diff-sentry 0.11.0__tar.gz → 0.13.0__tar.gz

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/.claude/rules/monitoring.md

@@ -47,12 +47,20 @@ paths:
 
 - **A release is a change.** `release_event` builds a `kind="release"` event (`repo` `pypi/<name>`, run id `pypi__<name>-<version>`, `-r<n>` for files added to a release later) whose files are the members of the new artifacts with content the previous release lacked, labelled `<kind>/<path>` (`wheel/cook.pth`, `sdist/pyproject.toml`), with a unified diff as the patch. It goes through `cli.screen`, so every text and file-structure rule reads it; never add a second scanning path for releases.
 - **Release facts are host-side facts.** `scan_release` turns `event["release"]` into baseline hits beside `scan_provenance` in `cli._baseline_indicators`: `release-new-install-root` (medium), `release-new-dependency` (low), `release-attestation-dropped` (`high`: the previous release had attestations, all of its files or any, and these files have none), `release-publisher-changed` (`high`: a Trusted Publisher, as kind, repository, workflow, environment and a Google publisher's email, case-folded, that the previous release's attestations did not name; it names the repository whose workflow uploaded, not the source it built from, and needs an attested previous release; read from PyPI's provenance URL in the index, retried when PyPI does not serve it) and `release-publisher-lookalike` (`critical`: that publisher's owner differs from a previous one's only by hyphens), and what was not read, all `high`: `release-shadowed-member` (two members of one artifact install to one path, which pip resolves to the `.data` copy), `release-code-not-read` (a changed member that runs, by suffix or as a build file or script, and was not shown as text: too large, past the diff's 20,000 lines, past a text or patch budget, compiled bytecode, a source file declaring a coding it cannot be read in, and a native module whose name, without its ABI tag, the previous release did not have), and `release-not-fully-read` (an artifact not downloaded, not matching its sha256, not read to its end for any reason, or a comparison given up after five attempts, which is screened and alerts on its own). `scan_release_change` is `scan_change` with `release_scope`, which keeps the mention rules (`prompt-injection`, `codeowners-tamper`, `workflow-tamper`, `privileged-fork-trigger`, `ci-bypass`) at `medium` anywhere in a release: a package's files are read by the programs that import them, a package governs no repository, and a comment mentions these as readily as code. The workflow-content rules (`pwn-request`, `workflow-permission-escalation`) keep their severity in every file, a workflow file of the sdist included: wherever a package carries that content, its code or its build can push it into someone's repository (a worm's shape), and every narrower reading tried had a spelling that hid one. Package code that writes only a code-owners file is a known gap.
-- **Artifacts are data.** Download only from `pypi.org` and `files.pythonhosted.org` over https, no redirects, each body checked against the index's sha256; read archives in memory, never extract, never install. Bounds: a download (`DS_RELEASE_MAX_ARTIFACT_MB`, 256), a release (1 GiB or four downloads), a zip's central directory (32 MiB: the largest of the size the end record states and the zip64 records whenever a locator sits before it, the one zipfile reads right before the locator and the one the locator names; never the member count, which zipfile ignores), members per artifact (50,000, a cut noted), decompressed bytes per artifact (256 MiB, counted by a capped stream so a tar header is bounded too), text kept per comparison (256 MiB), text per member (1 MiB; a larger one is compared by its sha256), patch text per event (16 MiB). A download PyPI does not serve is retried, never judged on part of a release.
+- **Artifacts are data.** Download only from `pypi.org` and `files.pythonhosted.org` (and the tag comparison's refs and trees from `github.com` and `api.github.com`) over https, no redirects, each body checked against the index's sha256; read archives in memory, never extract, never install. Bounds: a download (`DS_RELEASE_MAX_ARTIFACT_MB`, 256), a release (1 GiB or four downloads), a zip's central directory (32 MiB: the largest of the size the end record states and the zip64 records whenever a locator sits before it, the one zipfile reads right before the locator and the one the locator names; never the member count, which zipfile ignores), members per artifact (50,000, a cut noted), decompressed bytes per artifact (256 MiB, counted by a capped stream so a tar header is bounded too), text kept per comparison (256 MiB), text per member (1 MiB; a larger one is compared by its sha256), patch text per event (16 MiB). A download PyPI does not serve is retried, never judged on part of a release.
 - **Two passes.** The first reads digests only, to learn which members changed; the second keeps text for those and for the metadata alone, so a release of many platform wheels does not spend the text budget on what did not change. A Python source member is read as UTF-8 with replacement characters and its NULs kept, and, when its first two lines hold a `coding[:=]` declaration anywhere, also as that coding (resolved by `codecs.lookup` as CPython resolves it; a name of more than 200 characters is not resolved), both readings scanned (a `coding: utf-7` file hides its code from a UTF-8 read, and where CPython honours a declaration is not reproduced, so neither reading is left to the author); a declared coding that cannot be read is `release-code-not-read` (`site` runs a `.pth` line after a NUL line); any other member that is not UTF-8 is binary.
 - **Paths are where pip puts them.** A wheel's `x.data/purelib/` and `platlib/` map to the site-packages root, `x.data/scripts/` to `{scripts}/`, `x.dist-info/` to `{dist-info}/`; an sdist member loses its top directory, and one at the root keeps its path (pip builds from the root when the members share no top directory). `RECORD`, `WHEEL` and `METADATA` of a wheel, and `PKG-INFO` and `*.egg-info/` of an sdist, are derived and not diffed; `Requires-Dist` is read from `METADATA`.
+- **The source tag** (`tag_facts`): with a source repository (`--sources`, else the one GitHub repository the previous release's Trusted Publishers name), the members Python runs (`_compared`: `.py`, `.pyw`, `.pth` and build files; not a wheel's `{dist-info}/` or `{scripts}/`, not an sdist's derived files) are compared by git blob sha1 (`Member.blobs`, also of the bytes with CRLF as LF) with the tree of the tag for its version. Tags come from GitHub's `git fetch` ref advertisement (`tag_commits`, no API quota; an annotated tag's peeled commit), a tree from the API (`GITHUB_TOKEN` when set). A tag matches by `packaging` version after a non-digit prefix (`_tags_of`); a prefix that tags both releases is preferred, then one naming the package, then the shortest (`_pick`). Where an artifact sits in the repository (`src/`, a monorepo directory) is voted by its members' blobs (`_prefix`). The previous release against its own tag gives the paths a build writes (`_differences`), and only a difference at another path is `release-differs-from-tag` (high). Expectations are by exact path, never by directory: a directory key would let a generated `_version.py` vouch for every file beside it, and a generated root module for a root `.pth`. A comparison a judgment could not make leaves a `tag_checks` row: a release without a tag for its version (`release-tag-missing` at `medium`), or one judged while the API refused for its rate limit (`tag_limited`, a fact). One row per version (`<run id without revision>-tag`), since the comparison covers the whole release; a judgment that owes a comparison opens a closed row again with fresh clocks, so a wheel added to the release after its comparison is compared too, and each opening screens under its own id (`-tag2`, …) so a refused alert of an earlier one is still re-sent. `_recheck_tags` looks at the refs every poll: once a tag for the version appears and `_api_room` says the API has two calls left, `tag_event` reads the tag and both trees first (`_resolve_tag`) and only then downloads the release again for its blobs, and the tag facts alone are screened (an event with no files, so the content findings are not sent twice) under that run id. A release still untagged `_TAG_GRACE` (an hour) after it was judged is screened as `release-tag-missing` (high) without a download, and a comparison still owed `_TAG_DEADLINE` (six hours) after the judgment, whatever the reason (a tree the API keeps refusing, an API with no room), is `release-not-fully-read`: nothing owed is dropped without an alert. A Trusted Publisher's repository GitHub stops serving ends the check quietly (`unserved`), as at judgment. A release PyPI no longer lists when its tag appears is a note, not a clean comparison. No tag for the previous release compares nothing, a fact (`tag_compared`). A configured repository GitHub does not serve (401, 404, a redirect) is a note (`release-not-fully-read`); the Trusted Publisher's is a fact. The API's rate limit (403, 429) defers the comparison to `_recheck_tags`; any other GitHub failure is retried like a download; a truncated tree is a note.
 - **The previous release** is the highest version below the new one with a file that is not yanked; a pre-release is compared only when the new one is a pre-release too. Members are compared by content across all artifacts of a kind, so a payload in one platform's wheel shows.
 - **State is per file.** First sight of a package (even an empty one) records every file as the baseline. After that, each file not yet recorded is judged with the other new files of its release, against the previous release, so a wheel uploaded after its release was judged, or added to an old release, is judged too. A file is recorded only after its comparison is screened, and the index's ETag only after every new file of it is: a watcher stopped mid-comparison judges the same files on its next pass. A failed comparison is retried on every pass (the ETag is not sent while one is pending), superseded when the files to judge change, and kept as `error` after five, with an alert that it was not compared. A `--check` runs under `...-check` and never stands in for the watcher's judgment. An alert the SIEM did not accept is re-sent from `screened/` a few per poll.
 
