies the same release revision.
• Exact-tag package preparation passed 30 package-contract tests and 158 installed checks. Both production and installed-candidate dependency audits reported zero vulnerabilities. The downloaded candidate's archive, report and dependency evidence were bound and verified again offline. The archive contains 533 entries: 1,644,186 packed bytes and 7,098,678 unpacked bytes.
• Post-publication verification passed against npm 2.6.0. The published archive and decompressed tar payload are byte-identical to the reviewed candidate; registry content integrity, archive measurements and exact runtime dependency pins were verified. npm latest is 2.6.0.

Archive SHA-256: f036bc617e121abc892fc8c03b81070df1a4e374fc83acc4ef1e9e8d8415b35c.

CLI guide · Full changelog

WHOISleuth 2.5.1

Highlights

This is the first npm release in the 2.5 series. It includes the 2.5.0 website features and the following maintenance update without changing the existing 2.5.0 tag.

• Refresh certificate-warning intelligence with four additional fingerprints. Matching remains exact and local over the certificate already observed by Deep Lookup.
• Run the scheduled Firefox and WebKit checks independently, preserving complete specifications and zero retries while avoiding a shared 30-minute deadline.
• Review selected email, calendar invitations, text, still-PNG QR images, PDF, DOCX, HAR and supported identity-event exports offline. Reviews retain source hashes and extraction coverage without opening destinations or replaying requests. Email authentication remains an attributed header claim, with trust recorded per selected header.
• Review incident sequences, retained domain history, platform-object continuity, authorised storefront comparisons and connector provenance in the browser and CLI. Retained infrastructure has source-linked lists and an optional one-hop topology view.
• Keep Case follow-ups traceable with evidence relationships, amendments, recipient-disclosure review, report previews and temporary read-only package review. Managed indicator revisions support renewal and withdrawal, with separate recipient review for STIX and MISP exports.
• Preview remaining workflow checkpoint inputs and approvals before continuing. Local MMDB review records exact-byte identity, database metadata and an analyst-selected freshness policy without downloading databases.
• Preserve distinct DNS query outcomes and collection gaps in change reviews. Renewal reminders remain separate from configuration drift.
• Find guidance through searchable documentation, shared section navigation, fictional Case exercises and a shell-aware command builder.

Upgrade notes

• Node.js 24 or later remains required. The application and main CLI share version 2.5.1.
• Supported earlier formats retain their readers and historical verification. Compared with 2.4.0, current writers advance to Case schema 17, Case report 13 and response packet 11; workspace archive 9 and CLI Case-pack 2 envelopes remain unchanged. Back up saved work before upgrading: older readers may reject newly written formats, and application rollback does not downgrade stored data.
• Automation: verify-artifact --strict-exit returns 4 for unencrypted workspace archives even when section checks pass, because section digests do not cover mutable root metadata. Inspect the report for the verification scope.
• This npm release covers the main CLI only. Optional local-application and capture companions remain separate packages.

Install after npm publication

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.5.1

Or run without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.5.1 -- whoisleuth --help

Verification

• Post-merge CI passed on the exact tagged revision: 6,916 unit tests, 46 integration tests and 1,075 browser executions, including setup. Browser failures, retries, flakes and skips: zero.
• Scheduled cross-browser verification passed on the identical reviewed source tree: 149 executions each in Firefox and WebKit, including setup, with zero failures, retries, flakes or skips.
• Code analysis and source-drift checks passed. Installed package checks passed on Node.js 24 and 26.
• Exact-tag package preparation passed 30 package-contract tests and 150 installed checks. Both production and installed-candidate dependency audits reported zero vulnerabilities. The archive contains 512 entries: 1,562,270 packed bytes and 6,749,033 unpacked bytes.

Archive SHA-256: 2354c883ad236e4b659167f0c547c6d8644621afc7132431f79a333d6704b7c5.

CLI guide · Full changelog

WHOISleuth 2.4.0

Added

• Case decision summaries, response and recheck queues, reporting receipts, saved review views and recoverable drafts.
• Encrypted handoffs and portable evidence packages for deliberate second-opinion review and offline verification.
• Local CLI Case files with explicit create, note, evidence-pin, assessment and recheck operations. Mutations preserve earlier evidence and reject stale or lossy inputs.
• Resumable CLI workflows that retain partial collection results and keep further network activity subject to explicit approval.

