fix(oscfg): support 1.4.3 direct audit responses

AGENTS.md

@@ -19,13 +19,12 @@ The following release references were verified on 2026-08-06:
 
 | Line | Reference | State |
 |---|---|---|
-| `main` | `v0.3.101` | Current Windows/Linux release. It clears the remaining GitHub security alerts after the v0.3.100 js-yaml hotfix. |
-| `mac-author-build` | `mac-v0.3.98-author.1` | Current author-only macOS tagged source. The matching GitHub release is a draft and unpublished with the same public documentation corrections. |
+| `main` | `v0.3.102` | Current Windows/Linux release. It fixes pre-deploy Audit compatibility with OSConfig 1.4.3 single-resource array responses. |
+| `mac-author-build` | `mac-v0.3.101-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. |
 
 On `mac-author-build`, the root package, desktop package, and lockfile records
-use `0.3.98-author.1`. The current macOS Author tagged source is
-`mac-v0.3.98-author.1`, and its matching GitHub release remains a draft and
-unpublished. The Full-edition package versions are `0.3.101`; do not copy
+use `0.3.101-author.1`. The current macOS Author release is
+`mac-v0.3.101-author.1`. The Full-edition package versions are `0.3.102`; do not copy
 macOS package metadata to `main`.
 
 ### Current feature inventory
@@ -449,12 +448,11 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann
   errors, the desktop build, and a production audit with 0 vulnerabilities.
 - Historical `0.3.93-author.1` and `0.3.93-author.2` validation records are
   superseded; their tags/releases no longer exist. Use the current
-  `mac-v0.3.98-author.1` unpublished draft release metadata and current GitHub
+  `mac-v0.3.101-author.1` prerelease metadata and current GitHub
   checks as the authority for macOS Author build and asset status.
-- The current macOS Author tagged source is `mac-v0.3.98-author.1`, with an
-  unpublished draft release. Use current GitHub checks and release metadata
-  as the authority for build and asset status rather than recording a merge
-  SHA or workflow run here.
+- The current macOS Author release is `mac-v0.3.101-author.1`. Use current
+  GitHub checks and release metadata as the authority for build and asset
+  status rather than recording a merge SHA or workflow run here.
 
 ---
 

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.3.102] - 2026-08-08
+
+### Fixed
+
+- Normalize single-resource array responses from OSConfig 1.4.3 direct
+  `exec resource` calls. Pre-deploy Audit now evaluates CSP, Registry, Test,
+  and User Rights resources instead of reporting them as indeterminate or
+  "could not read" solely because the CLI returned `[resource]` rather than
+  `resource`.
+
 ## [Unreleased]
 
 ## [0.3.101] - 2026-08-07

INSTALL.md

@@ -8,10 +8,10 @@ ConfigForge has two editions:
   and Audit Pack export are available. Device Deploy, Audit, and Revert are
   intentionally omitted.
 
-The current Windows/Linux release is `v0.3.101`. The current macOS Author tagged source is
-`mac-v0.3.98-author.1`, and its matching GitHub release is also a draft and
-unpublished. The package versions are `0.3.101` for the Full edition and
-`0.3.98-author.1` for the macOS Author edition.
+The current Windows/Linux release is `v0.3.102`. The current macOS Author
+release is `mac-v0.3.101-author.1`; both are published as prereleases. The
+package versions are `0.3.102` for the Full edition and `0.3.101-author.1`
+for the macOS Author edition.
 
 ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source.
 
@@ -127,12 +127,10 @@ later). The release contains an ARM64-only binary. It is not an x64 or
 universal build and does not support Intel Macs. Rosetta does not provide
 ARM64-on-Intel compatibility.
 
-The current macOS Author tagged source is `mac-v0.3.98-author.1`. Its matching
-GitHub release is a draft and is not available from the public
+The current macOS Author release is `mac-v0.3.101-author.1`, published as a
+prerelease on the
 [Azure/ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
-page until a maintainer publishes it. Users can build the tagged source by
-following the instructions in the
-[Azure/ConfigForge repository](https://github.com/Azure/ConfigForge).
+page. Users can also build the tagged source from the repository.
 
 The app is unsigned and not notarized. Copy **ConfigForge Author.app** to
 `/Applications`, then clear the browser-added quarantine attribute once:

README.md

@@ -6,10 +6,10 @@
 
 > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps.
 
-The current Windows/Linux release is `v0.3.101`. The current macOS Author tagged source is
-`mac-v0.3.98-author.1`, and its matching GitHub release is also a draft and
-unpublished. The package versions are `0.3.101` for the Full edition and
-`0.3.98-author.1` for the macOS Author edition.
+The current Windows/Linux release is `v0.3.102`. The current macOS Author
+release is `mac-v0.3.101-author.1`; both are published as prereleases. The
+package versions are `0.3.102` for the Full edition and `0.3.101-author.1`
+for the macOS Author edition.
 