+## npm watch (`npm.py`, `release-watch --npm`)
+
+- **A version is a release.** `NpmWatcher` is `ReleaseWatcher` with `registry = "npm"` and its own `npm.db`: the same per-file state, retries, give-up and alert re-sending, with a version's tarball as its one file (kind `npm`, labelled `npm/<path>`, the `package/` top directory dropped). `release_event(registry="npm")` orders versions by semver (`semver_key`: a release after its pre-releases, numeric identifiers before others), keeps the name as written (`@scope/name`; run id `npm___scope_name-<version>`), skips the tag comparison and the wheel facts, and adds `npm_facts`.
+- **Read from the registry only.** The abbreviated packument (`application/vnd.npm.install-v1+json`, ETag-polled) from `registry.npmjs.org`; a version whose tarball URL is on another host is left out (`parse_packument`). Each tarball is checked against the registry's sha512 `integrity`, a mismatch a note.
+- **Publishers come from the registry's SLSA provenance** (`npm_publishers`): the `https://slsa.dev/provenance/v1` statement's `externalParameters.workflow` repository and path, written as `releases.publisher_identity` would (`github:owner/name:path::`), so `scan_release`'s publisher rules apply unchanged. The statement's subject must name the tarball's own sha512 (and a version the registry gives no sha512 for cannot be bound), or it is a note and no publisher. A 404 is no provenance; another status is retried like a download.
+- **Install scripts** (`npm_facts`): never the packument's `hasInstallScript`, and never through the screen's text budget, whose bounds and decoding fail open for a manifest. `tarball_manifests` reads the tarball itself as npm extracts it: the first path component dropped (a member at the root is not installed), the last entry of a path standing, the bytes decoded as UTF-8 with a BOM dropped and invalid bytes replaced, every `package.json` of the root and of a dependency under `node_modules` at any depth (npm runs a bundled dependency's install scripts). A manifest that is missing, not a regular file, past 16 MiB, not JSON (a `RecursionError` included) or not an object is a note (`release-not-fully-read`), never a package without scripts; the previous version's unread manifests count as none. The scripts are those an install from the registry runs (`preinstall`, `install`, `postinstall`; `prepare` runs only for a git or local install) and the implied `node-gyp rebuild` of a `binding.gyp` without either install script, keyed by package directory. Added is `npm-install-script-added` (high), a changed command `npm-install-script-changed` (medium). A dependency of any manifest (`dependencies`, `optionalDependencies`, `peerDependencies`) whose spec holds `:`, `/` or `\\`, or starts with `.` or `~/` (a git repository, a URL, a path, an `npm:` alias; a semver range or a dist-tag never does), new or with another spec than before, is `npm-dependency-source` (high). Manifest and `binding.gyp` names match in any case, as a case-insensitive file system finds them; two manifests whose paths differ only in case are each read and are a note, since which one npm reads depends on the file system. A path with `..` is not read, as npm refuses it. A new name in the root's `dependencies`, `optionalDependencies` or `peerDependencies` is `release-new-dependency` (low). A dependency newly taken from the registry in any manifest, keyed `<dir> <name>` (`_registry_dependencies`; a name whose spec moves onto the registry counts), is looked up (`dependency_facts`, at most 50): any version with `hasInstallScript` in its abbreviated document is `npm-dependency-runs-at-install` (high), and a package whose full document's `time.created` is under 30 days before the version's publish time (`published_at`, the watched package's `time[version]`; the clock only when that cannot be read), or a 404, is `npm-dependency-young` (high). A full document past 64 MiB is a note, never an established package, since an author pads versions as easily as they publish them; another failure is retried like a download.
+
 ## Image watch (`images.py`, `release-watch --images`)
 
