rigscore v2.0.0

Changes: v1.0.0 → v2.0.0

Public-release hardening pass. Four parallel tracks — security, distribution, scoring, docs — plus a dogfood-fixture fix. The scoring change is the reason this is a major bump.

Breaking

• Continuous coverage scaling — the step at totalApplicableWeight < 50 is gone; scaling is now scale = min(1, totalApplicableWeight / 100), applied always. Overall scores shift downward for projects with applicable weight 50–100; recalibrate --fail-under thresholds.

Security

• ANSI escape injection closed — stripAnsi applied to every file-sourced field before Chalk wrapping, blocking terminal-hijack payloads planted in scanned skill files
• Atomic saveState — state writes go to a temp file and are rename()’d in place, preventing SIGINT / concurrent-scan corruption
• Strict config parsing — ConfigParseError + readJsonStrict; the CLI exits 2 with a clear message instead of a raw Node stack
• Symlink-loop defense — shared walkDirSafe with lstat + visited-inode set + maxDepth; an info finding surfaces once per skipped cycle
• Network timeout + per-file cap — fetch wrapped in a 5s AbortController; the deep scanner skips files over 512 KB
• windows-security desynced — synchronous execSync replaced with the promisified execSafe, no event-loop blocking

Distribution

• Lockfile regenerated — built against package.json 1.0.0; npm ci is reproducible again
• Runtime + dev deps pinned to exact versions — caret ranges on chalk, yaml, vitest gone; no re-resolving deps on every install
• engines.node floor → >=18.17.0 — fs.promises.readdir({ recursive: true }) guaranteed available
• User-Agent derived from package.json — createRequire at module load; no more hardcoded version drift
• --init-hook pins @v${pkg.version} — writes the current tag into .git/hooks/pre-commit; re-installs warn rather than append
• CI matrix expanded — Node 18.17 / 20 / 22 across ubuntu and macos, with a lockfile-drift guard
• Dockerfile hardened — non-root rigscore user runs the scan; ARG VERSION + OCI labels; no longer reads /workspace as root
• action.yml stops swallowing crashes — 2>/dev/null || true removed; validates callers pin to a semver tag, not @main

Docs

• README — Platform notes + Exit codes — WSL / macOS / Git Bash / Docker Desktop behaviour documented; CI authors can branch on exit codes
• docs/FINDING_IDS.md — enumerates every emitted findingId, documents the <check>/<slug> schema and stability contract
• README — Advisory escalation, First run, Documentation sections — new
• docs/TROUBLESHOOTING.md — new
• docs/examples/ starter governance templates — Cursor, Cline, Continue, Windsurf, Aider

Scoring & checks

• claude-md → NOT_APPLICABLE on non-AI dirs — returns NOT_APPLICABLE (not CRITICAL) with no AI tooling markers; a banner points to --include-home-skills; generic hygiene still scores
• Narrowed claude-md anti-injection keyword — bare injection (which gave “dependency injection” credit) rejected for specific prompt-injection patterns
• skill-files — defensive-context suppression in shell-exec — fixes false fires on Do not use curl http://; findings carry a matches: N count and escalate to CRITICAL at ≥ 3
• deep-secrets — no blanket dotfile skip — config/.env.production and similar now scanned; SKIP_DIRS extended with machine-generated dotfolders

Test hygiene

• test/fixture-dogfood.test.js scrubs .rigscore-state.json from the fixture dir beforeEach / afterEach; fixture .gitignore lists the state file. A prior run’s per-user mode-0600 state file can no longer mask the mcp-config check and drift the locked finding count.

github.com/Back-Road-Creative/rigscore