Fix the BOM-migration regex that ate the previous line at 8 sites

The migration in d391aa6 used a value-capture regex that included
[\s\S]{0,50}? so the match could cross a newline. At 8 sites the rewriter
consumed the assignment line before each ConvertTo-Json pipeline and produced
two garbled lines: `Save-TcpkJson -Value $path = Join-Path $Dir 'coverage.json'`
followed by `$obj -Path $path -Depth 6`.

The brace-balance checker did not catch it because the braces still balanced.
The audit died with parse errors on the first affected file loaded, which was
_Coverage.ps1 on the reporter's Windows machine.

Every corrupted site restored to a proper
`Save-TcpkJson -Value $x -Path $p -Depth n` call on its own line:
_Coverage.ps1, _Llm.ps1, _Osv.ps1, three sites in Invoke-TcpkAudit.ps1,
Save-TcpkFileSnapshot.ps1, Save-TcpkRegistrySnapshot.ps1.

Lesson recorded so this class of mistake stays out of future migrations:
never use [\s\S] in a codebase-wide rewriter; eyeball the diff before commit;
ship one file first if the change is unverified on Windows.

Author: V33RU

CHANGELOG.md

@@ -4,6 +4,18 @@ Release history for TCPK. Newest first.
 
 ## Unreleased
 
+**Fix the BOM-migration regex that ate the previous line at 8 sites.** The migration in
+`d391aa6` used a regex with `[\s\S]{0,50}?` in the value capture. That allowed the match
+to cross a newline, so at 8 sites the rewriter consumed the assignment line before each
+`ConvertTo-Json` pipeline and produced two garbled lines like `Save-TcpkJson -Value $path
+= Join-Path $Dir 'coverage.json'` and `$obj -Path $path -Depth 6`. The audit died with
+parse errors on the first affected file loaded (`_Coverage.ps1`, `_Llm.ps1`, `_Osv.ps1`,
+`Invoke-TcpkAudit.ps1`, `Save-TcpkFileSnapshot.ps1`, `Save-TcpkRegistrySnapshot.ps1`).
+The brace balance checker did not catch it because the braces still balanced.
+
+Every corrupted site restored to a proper `Save-TcpkJson -Value $x -Path $p -Depth n`
+call on its own line.
+
 **Fix a bad regex in the pre-flight guard that aborted the whole audit on any Windows
 target.** The guard used `-match '(?i)\Program Files\WindowsApps\'`. .NET regex parses
 `\P` as an invalid Unicode-property escape and throws on compile, before the check loop

TCPK/Private/_Coverage.ps1

@@ -96,8 +96,8 @@ function Save-TcpkCoverage {
     )
     $obj = New-TcpkCoverageManifest -Elevated $Elevated -ProcessAttached $ProcessAttached `
         -AttachedPid $AttachedPid -OnlineCve $OnlineCve -ScanProfile $ScanProfile -GeneratedAt $GeneratedAt
-    Save-TcpkJson -Value $path = Join-Path $Dir 'coverage.json'
-    $obj -Path $path -Depth 6
+    $path = Join-Path $Dir 'coverage.json'
+    Save-TcpkJson -Value $obj -Path $path -Depth 6
     $path
 }
 

TCPK/Private/_Llm.ps1

@@ -66,8 +66,8 @@ function Set-TcpkLlmConfig {
     if ($PSBoundParameters.ContainsKey('BaseUrl'))     { $cfg | Add-Member baseUrl $BaseUrl -Force }
     if ($PSBoundParameters.ContainsKey('ApiKey'))      { $cfg | Add-Member apiKey $ApiKey -Force }
     if ($PSBoundParameters.ContainsKey('Enabled'))     { $cfg | Add-Member enabled $Enabled -Force }
-    if ($PSBoundParameters.ContainsKey('Temperature')) { $cfg | Add-Member temperature Save-TcpkJson -Value $Temperature -Force }
-    $cfg -Path (Get-TcpkLlmConfigPath) -Depth 6
+    if ($PSBoundParameters.ContainsKey('Temperature')) { $cfg | Add-Member temperature $Temperature -Force }
+    Save-TcpkJson -Value $cfg -Path (Get-TcpkLlmConfigPath) -Depth 6
     $script:TcpkLlmConfig = $cfg
     return $cfg
 }

TCPK/Private/_Osv.ps1

@@ -241,7 +241,7 @@ function Get-TcpkOsvCache {
 function Save-TcpkOsvCache {
     [CmdletBinding()] param([Parameter(Mandatory)]$Cache)
     $p = Get-TcpkOsvCachePath
-    try { ([pscustomobject]Save-TcpkJson -Value $Cache) -Path $p -Depth 8 -ErrorAction Stop } catch { }
+    try { Save-TcpkJson -Value ([pscustomobject]$Cache) -Path $p -Depth 8 } catch { }
 }
 
 function Get-TcpkOsvCacheKey { param([string]$Ecosystem, [string]$Name, [string]$Version)