 - **Provenance only, never a layer.** `image_provenance` reads an image's index, each BuildKit attestation manifest and its SLSA provenance layer; `provenance_facts` keeps the source repository (`vcs:source`; `owner/name` only for a URL whose host is exactly github.com, any other source as written, so a lookalike is only judged between GitHub repositories), revision, building repository, workflow without its ref, ref and ref protection. An attestation counts only when its `vnd.docker.reference.digest` is a platform image of the same index and the provenance's `subject` names that image (BuildKit always writes one); a platform image no attestation names is a note. A layer's content is a known gap.

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/.claude/rules/rubric-and-eval.md

@@ -15,6 +15,7 @@ paths:
 - `rl_export.rubric_signal` attaches the ATLAS 4-category (TF/TA/TG/PA) decomposition as LABELS: a fixed, no-LLM skeleton in `run_start` meta (`rubric_to_meta(default_rubric())`, one criterion per category, since the task is constant; there is no `generate_rubric` path) plus deterministic per-criterion `criteria_facts`.
 - The facts are a re-lens over `run_labels` / `run_metrics`, not a second derivation: `rubric.trace_facts` reuses them, so a criterion's `observed` cannot drift from what a trainer reads. `_CATEGORY_LENS` maps TF↔(verdict / signal / hit_iteration_cap), TA↔(scan / deep_classify / analyst / fetch / skill counts + circuit-breaks + analyst failures), TG↔(indicator_count / max_indicator_severity / signal / cited_unknown), PA↔(verdict / cited_unknown).
 - `deep_classify_circuit_breaks` counts the tool_calls the breaker short-circuited. From rlm-harness 1.22.0 a repeating error status (`is_fast_fail_http`) counts toward the breaker as an unusable reply does, so a break in a newer trace can mean a misconfigured classifier endpoint as well as a thrashing planner; the status in the run's endpoint-error tool_calls (`Error code: 401`) tells them apart, since a 429, a 5xx or a timeout records one too and does not count.
+- The per-action `cause` that `rl_export` re-exports from the kit (`export_actions`, read by `payload_cause`) is the kit's field: from rlm-harness 1.24.0 a tool_call without `ok` reads as `unknown`, where it read as `invalid` before, so an older trace's `read_skill` rows move. Split a corpus by `run_start.payload.rlm_harness` before comparing `cause` rates across it.
 - `CriterionFact` has no score/met field; the trainer scores. Never add a reward/score/met field to any rubric type.
 - `rubric.py` is a dspy-free leaf: it imports only `.schema` at top, and its `rl_export` reuse is a function-level import (that path is dspy-free too), so `response.py` can import it at top.
 - `response._rubric` surfaces it as `DetectionResponse.rubric` (`RubricReport`); the studio shows it as a card tagged `labels — not a score` that adds no judgement. Keep the card legacy-guarded: a response without a `rubric` renders nothing.

