[hivecommons-hive]

• Review backlog (docs-currency): Header docstring never documents the optional package exception field #523: the header docstring now documents the optional package field (scope, one GHSA per package, omitted = all packages) so operators can discover it.
• Review backlog (intent-alignment): Empty-string package no longer acts as wildcard #524: exceptionKey treats an empty package like an omitted one, restoring pre-🐛 fix: honour every package-scoped npm audit exception for one GHSA #521 wildcard behaviour instead of a dead ID: key; test added.
• Review backlog (correctness): Unused-exception warning omits package, ambiguous with multiple entries per GHSA #525: the unused-exception warning now includes the package (* when unscoped) so sibling entries for one GHSA are distinguishable; test updated.

Closes #523
Closes #524
Closes #525

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

❌ Deploy Preview for hivecommons-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	df74571
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6ae41a6ee2d6b62a5c46dad5

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

The logic is correct; the only thing blocking this is Prettier.

Checked against the tree:

• scripts/npm-audit-gate.ts:131 pkg || "*" — with exceptionKey(ex.id, ex.package) at :163 and the lookup at :175-177 (scoped key first, then unscoped fallback), an exception with package: "" now lands under ID:* and matches every affected package. That is the pre-#521 behaviour #524 asks for; the new test at npm-audit-gate.test.ts:187-191 pins it.
• :249 the unused warning prints (${ex.package || "*"}), and the main test at :425 asserts (nope) for the scoped entry — consistent with #525.
• Header docstring (:15-18) covers #523. Changelog fragment name follows fixed-<issue>-….

Why CI is red — the diff's fault, one-line fix: the TypeScript & ESLint job fails at npm run format:check:

[warn] scripts/npm-audit-gate.test.ts
Code style issues found in the above file. Run Prettier with --write to fix.

npm-audit-gate.test.ts:425 is 91 columns against printWidth: 80 in .prettierrc. Prettier wants the regex on its own line:

    expect(out).toMatch(
      /::warning::Unused npm audit exception GHSA-zzzz-zzzz-zzzz \(nope\)/
    );

The Netlify failures are the deploy preview and derive from the same job, not from the content. Once npx prettier --write scripts/npm-audit-gate.test.ts is pushed this looks correct to me.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

The four red Netlify contexts (deploy-preview, Pages changed, Header rules, Redirect rules) are a shared repository incident, not this PR: main's own deploy errors the same way (skipped, no build). Tracked in #527; deferring Netlify-related repair here until it closes. TypeScript & ESLint and Lint and build are green on this head.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read scripts/npm-audit-gate.ts at df74571 end to end, not just the diff. This looks correct to me.

• exceptionKey (scripts/npm-audit-gate.ts:131-133): pkg || "*" is applied on both sides — when the exception is inserted into active (L163) and when an advisory is looked up (L175-177) — so an exception with package: "" now lands on the same GHSA-…:* key the lookup falls back to. Before, ?? produced a dead GHSA-…: key that could never match an advisory (advisories always carry a non-empty package from collectAdvisories, L112), which is the #524 bug.
• The unused-exception warning (L247-250) now includes ex.package || "*", so two entries for one GHSA scoped to different packages are distinguishable in the Actions annotation (#525).
• Header docstring (L15-18) documents the field (#523).

Ran npx vitest run scripts/npm-audit-gate.test.ts at the PR head: 36/36 pass. The new treats an empty package as an unscoped exception test fails on main (the exception would be reported as unused and the advisory as blocking), so it pins the fix.

Open question, not a defect: the three Netlify checks (Header rules, Pages changed, Redirect rules, deploy-preview) are red on a PR that touches only scripts/ and changelog.d/. main has no Netlify check-runs I can compare against, and I cannot read the Netlify log from here. Probably a preview-build infrastructure issue rather than this diff, but someone with Netlify access should confirm before merging.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#526df74571` sha256:309177ebb42024fec489689623e09cae8b8dc13f601a8f09f7e770f4b4db2029 — download from the dashboard or `hivectl review evidence #526`.