TCPK/Public/Invoke-TcpkAudit.ps1

@@ -975,8 +975,8 @@ function Invoke-TcpkAudit {
     Write-Information -MessageData "  Extracting interesting strings (recon)..." -InformationAction Continue
     $rsSw = [System.Diagnostics.Stopwatch]::StartNew()
     try {
-        $reconStrings = Get-TcpkReconStrings -Path Save-TcpkJson -Value $expanded
-        $reconStrings -Path (Join-Path $OutDir 'strings.json') -Depth 4
+        $reconStrings = Get-TcpkReconStrings -Path $expanded
+        Save-TcpkJson -Value $reconStrings -Path (Join-Path $OutDir 'strings.json') -Depth 4
         Write-Information -MessageData ("  strings.json: {0} URLs, {1} paths, {2} reg keys, {3} IPs, {4} emails, {5} cmd refs" -f `
             @($reconStrings.Urls).Count, @($reconStrings.FilePaths).Count, @($reconStrings.RegistryKeys).Count, `
             @($reconStrings.IpAddresses).Count, @($reconStrings.Emails).Count, @($reconStrings.Commands).Count) -InformationAction Continue
@@ -989,8 +989,8 @@ function Invoke-TcpkAudit {
 
     # --- attack-surface map (synthesized entry-point view; Batch C deliverable) ---
     try {
-        $surface = Save-TcpkJson -Value $findingsFull | Get-TcpkAttackSurface
-        $surface -Path (Join-Path $OutDir 'attack-surface.json') -Depth 6
+        $surface = $findingsFull | Get-TcpkAttackSurface
+        Save-TcpkJson -Value $surface -Path (Join-Path $OutDir 'attack-surface.json') -Depth 6
         $catSummary = (@($surface.Categories) | ForEach-Object { "$($_.Label)=$($_.Count)" }) -join '; '
         $all.Add( (New-TcpkFinding -Module 'recon' -RuleId 'attacksurface.summary' `
             -Severity 'INFO' -Confidence 'Confirmed' `
@@ -1023,8 +1023,8 @@ function Invoke-TcpkAudit {
 
     # --- exploit plan (CVE matches + exploitable findings -> actionable items) ---
     try {
-        $plan = @(Get-TcpkExploitPlan -Findings $findingsFull -CveMatches Save-TcpkJson -Value $cveMatches -Path $expanded)
-        $plan -Path (Join-Path $OutDir 'exploits.json') -Depth 5
+        $plan = @(Get-TcpkExploitPlan -Findings $findingsFull -CveMatches $cveMatches -Path $expanded)
+        Save-TcpkJson -Value $plan -Path (Join-Path $OutDir 'exploits.json') -Depth 5
         $expModules = @($plan | Where-Object { $_.Module }).Count
         Write-Information -MessageData "  exploits.json: $(@($plan).Count) actionable items ($expModules with a framework exploit module)" -InformationAction Continue
         Write-TcpkLog -Level SUCCESS -Component 'exploit.plan' -Message "$(@($plan).Count) items, $expModules with a module" | Out-Null

TCPK/Public/OsIntegration/Save-TcpkFileSnapshot.ps1

@@ -47,8 +47,8 @@ function Save-TcpkFileSnapshot {
             }
         }
     }
-    Confirm-TcpkParentDir -FilePath Save-TcpkJson -Value $OutFile
-    $snap -Path $OutFile -Depth 4
+    Confirm-TcpkParentDir -FilePath $OutFile
+    Save-TcpkJson -Value $snap -Path $OutFile -Depth 4
 
     New-TcpkFinding -Module 'os' -RuleId 'fs.snapshot' `
         -Severity 'INFO' -Confidence 'Confirmed' `

TCPK/Public/OsIntegration/Save-TcpkRegistrySnapshot.ps1

@@ -44,8 +44,8 @@ function Save-TcpkRegistrySnapshot {
             $snap[$kp] = $vals
         }
     }
-    Confirm-TcpkParentDir -FilePath Save-TcpkJson -Value $OutFile
-    $snap -Path $OutFile -Depth 6
+    Confirm-TcpkParentDir -FilePath $OutFile
+    Save-TcpkJson -Value $snap -Path $OutFile -Depth 6
 
     New-TcpkFinding -Module 'os' -RuleId 'registry.snapshot' `
         -Severity 'INFO' -Confidence 'Confirmed' `