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/.env.example

@@ -79,5 +79,7 @@ DS_API_KEY=sk-...
 # DS_RELEASE_PACKAGES=litellm,requests     # release-watch: PyPI projects (or --packages / --packages-file)
 # DS_RELEASE_INTERVAL=300                  # release-watch: seconds between polls of each project's index
 # DS_RELEASE_MAX_ARTIFACT_MB=256           # release-watch: a larger wheel or sdist is not compared, which alerts
+# DS_RELEASE_NPM=@scope/name,left-pad    # release-watch: npm packages (or --npm)
+# DS_RELEASE_SOURCES=litellm=BerriAI/litellm  # release-watch: the GitHub repository each package is built from, compared by tag (or --sources)
 # DS_RELEASE_IMAGES=ghcr.io/owner/name     # release-watch: container images compared by build provenance (or --images)
 # DS_RELEASE_IMAGE_TAGS=latest             # release-watch: floating tags whose moves are judged (or --image-tags)

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/AGENTS.md

@@ -31,10 +31,10 @@ rlm-harness is an exact PyPI pin (`rlm-harness==X.Y.Z` in `pyproject.toml`, lock
 - **The budget is hard: `max_retries=1`, no whole-RLM retry inside a run.** One change = one trajectory, so the trace stays valid training data. (`watch` may run a change again, but only when the previous attempt produced no result at all, an infrastructure failure; `cli.run` resets that run id's trace first, so exactly one trajectory per run id survives.) A failed run is infra before it is a schema bug; see `.claude/rules/detect-setup.md` for how the failure names itself.
 - **A second model-judgement is a TOOL, never the sub-LM.** `deep_classify` (on rlm-harness's `make_model_tool`) is the swappable second-stage seam the planner chooses to call, so the decision is a `tool_call` in the trajectory. The analyst intercept (`intercept_sub_lm`) is tracing-only, zero transforms. Swapping the backend touches only `classify_backend` / `_selfclassify_chat`. The planner passes distilled findings, never the whole diff.
 - **Sandboxed code builds no sub-agents.** In dspy 3.4.1 and later, sandboxed code can construct dspy programs that run on the host, call the analyst, can drive the task's tools, and record as one `sub_call` with no inner turns. The kit's default allows it, so `setup` passes `sandbox_sub_agents=False` explicitly, and production never injects an interpreter (which would bypass it); `test_program_offers_no_sub_agents` holds the behaviour.
-- **GitHub ingest, monitoring, and SIEM emission are host-side plumbing, never planner tools.** `ingest.py` shells out to `gh` host-side (transport injectable); `emit.emit_signal` POSTs and never raises; `watch`, `actors` and `snapshot` poll, remember, and archive outside the trajectory, `releases` reads PyPI's own hosts only, as data that is never installed, and `images` reads the GHCR and Docker Hub APIs only (manifests and provenance, never a layer). Only choices the policy makes are tools; delivering a finished result is plumbing. What the store learns reaches the signal only as provenance facts through `scan_provenance`, never as a second derivation (see `.claude/rules/monitoring.md`).
+- **GitHub ingest, monitoring, and SIEM emission are host-side plumbing, never planner tools.** `ingest.py` shells out to `gh` host-side (transport injectable); `emit.emit_signal` POSTs and never raises; `watch`, `actors` and `snapshot` poll, remember, and archive outside the trajectory, `releases` and `npm` read PyPI's and npm's own hosts, and the refs and trees of a package's GitHub repository, as data that is never installed, and `images` reads the GHCR and Docker Hub APIs only (manifests and provenance, never a layer). Only choices the policy makes are tools; delivering a finished result is plumbing. What the store learns reaches the signal only as provenance facts through `scan_provenance`, never as a second derivation (see `.claude/rules/monitoring.md`).
 - **This is a ROLLOUT source: trajectories, not reward.** `rl_export` passes `reward=None`; labels read the assembled verdict and metrics are objective effort counters. `deep_classify` tool_calls train the classifier; every other action is the planner's. A metric keeps ONE meaning across rlm-harness versions (the corpus mixes them; `run_start.payload.rlm_harness` names the writer): a quantity a newer kit makes observable gets a NEW key that is None where the trace cannot say (e.g. `analyst_failures`). The ATLAS rubric and the eval member stay reward-free too; see `.claude/rules/rubric-and-eval.md`.
 - **Attack knowledge lives in `diff_sentry/skills/`, not the prompt.** The skill catalog is injected (`load_skills_as_tools(discovery="inject")`) and `read_skill(name)` pulls a body on demand. Fix a wrong convention by editing or adding a skill; `detect.INSTRUCTIONS` holds only identity, the MISSION frame, the tool cost model, the triage loop, and output-gating rules. Skills ship via `packages = ["diff_sentry"]`; a force-include duplicates them and breaks the build.
-- **Keep the dspy-free modules dspy-free.** `config`, `schema`, `normalize`, `indicators`, `shelllex`, `linewide`, `assemble`, `response`, `emit`, `ingest`, `hosts`, `dbutil`, `actors`, `snapshot`, `watch`, `releases`, `images`, `rl_export`, and `rubric` must not import dspy at module top, and `import diff_sentry` must not import dspy (`ClassifyChange` / `setup` / `run` / `screen` / `detect_from_event` are lazy PEP 562 re-exports).
+- **Keep the dspy-free modules dspy-free.** `config`, `schema`, `normalize`, `indicators`, `shelllex`, `linewide`, `assemble`, `response`, `emit`, `ingest`, `hosts`, `dbutil`, `actors`, `snapshot`, `watch`, `releases`, `npm`, `images`, `rl_export`, and `rubric` must not import dspy at module top, and `import diff_sentry` must not import dspy (`ClassifyChange` / `setup` / `run` / `screen` / `detect_from_event` are lazy PEP 562 re-exports).
 - **The trace self-describes the run.** `run_start` meta carries the normalized event, instructions, source echo, `baseline_indicators`, `emit_on`, role→model names, budgets, and the rubric skeleton, so an offline re-render/export re-derives the same `signal` (reading `emit_on` from meta, never current config). Any new per-run config that affects read-time derivation must ride in meta.
 