Improved

• Console navigation, selected-Case context, responsive layouts and keyboard access across investigation and reference pages.
• Registration, DNS, mail-policy, website, provider and source-quality explanations, keeping unavailable, partial and conflicting evidence distinct.
• Explicit inherited mail-policy and parent-delegation review without expanding default collection modes.
• Workspace locking, import conflict handling, storage-pressure behaviour, cancellation, private file output and evidence-package validation.
• Shared domain and verification owners, focused contributor checks, portable package validation and isolated browser checks against declared build artefacts.

Compatibility and safety

• Node.js 24 or later remains required. The application and main CLI share version 2.4.0.
• Supported public artefacts remain readable through fixture-backed compatibility paths, and historical integrity formats retain their verification routes. New formats declare their versions and unsupported future versions fail closed.
• Back up retained work before upgrading. Older applications may reject newer saved formats; rolling back the application does not downgrade stored data.
• Saved browser work remains local by default. Offline planning, file review and verification stay offline. Additional collection and sharing require deliberate actions; incomplete evidence does not establish absence, maliciousness or successful remediation.
• Optional capture and standalone application tools remain separate packages. This release publishes only the main CLI package.

Verification

Released from 94c6cafd4d27b82289e63b17f73fa1f58202488e, also verified on the production website.

• Pre-merge CI and post-merge CI each passed 6,227 unit tests across 572 suites and 975 browser executions.
• Each browser run included 942 functional tests, 15 performance measurements, 12 critical Firefox/WebKit tests and six authentication setups. Final failures, retries, flakes and skips: zero.
• Post-merge coverage: 96.16% lines, 86.49% branches and 94.44% functions. Package/runtime, compatibility, privacy, architecture, loading and source-analysis checks passed.
• Tagged candidate preparation passed 27 package-contract tests across three suites and 120 installed-command checks. Both repository and freshly installed candidate dependency audits reported zero production vulnerability entries.
• The independently assembled local and hosted candidates are byte-identical: 403 compiled sources, 414 entries, 1,435,072 packed bytes and 6,281,597 unpacked bytes.
• Post-publication verification confirmed that npm 2.4.0 matches the reviewed candidate, including archive bytes, file inventory and exact dependency pins. This check used corrected verification tooling at d1679f68; the published package and release tag remain unchanged.

Candidate archive SHA-256: 84d3be86dd60e2685897253236eee4dd5ad1f39d2d440ba622630f44efdcb83c.

Install

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.4.0

Or run without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.4.0 -- whoisleuth --help

CLI guide · Full changelog

WHOISleuth 2.3.0

Added

• Case-type evidence-readiness guidance, structured analyst confidence and explicit response-route review deadlines.
• Browser-local Brand records for official channels and rights references, with deliberate sharing and export boundaries.
• Offline mail-headers review for domain-only message identity, reported authentication results and bounded routing information. Header claims remain distinct from independent authentication verification.

Improved

• Investigation, Case, comparison and monitoring handoffs preserve source identity, observation time, incomplete evidence and analyst decisions more consistently.
• Selected Case follow-up calendars use the stable Case reference by default, with separate choices for disclosing investigated domains and other details.
• Responsive reference navigation, finding pagination and deferred controls retain usable navigation and clearer loading behaviour.
• CLI options, help and completions share a typed grammar. Case decisions and audience-specific projections have explicit shared owners.
• Local and hosted checks use the same maintained verification groups and declared browser-build inputs. Failed or interrupted browser runs retain bounded diagnostics.
• Performance reports retain repeated timings and execution context without treating one development machine's speed as a universal release limit. Functional readiness, request, transfer and layout checks remain mandatory.

Compatibility and safety

• Current writers use Case schema 15, Case report 11, response packet 9, workspace archive 8 and Brand Profile 8. Exact supported public formats remain readable through fixture-backed migrations; unsupported future formats fail closed.
• Saved work remains browser-local by default. New fields are shared only through deliberate exports or actions.
• Offline planning, file review and verification commands remain offline. Incomplete evidence does not establish absence, ownership, maliciousness or successful remediation.
• Back up retained work before upgrading. An older application may not read newer saved formats, so an application rollback is not a data-format downgrade.

