Toolip v1.0.7 — Package Recovery and Scanner Accuracy

Toolip v1.0.7 restores a fully functional npm package and hardens the release pipeline.

Critical fix:

• Restores the compiled dist/src CLI files missing from v1.0.6.
• Verifies the actual npm tarball contains the executable before publication.
• Installs and runs the packed tarball in an isolated environment before release.
• Adds a mandatory prepack build and package verification step.

Accuracy fixes:

• Uses package.json as the single source of truth for the CLI version.
• Prevents RegExp.exec() from being reported as child_process.exec().
• Restricts dangerous-code detection to executable source files.
• Prevents JSON reports containing prior findings from being rescanned as executable vulnerabilities.
• Downgrades password-like test fixtures to low severity.
• Retains detection of genuine shell exec() calls.

Verification:

• TypeScript typecheck passes.
• Full Vitest suite passes.
• Clean production build passes.
• Package structure verification passes.
• Packed tarball installation passes.
• CLI version, help, and self-test pass from the packed artifact.

Built by Ashibuogwu Williams (wbizmo).