 ## Topic guides
@@ -54,5 +54,5 @@ Claude Code loads each rule automatically when you touch a matching file; other
 
 - rlm-harness owns the generic cores: `make_model_tool` (chat → retry → validate → circuit-break) under `deep_classify`, and the SSRF primitives (`is_safe_url`, `resolved_host_is_safe`, `parse_cidrs`) under `fetch_tool`, which adds the GitHub allowlist, the httpx provider, and tracing.
 - When this consumer needs a workaround, fix the reusable gap in rlm-harness generically; never special-case diff-sentry there. Consumer values (`DS_*` roles, the verdict schema, indicator rules, the SIEM payload shape) stay here.
-- The deterministic tier ships as `cli.screen`, `watch` and `release-watch` (host-side, in front of `cli.run`). Next increments: comparing a release's sdist with its git tag, an image's new layers by content, and npm releases beside PyPI's; an optional small single-shot model call inside that tier; a GH Archive backfill for account history older than the Events API's 30 days; per-repository workflow awareness (which repos run `issue_comment` or `pull_request_target` workflows) to weight the slash-command rule.
+- The deterministic tier ships as `cli.screen`, `watch` and `release-watch` (host-side, in front of `cli.run`). Next increments: an image's new layers by content; an optional small single-shot model call inside that tier; a GH Archive backfill for account history older than the Events API's 30 days; per-repository workflow awareness (which repos run `issue_comment` or `pull_request_target` workflows) to weight the slash-command rule.
 - Two workspace members, never in the `diff_sentry` wheel: `studio/` (`diff-sentry-studio`, the detection console, behind its `live` extra) and `eval/` (`diff-sentry-eval`, the reward-free scorecard). Both read the trace / `DetectionResponse` contract through the public surface only. Keep the root wheel at `packages = ["diff_sentry"]` so `uv build` never sweeps them in.

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to diff-sentry, a BewAIre-style detector that classifies one GitHub change (PR, issue or push) for malicious intent on [`rlm-harness`](https://github.com/qazbnm456/rlm-harness).
 