Verification

• Released from b4f7fd940b04ea07e3f0b1e3b23e8d92c6cbc6c5, verified on the production website and through post-merge CI.
• 4,902 unit tests across 564 suites, 12 mutation checks and 507 browser checks passed. Browser failures, retries, flakes and skips: zero.
• Post-merge coverage: 95.54% lines, 84.06% branches and 93.82% functions. Package, compatibility, privacy, architecture, loading and security gates passed.
• Tagged candidate preparation and staging passed 25 package-contract tests and 78 installed checks, with zero production dependency vulnerability entries.
• Candidate assembly compiled 336 sources and packed 347 entries: 1,285,707 packed bytes and 5,630,523 unpacked bytes. The published npm archive and its dependency pins match that approved candidate exactly.

Archive SHA-256: 38fa20226ab33036ad66510321e57387dde2a5f868b5ad7907487e07612ec9ba.

Install

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.3.0

Or run without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.3.0 -- whoisleuth --help

Publication used the reviewed trusted-staging workflow with maintainer approval. Post-publication verification passed against the exact approved candidate; observed signature and provenance metadata are not an independent cryptographic attestation check.

Full changelog

WHOISleuth CLI v2.2.0

Added

• Evidence-led Case workflows with controlled incident classifications, stable browser-local Case references, explicit response stages and evidence-linked conclusions.
• Separate Brand allowlist management, action-oriented analyst review queues and Case-local rendered-capture hand-off.
• Bounded official platform and infrastructure-provider reporting routes, plus practical public guidance for preparing reports without submitting complaints automatically.

Improved

• Case response preparation now carries exact incident context, deliberate action transitions, packet digests and independent recheck outcomes more clearly from investigation through monitoring.
• Imported findings, reporting contacts and review states preserve missing, conflicting, stale and unreviewed evidence instead of implying unsupported conclusions.
• Public and authenticated layouts have more consistent scanline rendering and stronger narrow-screen coverage.
• Local and hosted verification now share a deterministic required-CI boundary. Live registry auditing remains fail-closed in weekly maintenance and tagged releases without delaying every pull-request install.

Compatibility and safety

• The current Case, response-packet, report and workspace contract versions are unchanged, with the existing latest-public compatibility fixtures retained.
• Saved investigations remain browser-local by default. Reporting destinations are guidance only; WHOISleuth does not submit complaints or make analyst decisions automatically.
• Incident URLs remain analyst-selected, and source evidence is not promoted into an automatic maliciousness, ownership or takedown verdict.
• Existing Fast, Compact, Bulk and scheduled-monitor request boundaries remain explicit; offline planning and verification commands remain offline.

Verification

• The tagged source at 16f81977 passed the complete pull-request and protected-main CI matrices, both CodeQL analyses and dependency review.
• 4,760 unit tests passed across 558 suites. Coverage was 95.86% lines, 83.93% branches and 94.01% functions; all seven reviewed critical mutants were killed.
• 490/490 built-browser tests passed: 476 functional and 14 isolated performance tests, with zero failures, retries, flakes or skips.
• The tagged release audit reported zero production vulnerability entries; production dependency notices passed for 162 packages.
• The trusted release workflow assembled 332 dependency-closure modules and 343 packed files. The candidate and public registry archive are both 1,267,993 bytes with SHA-256 c7021b3e8b416c3eecbf6f4c5e51dfade9558eba31cc8216fa00061153d39c07.
• The decompressed tar payload is byte-identical to the reviewed candidate, with SHA-256 e518f45d9d88a145ad07833e364965a10340c3884266bbe76547fe53eee8b945; unpacked files total 5,580,027 bytes.
• Exact runtime dependency pins, one registry signature metadata record and the SLSA provenance v1 predicate were observed. The signature and provenance records were not independently cryptographically verified.
• The exact public package passed an isolated version check, offline doctor and zero-request Lookup-plan smoke test.

Install

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.2.0

Or run it without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.2.0 -- whoisleuth --help

Published through the reviewed trusted-staging workflow.

