CodeInspectus 3.3.1 — Hardening patch

Hardening patch

CodeInspectus 3.3.1 fixes issues found by running 3.3.0 against hostile inputs. Upgrading is recommended.

Security

• MCP scan, rescan, generate_sbom and plan_cleanup refuse empty or relative paths. These used to resolve against the MCP server's working directory, so a client could act on a directory it did not mean.
• The TypeScript SDK passes paths to the CLI as absolute paths and refuses IDs that start with -, so untrusted input such as --working-tree can't become a CLI option.
• Finding snippets from configuration files (YAML, .env, .npmrc, INI, TOML, properties, HCL) mask unquoted credential values such as client_secret: supersecretvalue. Placeholders like ${VAR} are kept.
• Text output escapes line breaks and bidirectional controls in file names, notes and warnings. A file name containing a newline could fake a line, such as a fake critical finding.
• issue export turns < and & into HTML entities and shows zero-width and bidirectional characters as visible escapes.
• Git child processes no longer inherit GIT_*_PATHSPECS from the caller.

Fixed

• Triage annotations follow a finding that only moved lines. A duplicated line never inherits the original's triage state.
• Rescan compares against the latest full scan, never a newer Git-scoped or history scan.
• Scanning a subdirectory only reports AI co-author trailers from commits that touched it.
• Compressed PNG text chunks (zTXt, iTXt) are checked for explicit AI declarations, with a 256 KiB decompression bound.
• Under --severity, the headline no longer prints misleading zero counts for hidden levels.
• --output /tmp/... works on macOS. Whether the output is inside the scanned repository is checked on the real path.
• Setup advice points to npx codeinspectus setup or the codeinspectus_setup tool.

Export 3.0.0, repository-trust 1.0.0 and cleanup 1.0.0 contracts are unchanged.

See CHANGELOG.md for the complete notes.