+## 0.13.0
+
+Upgrade from 0.12.0: `release-watch` can watch npm packages. The GitHub Action's scan is unchanged, nothing needs configuring, and `rlm-harness==1.24.0` is unchanged.
+
+### Added
+- **`release-watch --npm` watches npm packages** (`DS_RELEASE_NPM`, or `--check npm:NAME VERSION` for one version). Each new version is compared with the version before it in semver order, as a PyPI release is: the tarball is read from `registry.npmjs.org` as data, checked against the registry's sha512, and every new or changed file is screened by the same rules. The npm worms of 2025 ran their payload from an install script, and a compromised version can also depend on a package published hours before, so it adds what only npm shows:
+  - `npm-install-script-added` (`high`): a `preinstall`, `install` or `postinstall` script, or the `node-gyp rebuild` a `binding.gyp` implies, that the previous version did not run, in the package or in a dependency it bundles. A script that changes command is `medium`.
+  - `npm-dependency-source` (`high`): a dependency newly installed from a git repository, a URL, a path or an `npm:` alias.
+  - `npm-dependency-runs-at-install` and `npm-dependency-young` (`high`): a dependency newly taken from the registry whose versions run a script at install, or that was created within 30 days of the version or is not on the registry.
+  - The publisher checks PyPI releases have, from the SLSA provenance the registry holds, which must name the tarball's own digest.
+
+  The manifests are read as npm extracts them, and one that cannot be read alerts. See [npm packages](docs/release-watch.md#npm-packages).
+
+## 0.12.0
+
+Upgrade from 0.11.0: `release-watch` can compare each release with its git tag, and `rlm-harness` moves to 1.24.0. The GitHub Action's scan is unchanged, and nothing needs configuring.
+
+### Added
+- **`release-watch` compares each release with its git tag**, when it knows the GitHub repository a package is built from (`--sources litellm=BerriAI/litellm`, `DS_RELEASE_SOURCES`, or else the repository of the previous release's Trusted Publisher). The files Python runs are compared with the tag for the version by git blob hash, so nothing is downloaded from GitHub but its tag list and two file trees. A file the tag does not hold, or holds with other content, is `release-differs-from-tag` (`high`); what the previous release also differed by at the same path, such as a version file the build writes, is expected. A release whose repository tagged the previous one and has no tag for it (`BerriAI/litellm` has no `v1.107.0`) is `release-tag-missing`: `medium` at first, compared once the tag appears, and `high` after an hour. A comparison that still cannot be made six hours after the release was judged alerts that it was not made. See [Comparing a release with its git tag](docs/release-watch.md#comparing-a-release-with-its-git-tag).
+
+### Changed
+- **`rlm-harness` 1.24.0.** A tool call recorded without an outcome now reads as unknown rather than as a decline; every call diff-sentry records declares its outcome.
+
 ## 0.11.0
 
 Upgrade from 0.10.0: `release-watch` can now watch container images. The GitHub Action's scan is unchanged, nothing needs configuring, and `rlm-harness==1.22.0` is unchanged.

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: diff-sentry
-Version: 0.11.0
+Version: 0.13.0
 Summary: Catch malicious pull requests before they merge: scan a diff for supply-chain attack patterns with deterministic evidence a model cannot suppress.
 Author: Boik Su
 License-Expression: MIT
@@ -10,7 +10,7 @@ Requires-Python: >=3.11
 Requires-Dist: httpx>=0.27
 Requires-Dist: packaging>=23
 Requires-Dist: pydantic>=2.11.0
-Requires-Dist: rlm-harness==1.22.0
+Requires-Dist: rlm-harness==1.24.0
 Provides-Extra: classify
 Requires-Dist: openai>=1.0; extra == 'classify'
 Provides-Extra: observe
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@v0.11.0
+      - uses: qazbnm456/diff-sentry@v0.13.0
 ```
 
 That is the whole setup. The job fails when an indicator at or above `high` fires. Add `push` to `on:` to also scan commits pushed straight to a branch. A push that bypasses branch protection can also delete this workflow, so `watch` and `release-watch` read the repository and its releases from outside.
@@ -96,7 +96,7 @@ If you operate the infrastructure, or maintain a project where a wrong call is e
 - **Deep classification**: a reasoning model reads a PR, issue or push in a sandbox and returns a verdict next to the evidence. See [How it works](docs/how-it-works.md).
 - **The studio**: a local console that streams a run as it happens. See [`studio/README.md`](studio/README.md).
 - **Watch**: monitors a list of repositories, alerts the moment the rules fire, and remembers the accounts and payload hosts it has seen. See [Watching a watchlist](docs/watch.md).
-- **Release watch**: compares each new release of the PyPI packages you depend on with the release before it, and alerts when the new wheels carry a startup hook or a packed loader that the source never showed. See [Watching releases](docs/release-watch.md).
+- **Release watch**: compares each new release of the PyPI and npm packages you depend on with the release before it, and alerts when it carries a startup hook, a packed loader or a new install script, or was published without its usual provenance. See [Watching releases](docs/release-watch.md).
 - **Trajectories for training**: every run is recorded, and `export` turns the traces into a reward-free dataset for fine-tuning a smaller planner. See [The full pipeline](docs/how-it-works.md#the-full-pipeline).
 
 None of this is needed for the Action, and none of it sends your code anywhere you did not configure yourself.
@@ -109,7 +109,7 @@ A strong prompt injection can skew a model's verdict, though never the evidence.
 
 - [How it works](docs/how-it-works.md): severity tuning, the evidence union, the full pipeline, running it locally, and the incidents the tests reconstruct.
 - [Watching a watchlist](docs/watch.md): the monitor, its alerts, its archive, and what the account dossier holds.
-- [Watching releases](docs/release-watch.md): comparing each new PyPI release with the one before it.
+- [Watching releases](docs/release-watch.md): comparing each new PyPI or npm release, and each container image, with what came before.
 - [Honest limits](docs/limits.md): what the rules and the pipeline do not see.
 - [Development](docs/development.md): the test suites and CI.
 - [CHANGELOG](CHANGELOG.md)

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/README.md

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@v0.11.0
+      - uses: qazbnm456/diff-sentry@v0.13.0
 ```
 