Full changelog: v2.1.0...v2.2.0

WHOISleuth CLI v2.1.0

Added

• Complete executable analyst workflows across the Console and installed CLI, covering investigation planning, retained-evidence review, Case hand-off, response preparation, monitoring, recheck and portable verification.
• Registrar accreditation and official compliance context as separately attributed evidence. Registrar standing does not determine domain maliciousness, availability, ownership or control.
• Stronger offline review and portability paths for evidence replay, response packets, change packets, archive inspection and artefact verification.

Improved

• Clarified technology evidence roles so edge networks, application platforms, runtimes and embedded dependencies remain distinct; infrastructure indicators no longer imply origin hosting without supporting evidence.
• Hardened nested Lookup-profile validation, evidence provenance, incomplete states, page-identity evidence and future-version rejection while preserving valid sibling evidence.
• Improved evidence navigation and presentation across desktop and narrow layouts, including stable disclosure geometry and complete access to validated raw Lookup evidence.
• Decomposed large CLI, parser, route and presentation owners, and aligned local and hosted verification around one maintained quality boundary.

Compatibility and safety

• Lookup evidence advances to schema 28 with fixture-backed support for public schema 26 and 27 inputs.
• Public v1.47.4 migration and compatibility boundaries remain intact; unsupported future formats continue to fail closed.
• Fast, Compact, Bulk and scheduled-monitor request budgets remain explicit. New registrar standing context is target-free and makes no target-specific request.
• Browser-local storage, deliberate network actions, source attribution and explicit partial, unavailable and conflicting states are preserved.

Verification

• The tagged source at bba11c13 passed the complete pull-request and protected-main CI matrices, CodeQL and dependency review.
• 4,722 unit tests passed across 552 suites. Coverage was 95.85% lines, 83.91% branches and 94.02% functions; all seven reviewed critical mutants were killed.
• 485/485 built-browser tests passed with zero failures, retries, flakes or skips.
• Typecheck, Svelte check, production build, loading, architecture, ownership, journey, schema, capability, privacy, licence, dependency, package and release gates passed.
• The trusted release workflow assembled 332 dependency-closure modules and 343 packed files. The candidate and public registry archive are both 1,264,834 bytes with SHA-256 e9e23e0edda1f88a53eafe06972a94dc94c7a032f226c72823faf00206307946.
• The decompressed tar payload is byte-identical to the reviewed candidate, with SHA-256 d2047a2c144bb3183906c36d7e3b53bcf81ea44316bac4683a28b8501942c420; unpacked files total 5,565,487 bytes.
• Exact runtime dependency pins, registry integrity, package measurements, one registry signature metadata record and the SLSA provenance v1 predicate were observed. The signature and provenance records were not independently cryptographically verified.
• The exact public package passed isolated version, doctor and zero-request Lookup-plan smoke checks under Node 24.19.0.

Install

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.1.0

Or run it without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.1.0 -- whoisleuth --help

Published through the reviewed trusted-staging workflow.

Full changelog: v2.0.1...v2.1.0

WHOISleuth CLI v2.0.1

Fixed

• Count both registry-to-WHOIS and registry-to-registrar comparisons in the collapsed Registration evidence summary.
• Keep DNS evidence state labels intact at narrow viewport widths.
• Preserve exported Brand Profile modification times when a missing profile is restored from a workspace archive.
• Add focused model, archive and production-browser regressions for each repaired boundary.

Compatibility and safety

• The Brand Profile restore correction is part of the shared workspace implementation used by the browser and installed CLI, so the application and CLI advance together to version 2.0.1.
• No schema, evidence, scoring, request, storage, privacy or network contract changed.
• Public v1.47.4 compatibility fixtures remain unchanged. Only the current Case-pack writer fixture and its generated lifecycle and storage digests were refreshed.