 ## Export to Azure Machine Configuration
 
@@ -250,20 +250,22 @@ is not a universal binary.
 
 | Version | Highlights |
 |---|---|
-| **0.3.101** (current Windows/Linux release) | Clears the remaining GitHub security alerts with patched DOMPurify, fast-uri, ip-address, React Router, and Undici releases |
+| **0.3.102** (current Windows/Linux release) | Fixes pre-deploy Audit with OSConfig 1.4.3 so single-resource CSP, Registry, Test, and User Rights reads are evaluated instead of reported as indeterminate |
+| **0.3.101** (prior Windows/Linux release) | Clears the remaining GitHub security alerts with patched DOMPurify, fast-uri, ip-address, React Router, and Undici releases |
 | **0.3.100** (prior Windows/Linux release) | Updates js-yaml to the patched 4.3.1 release for `GHSA-5p4m-2wfm-xmqj` |
 | **0.3.99** (prior Windows/Linux release) | Verifies Enforce results, preserves exact QWords, keeps Revert safe, repairs WS2022 readability, and adds Machine Configuration Set compatibility |
 | **0.3.98** (prior Windows/Linux release) | Adds complete Machine Configuration deployment documentation and removes stale/internal public-doc guidance |
-| **0.3.98-author.1** (current macOS tagged source; draft unpublished) | Ports the same public documentation and Machine Configuration guidance to macOS Author |
+| **0.3.101-author.1** (current macOS prerelease) | Ports the author-safe baseline, lossless data, Machine Configuration packaging, build, and security fixes |
+| **0.3.98-author.1** (prior macOS prerelease) | Ports the public documentation and Machine Configuration guidance to macOS Author |
 | **0.3.97** (prior Windows/Linux draft) | Preserves authoritative CLI reasons for expression-backed Test resources and adds detailed templates to all WS2025 controls |
 | **0.3.97-author.1** (prior macOS draft) | Ports the same detailed audit-reason behavior to the author-only macOS line |
 | **0.3.96** (prior Windows/Linux draft) | Preserves all 320/321/296 WS2025 controls while fixing Registry/CSP contracts and CEL compliance, and hardens Machine Configuration MOF export in PR #104 |
 | **0.3.96-author.1** (prior macOS draft) | Ports the same WS2025 authoring and global MOF export fixes to the author-only macOS line in PR #105 |
 | **0.3.95** (prior Windows/Linux draft) | Replaces unreliable native hover titles with FluentUI tooltips on My Baselines status cells (keyboard accessible, ARIA-exposed multiline details) in PR #100; corrects documentation architecture and release-state drift in PR #97 |
 | **0.3.94** (prior Full edition) | Excludes CIS benchmark source data from public installers, publishes the public licensing/privacy/support/security policy surface, patches dev-only `brace-expansion` 5.x, and refreshes nine README screenshots with synthetic benchmark content in PR #89 |
 | **0.3.94-author.1** (prior macOS draft) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations |
-| **0.3.93-author.2** (historical macOS source milestone; no current tag or release) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83/#84. Historical workflow evidence is superseded by the current `mac-v0.3.98-author.1` draft release metadata. |
-| **0.3.93-author.1** (historical macOS source milestone; no current tag or release) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77. Historical workflow evidence is superseded by the current `mac-v0.3.98-author.1` draft release metadata. |
+| **0.3.93-author.2** (historical macOS source milestone; no current tag or release) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83/#84. Historical workflow evidence is superseded by the current `mac-v0.3.101-author.1` prerelease metadata. |
+| **0.3.93-author.1** (historical macOS source milestone; no current tag or release) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77. Historical workflow evidence is superseded by the current `mac-v0.3.101-author.1` prerelease metadata. |
 | **0.3.93** (prior Full edition) | Adds nested Enter/Tab editing and repairs standalone Windows Server 2025 audits, CIS mapping, and Matrix Diff policy identity handling |
 | **0.3.92** | Patches the desktop updater, AppImage packager, PostCSS processor, and archive toolchain against newly disclosed vulnerabilities |
 | **0.3.91** | Shows stacked Test schema rules in Visual mode and enforces supported constraints on newly edited values |

SECURITY.md

@@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged source lines.
 
 | Edition | Current version | Security updates |
 | --- | --- | --- |
-| Full edition for Windows and Linux | `v0.3.101` | Supported release |
-| macOS Author edition | `mac-v0.3.98-author.1` | Supported tagged source; release remains a draft |
+| Full edition for Windows and Linux | `v0.3.102` | Supported published prerelease |
+| macOS Author edition | `mac-v0.3.101-author.1` | Supported published prerelease |
 | Older versions | Earlier tags | Not supported |
 
 ## Security scope

apps/desktop/PACKAGING.md

@@ -9,7 +9,7 @@
 > flavor lives on the `mac-author-build` branch and uses its own
 > `electron-builder.author.yml`.
 >
-> **Current through v0.3.101:** the release pipeline generates a
+> **Current through v0.3.102:** the release pipeline generates a
 > CycloneDX SBOM per platform, enforces
 > `npm audit --omit=dev --audit-level=high` as a release gate,
 > pins `electron-builder` invocation via `npx --no-install`, and