 That is the whole setup. The job fails when an indicator at or above `high` fires. Add `push` to `on:` to also scan commits pushed straight to a branch. A push that bypasses branch protection can also delete this workflow, so `watch` and `release-watch` read the repository and its releases from outside.
@@ -74,7 +74,7 @@ If you operate the infrastructure, or maintain a project where a wrong call is e
 - **Deep classification**: a reasoning model reads a PR, issue or push in a sandbox and returns a verdict next to the evidence. See [How it works](docs/how-it-works.md).
 - **The studio**: a local console that streams a run as it happens. See [`studio/README.md`](studio/README.md).
 - **Watch**: monitors a list of repositories, alerts the moment the rules fire, and remembers the accounts and payload hosts it has seen. See [Watching a watchlist](docs/watch.md).
-- **Release watch**: compares each new release of the PyPI packages you depend on with the release before it, and alerts when the new wheels carry a startup hook or a packed loader that the source never showed. See [Watching releases](docs/release-watch.md).
+- **Release watch**: compares each new release of the PyPI and npm packages you depend on with the release before it, and alerts when it carries a startup hook, a packed loader or a new install script, or was published without its usual provenance. See [Watching releases](docs/release-watch.md).
 - **Trajectories for training**: every run is recorded, and `export` turns the traces into a reward-free dataset for fine-tuning a smaller planner. See [The full pipeline](docs/how-it-works.md#the-full-pipeline).
 
 None of this is needed for the Action, and none of it sends your code anywhere you did not configure yourself.
@@ -87,7 +87,7 @@ A strong prompt injection can skew a model's verdict, though never the evidence.
 
 - [How it works](docs/how-it-works.md): severity tuning, the evidence union, the full pipeline, running it locally, and the incidents the tests reconstruct.
 - [Watching a watchlist](docs/watch.md): the monitor, its alerts, its archive, and what the account dossier holds.
-- [Watching releases](docs/release-watch.md): comparing each new PyPI release with the one before it.
+- [Watching releases](docs/release-watch.md): comparing each new PyPI or npm release, and each container image, with what came before.
 - [Honest limits](docs/limits.md): what the rules and the pipeline do not see.
 - [Development](docs/development.md): the test suites and CI.
 - [CHANGELOG](CHANGELOG.md)

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/action.yml

@@ -40,7 +40,7 @@ inputs:
       that PR rather than by the ones already on main.
     required: false
     # KEEP IN STEP WITH [project].version. release.yml fails the build if this drifts from the tag being released, because a stale default here would silently run an old scanner under a new action tag.
-    default: '0.11.0'
+    default: '0.13.0'
 
 outputs:
   failed:

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/diff_sentry/__init__.py

@@ -72,7 +72,7 @@ __all__ = [
     "screen",
 ]
 
-__version__ = "0.11.0"
+__version__ = "0.13.0"
 
 
 def __getattr__(name: str):  # PEP 562: defer the dspy import to first use

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/diff_sentry/cli.py

@@ -337,7 +337,8 @@ def _cmd_release_watch(args) -> int:
     import signal
 
     from .images import ImageWatcher
-    from .releases import ReleaseWatcher, parse_packages
+    from .npm import NpmWatcher, parse_npm_packages
+    from .releases import ReleaseWatcher, parse_packages, parse_sources
 
     logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
     if not math.isfinite(args.interval) or args.interval <= 0:
@@ -349,31 +350,42 @@ def _cmd_release_watch(args) -> int:
             with open(args.packages_file, encoding="utf-8") as fh:
                 texts.append(fh.read())
         packages = parse_packages(texts)
+        npm = parse_npm_packages([*args.npm, os.getenv("DS_RELEASE_NPM", "")])
+        check_npm = bool(args.check) and args.check[0].startswith("npm:")
         if args.check:
-            packages = parse_packages([args.check[0]])
+            packages = [] if check_npm else parse_packages([args.check[0]])
+            npm = parse_npm_packages([args.check[0][4:]]) if check_npm else []
         images = [i for text in [*args.images, os.getenv("DS_RELEASE_IMAGES", "")] for i in text.replace(",", " ").split()]
         floating = tuple(args.image_tags or os.getenv("DS_RELEASE_IMAGE_TAGS", "latest").replace(",", " ").split())
         image_watcher = ImageWatcher([] if args.check else images, state_dir=args.state, out_dir=args.out,
                                      floating=floating, emit=not args.no_emit)
         try:
-            watcher = ReleaseWatcher(packages, state_dir=args.state, out_dir=args.out, emit=not args.no_emit)
+            sources = parse_sources([*args.sources, os.getenv("DS_RELEASE_SOURCES", "")])
+            watcher = ReleaseWatcher(packages, state_dir=args.state, out_dir=args.out, emit=not args.no_emit,
+                                     sources=sources)
         except BaseException:
             image_watcher.close()
             raise
+        try:
+            npm_watcher = NpmWatcher(npm, state_dir=args.state, out_dir=args.out, emit=not args.no_emit)
+        except BaseException:
+            image_watcher.close()
+            watcher.close()
+            raise
     except (OSError, ValueError, RuntimeError) as exc:
         print(f"release-watch: {exc}", file=sys.stderr)
         return 2
     try:
         if args.check:
-            result = watcher.check(packages[0], args.check[1])
+            result = npm_watcher.check(npm[0], args.check[1]) if check_npm else watcher.check(packages[0], args.check[1])
             print(json.dumps(result, indent=2, default=str))
             return 1 if "error" in result else 0
-        if not packages and not images:
-            print("release-watch: nothing to watch (--packages, --packages-file, --images, or DS_RELEASE_PACKAGES / "
-                  "DS_RELEASE_IMAGES)", file=sys.stderr)
+        if not packages and not npm and not images:
+            print("release-watch: nothing to watch (--packages, --packages-file, --npm, --images, or DS_RELEASE_PACKAGES / "
+                  "DS_RELEASE_NPM / DS_RELEASE_IMAGES)", file=sys.stderr)
             return 2
         if args.once:
-            for result in watcher.poll_once() + image_watcher.poll_once():
+            for result in watcher.poll_once() + npm_watcher.poll_once() + image_watcher.poll_once():
                 print(json.dumps(result, default=str))
             return 0
         stopping = []
@@ -382,6 +394,7 @@ def _cmd_release_watch(args) -> int:
             while not stopping:
                 started = time.monotonic()
                 watcher.poll_once()
+                npm_watcher.poll_once()
                 image_watcher.poll_once()
                 while not stopping and time.monotonic() - started < args.interval:
                     time.sleep(min(1.0, args.interval))
@@ -390,6 +403,7 @@ def _cmd_release_watch(args) -> int:
         return 0
     finally:
         watcher.close()
+        npm_watcher.close()
         image_watcher.close()
 
 
@@ -655,6 +669,10 @@ def build_parser() -> argparse.ArgumentParser:
                         help="compare each new release of watched PyPI packages with the one before it (no model)")
     rw.add_argument("--packages", nargs="+", default=[], help="PyPI project names (or set DS_RELEASE_PACKAGES)")
     rw.add_argument("--packages-file", help="a file of project names, one per line (# comments allowed)")
+    rw.add_argument("--npm", nargs="+", default=[], help="npm package names, @scope/name included (or set DS_RELEASE_NPM)")
+    rw.add_argument("--sources", nargs="+", default=[], metavar="PACKAGE=OWNER/NAME",
+                    help="the GitHub repository each package is built from, to compare each release with its tag "
+                         "(or set DS_RELEASE_SOURCES; default: the repository of the previous release's Trusted Publisher)")
     rw.add_argument("--images", nargs="+", default=[],
                     help="container images (ghcr.io/owner/name, docker.io/owner/name) whose tags are compared by provenance "
                          "(or set DS_RELEASE_IMAGES)")
@@ -668,7 +686,8 @@ def build_parser() -> argparse.ArgumentParser:
     rw.add_argument("--no-emit", action="store_true", help="do not emit SIEM signals")
     rw.add_argument("--once", action="store_true", help="one poll, then exit")
     rw.add_argument("--check", nargs=2, metavar=("PACKAGE", "VERSION"),
-                    help="judge one release against the one before it now, print the result, and exit")
+                    help="judge one release against the one before it now, print the result, and exit "
+                         "(npm:NAME for an npm package)")
     rw.set_defaults(func=_cmd_release_watch)
 
     ac = sub.add_parser("actor", help="the dossier of an account the watcher has seen (offline)")

{diff_sentry-0.11.0 → diff_sentry-0.13.0}/diff_sentry/deep_classify.py

@@ -143,7 +143,7 @@ def make_deep_classify_tool(config: DetectConfig, chat_fn: Callable[[str], str]
             return ("DEEP_CLASSIFY CIRCUIT BREAKER — too many unusable replies or failing calls in a row. Decide from the "
                     "deterministic indicators and your own reading; do not keep re-asking.")
         if r.endpoint_error is not None:
-            record_tool_call("deep_classify", args={"findings": findings[:400]}, error=r.endpoint_error)
+            record_tool_call("deep_classify", args={"findings": findings[:400]}, ok=False, error=r.endpoint_error)
             return f"DEEP_CLASSIFY ENDPOINT ERROR: {r.endpoint_error}. Decide from the indicators yourself."
         v: ClassifyValidation = r.validated
         # SEAM: a delegated rlm-harness HARNESS backend (make_harness_tool) returns