Verification

• The tagged source at 0d10213 passed 4,568 tests across 539 suites, 36 property tests and five killed critical mutants.
• Typecheck, Svelte check, production build, the 21-route loading report, architecture, ownership, schema, 13-contract compatibility, capabilities, public-product, privacy, licence, dependency, Retire.js, CodeQL, secret and diff checks passed.
• The full local production-build browser run passed 471 tests with zero failures, retries, flakes or skips. Fresh pull-request and post-merge unit, quality and both browser-shard checks also passed.
• The trusted release workflow rebuilt and staged 300 dependency-closure modules and 311 packed files. The public archive is 1,209,089 bytes; its candidate and registry SHA-256 is ba004e504e7d078f290587bca744bff724ad51dd93c04f550118d62db178b382.
• The decompressed tar payload is byte-identical to the reviewed candidate, with SHA-256 e3bce5cda291eaa185249a68afbd06976d6f114d78e031093d3f0ea390f2cf96. The unpacked package is 5,323,426 bytes.
• Post-publication verification passed for metadata, registry integrity, candidate payload identity, archive measurements and exact runtime dependency pins. One registry signature metadata record and the SLSA provenance v1 predicate were observed; these records were not independently cryptographically verified.
• The exact public package was installed in an isolated temporary home. Version, doctor and a zero-request Lookup plan passed.

Install

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.0.1

Or run it without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.0.1 -- whoisleuth --help

Published through the reviewed trusted-staging workflow with maintainer approval.

Full changelog: v2.0.0...v2.0.1

WHOISleuth CLI v2.0.0

Highlights

• Expanded WHOISleuth into a complete evidence workbench across the browser and CLI, with bounded Lookup review, source-aware evidence navigation, explainable Decision Facts, portable Cases and Brand Asset Registers, and explicit Investigate, Respond and Assure workflows.
• Added richer local CLI workflows for Lookup planning and terminal review, bulk and discovery work, evidence and archive verification, comparisons, briefs, response packages, interchange and replay.
• Improved the public resources and CLI reference, application navigation, accessibility, light and dark themes, loading behaviour and search metadata.
• Centralised product, capability, schema, evidence, Case, workspace and interchange contracts so generated catalogues and compatibility checks derive from their canonical owners.
• Hardened untrusted evidence, browser-local storage, imports, ZIP archives, concurrent updates, package assembly and network boundaries while retaining explicit partial, unavailable, unsupported and inconclusive states.

Compatibility and safety

• This is a major release. Documented durable formats from the latest public v1.47.4 release migrate directly to current v2; unreleased intermediate v2 checkpoints are not accepted as public compatibility targets.
• CLI output and artefact schemas remain versioned and fail closed on unsupported future versions. Automations that parse v1 output should validate against the v2 contracts before upgrading.
• Fast, Compact and Deep collection remain distinct. Networked commands disclose their targets and collection scope, while offline commands remain offline.
• Missing or failed evidence does not become absence, safety, ownership or intent, and registry, DNS, transport, certificate, page and analyst-derived evidence remain separately attributed.
• The CLI requires Node.js 24 or later and retains exact reviewed runtime dependency pins.

Verification

• The tagged source at 2c94beb1 passed 4,565 tests across 539 suites, with 94.73% line, 82.87% branch and 92.52% function coverage.
• Both hosted browser shards passed 472 tests with zero failures, skips, retries, flaky classifications or extra attempts. Code scanning, release, package, architecture, schema, compatibility, privacy, licence, dependency, loading, type and build checks passed.
• The trusted package workflow verified 300 dependency-closure modules, 311 packed entries and the installed CLI command, help, completion, planning, archive, evidence and offline-network boundaries.
• The public registry archive is 1,209,080 bytes with SHA-256 ecd3cdfb78df26200aef590c7bcf47ad81431ceae6889a7df5e38bb424872f97. Its tar payload is byte-identical to the reviewed candidate, with SHA-256 a19057e10b079f232bbde666cebe9b6f2faed50179817a7f59dfa31af953cf43.
• Post-publication verification passed for metadata, registry SHA-512/SHA-1 integrity, candidate identity, archive measurements, exact runtime dependencies, one registry signature metadata record and the SLSA provenance predicate. The candidate was installed and exercised; the post-publication comparison remained read-only and did not execute the downloaded registry package. Signature and provenance records were observed as registry metadata rather than independently cryptographically verified.

Install

npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@2.0.0

Or run it without a global installation:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli@2.0.0 -- whoisleuth --help

Published through the reviewed trusted-staging workflow with maintainer approval.

Full changelog: v1.47.4...v2.0.0