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@configforge/desktop",
-  "version": "0.3.101",
+  "version": "0.3.102",
   "private": true,
   "description": "ConfigForge \u2014 OSConfig Baseline Editing tool",
   "main": "./dist/electron/main.js",

docs/src/architecture/system-overview.md

@@ -1,6 +1,6 @@
 # System overview
 
-ConfigForge **0.3.101** is an Electron desktop app for authoring, validating, comparing, and deploying/auditing OSConfig manifests (`.osc.yaml`). The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package.
+ConfigForge **0.3.102** is an Electron desktop app for authoring, validating, comparing, and deploying/auditing OSConfig manifests (`.osc.yaml`). The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package.
 
 There is no HTTP server, database, queue, or microservice layer in the current app. Renderer code calls the Electron preload bridge (`window.cfs.*`), the main process validates IPC payloads, and pure handlers in `packages/core` own filesystem and CLI operations.
 

docs/src/changelog.md

@@ -6,6 +6,13 @@ foundational work by theme.
 
 ## Unreleased
 
+## v0.3.102 - 2026-08-08
+
+- **OSConfig 1.4.3 audit compatibility:** Pre-deploy Audit now unwraps the
+  CLI's single-resource array response so CSP, Registry, Test, and User Rights
+  resources produce real compliance results instead of false "could not read"
+  outcomes.
+
 ## v0.3.101 — 2026-08-07
 
 - **Dependency security:** Update DOMPurify, fast-uri, ip-address, React

docs/src/introduction.md

@@ -20,10 +20,10 @@ application** with two editions:
   and elevation methods under `system`) are intentionally omitted. Authors
   deploy later from the Full edition on Windows or Linux.
 
-The current Windows/Linux release is `v0.3.101`. The current macOS Author tagged source is
-`mac-v0.3.98-author.1`, and its matching GitHub release is also a draft and
-unpublished. The package versions are `0.3.101` for the Full edition and
-`0.3.98-author.1` for the macOS Author edition.
+The current Windows/Linux release is `v0.3.102`. The current macOS Author
+release is `mac-v0.3.101-author.1`; both are published as prereleases. The
+package versions are `0.3.102` for the Full edition and `0.3.101-author.1`
+for the macOS Author edition.
 
 If you've ever maintained a security baseline by editing GPO templates, exporting Defender for Endpoint settings to a spreadsheet, or copy-pasting between half a dozen runbooks - this app is for you.
 

docs/src/operations/ci.md

@@ -71,25 +71,25 @@ the immutable macOS tag:
 gh workflow run "Release (macOS author)" \
   --repo Azure/ConfigForge \
   --ref main \
-  -f release_tag=mac-v0.3.98-author.1
+  -f release_tag=mac-v0.3.101-author.1
 ```
 
 The target draft release and tag must already exist. The workflow loads its
 definition from `main`, checks out `release_tag`, verifies that
 `HEAD` resolves to the tag, checks that tagged tree with the dependency-free
 public-asset guard from protected `main`, then builds with
 `electron-builder.author.yml`.
-The `mac-v0.3.98-author.1` release contract expects exactly these assets:
+The `mac-v0.3.101-author.1` release contract expects exactly these assets:
 
-1. `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg`
-2. `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg.blockmap`
+1. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg`
+2. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap`
 3. `latest-mac.yml`
 4. `sbom-macos-author.cdx.json`
 5. `SHA256SUMS-macos-author.txt`
 
 The workflow refuses a published release and never publishes automatically.
-For `mac-v0.3.98-author.1`, use the current GitHub checks and draft release as
-the authority for actual build and asset status.
+For `mac-v0.3.101-author.1`, use the current GitHub checks and published
+prerelease as the authority for actual build and asset status.
 
 ## Linux runner notes
 

docs/src/quick-start/install-run.md

@@ -8,10 +8,10 @@ Benchmark Mapping, history, rationale, and Audit Pack export while omitting
 device operations. The native `oscfg` CLI is **not bundled** and is **not
 required** for authoring in either edition.
 
-The current Windows/Linux release is `v0.3.101`. The current macOS Author tagged source is
-`mac-v0.3.98-author.1`, and its matching GitHub release is also a draft and
-unpublished. The package versions are `0.3.101` for the Full edition and
-`0.3.98-author.1` for the macOS Author edition.
+The current Windows/Linux release is `v0.3.102`. The current macOS Author
+release is `mac-v0.3.101-author.1`; both are published as prereleases. The
+package versions are `0.3.102` for the Full edition and `0.3.101-author.1`
+for the macOS Author edition.
 
 ## Prerequisites
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "configforge",
-  "version": "0.3.101",
+  "version": "0.3.102",
   "private": true,
   "license": "MIT",
   "description": "ConfigForge \u2014 Cross-platform Electron desktop app for OSConfig security baseline authoring",