fix(oscfg): support 1.4.3 direct audit responses

[Amir Bredy (ABMFST)]

Summary

• normalize direct oscfg exec resource object, singleton-array, and wrapped-array response shapes
• fix pre-deploy Audit with oscfg 1.4.3, which returns [resource] where 1.3.x returns resource
• preserve multi-resource list mode while rejecting ambiguous multi-item get/set/remove responses
• prepare the v0.3.102 Windows/Linux release and align current macOS Author release references

Live reproduction

On a Windows Server 2025 Hyper-V VM, ConfigForge v0.3.101 with oscfg 1.4.3 audited five CSP rules plus one User Rights Test as 6/6 indeterminate before deployment because each direct exec response was a singleton array. The same manifest enforced successfully and post-audited 6/6 compliant through namespace output. This patch normalizes the direct response so pre-deploy Audit can evaluate the same resources.

Validation

• live v0.3.101 / oscfg 1.4.3 reproduction captured
• dependency-free public-package and public-registry guards pass locally
• package and lockfile versions agree at 0.3.102
• full Vitest, lint, build, Playwright, Node 24, production audit, and CodeQL run in hosted GitHub Actions per device policy

[Copilot]

Pull request overview

Updates the core OSConfig CLI wrapper to handle OSConfig 1.4.3’s changed oscfg exec resource JSON shape (singleton arrays), restoring correct pre-deploy Audit evaluation, and bumps release metadata/docs to v0.3.102.

Changes:

• Normalize direct exec resource outputs across object vs singleton-array vs wrapped-array shapes, while preserving list mode and rejecting ambiguous multi-item direct responses.
• Add targeted unit tests covering the new response normalization behavior.
• Prepare v0.3.102 release metadata: versions bumped and docs updated to current Full + macOS Author prerelease references.

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
SECURITY.md	Updates supported-version references for Full and macOS Author prereleases.
scripts/release-metadata.test.mjs	Adjusts assertions to match updated security/version policy text.
README.md	Refreshes current release references and highlights v0.3.102 audit-compat fix in the version table.
packages/core/src/oscfg/get.ts	Renames/exports array-normalizer helper for broader CLI-response shape normalization.
packages/core/src/oscfg/exec.ts	Normalizes exec resource results across 1.3.x vs 1.4.3 shapes; preserves list mode; rejects ambiguous multi-resource direct responses.
packages/core/src/oscfg/exec.test.ts	Adds unit tests for execResource response normalization scenarios.
package.json	Bumps root package version to 0.3.102.
package-lock.json	Aligns lockfile versions to 0.3.102.
INSTALL.md	Updates install docs to current Full and macOS Author prerelease references.
docs/src/quick-start/install-run.md	Updates quick-start docs to current Full and macOS Author prerelease references.
docs/src/operations/ci.md	Updates macOS author release tag and asset contract examples to the current prerelease.
docs/src/introduction.md	Refreshes intro docs to current Full and macOS Author prerelease references.
docs/src/changelog.md	Adds v0.3.102 changelog entry describing the OSConfig 1.4.3 audit compatibility fix.
docs/src/architecture/system-overview.md	Updates the referenced current version to 0.3.102.
CHANGELOG.md	Adds 0.3.102 entry documenting the OSConfig 1.4.3 direct exec normalization fix.
apps/desktop/PACKAGING.md	Updates packaging doc version reference to v0.3.102.
apps/desktop/package.json	Bumps desktop workspace version to 0.3.102.
AGENTS.md	Updates branch/release reference snapshot to v0.3.102 and mac-v0.3.101-author.1.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.