diff-sentry 0.4.1__tar.gz → 0.4.3__tar.gz

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/.github/workflows/ci.yml

@@ -29,13 +29,13 @@ jobs:
       matrix:
         python-version: ["3.11", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
         # Third-party action pinned to a commit SHA for supply-chain integrity (a moving major tag
         # could be repointed at malicious code that runs with this workflow's token). GitHub-owned
         # actions (checkout) stay on a major tag. Bump the SHA and the trailing version comment together.
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
@@ -75,7 +75,7 @@ jobs:
     name: self-scan (dogfood)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0        # the action needs the base commit to diff against
 
@@ -110,9 +110,9 @@ jobs:
     name: consumer install path (PyPI)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
       - name: The released package installs from PyPI and flags a malicious diff
@@ -134,9 +134,9 @@ jobs:
     name: ruff
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
       - name: Lint

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/.github/workflows/release.yml

@@ -26,10 +26,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Build sdist + wheel
         run: uv build

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/CHANGELOG.md

@@ -5,6 +5,110 @@ malicious intent — the diff held as **untrusted data** in a sandboxed REPL, a
 and deterministic indicator evidence unioned on read into a SIEM signal — as a traced, improvable RLM
 framework on [`rlm-harness`](https://github.com/qazbnm456/rlm-harness) (a BewAIre-style detector).
 
+## 0.4.3
+
+Dependencies. `rlm-harness` moves from `1.0.0` to `1.10.1` — ten minor releases of the kit — and `dspy`
+from `3.2.1` to `3.3.1` with it. Nothing in the `diff_sentry` package changed: every kit name this
+project imports was checked against 1.10.1 by name, both offline suites, the studio suite and the node
+tests pass on the new pin, and a live classification ran clean. The one real risk, a doubled
+`sub_call`, was tested for before the bump and is not there (below).
+
+### Changed
+- **`rlm-harness==1.10.1`, `dspy` 3.3.1.** The pin stays exact. dspy 3.3 drops `asyncer`, `typeguard`,
+  `numpy` and `xxhash` from its exact pins, so a fresh install resolves fewer packages, not more.
+- **The trace carries more of the run; nothing here reads it differently.** `run_start` records the kit
+  version that wrote it (`rlm_harness`); `run_end` gains `budgets` (the generation cap actually APPLIED
+  per role, plus the iteration caps and whether dspy accepted them — `dropped: true` means all three
+  reverted to dspy's defaults, so exclude those runs before any claim about iteration exhaustion),
+  `usage` (completion tokens per ATTEMPT, not per turn — a distribution over runs wants the per-run
+  `max`, never the sum) and `error_chain` (the causes below a failed run's outer exception). Every tool
+  call and `sub_call` carries a measured `duration_s`. `run_labels`, `run_metrics`, the rubric facts
+  and the SIEM signal derivation are untouched; the new fields ride along for a future reader.
+- **A non-retryable LM error fails fast, as itself.** An auth / billing / configuration /
+  unsupported-model error from dspy escapes the kit after ONE attempt as the original `dspy.LMError`
+  subclass instead of burning the retry budget and arriving wrapped in `RLMTaskError`. `cli.run` already
+  turns every exception into a `status=failed` response, so the never-raises contract holds; the
+  response now names the dspy class, which tells "fix the credential" apart from "the model kept
+  producing invalid output". `RLMTaskError` still means the latter, or a retryable endpoint fault
+  (timeout / 5xx / transport) that outlasted the single attempt.
+- **The studio's "took" label on a tool call reads the kit's own timing.** The kit now measures each
+  call; the console used to estimate a tool's duration as the gap since the previous live event, which
+  charged the whole preceding planner turn to a sub-millisecond scan. It prefers the recorded
+  `duration_s` and falls back to the gap for a trace that predates it.
+
+### Fixed (upstream, reaching this project)
+- **An analyst escalation is recorded once.** Since kit 1.7.0 a plain `sub_lm` is wrapped for tracing
+  automatically. This project already wraps the analyst with `intercept_sub_lm`, whose wrapper declares
+  `records_sub_call = True`; the kit honours that opt-out and leaves it alone, so a `sub_call` lands in
+  the trace — and in the exported datasets — exactly once. Verified at runtime and on a live run.
+- **`intercept_sub_lm` handles dspy's typed `LMResponse`.** Under dspy 3.3 a sub-LM can return an
+  `LMResponse` rather than a list of strings, and the 1.0.0 wrapper mishandled it. The analyst intercept
+  is that wrapper.
+- **A lone surrogate in a payload no longer loses the event.** The change under review is
+  attacker-authored text; a payload carrying an unpaired surrogate used to fail the recorder's JSON dump
+  and drop the event. It is written now.
+
+### Docs
+- **`CLAUDE.md` names all five version sites** and which of them `release.yml` gates (the README's
+  `uses:` example is the one it does not), and its `RLMTaskError` guidance matches the fail-fast
+  behaviour above.
+
+## 0.4.2
+
+Scoping. Every fix here comes from the same root: the scan read a whole change as one
+string, so rules that need two signals could take them from two unrelated files.
+
+### Fixed
+- **The scan is scoped per file.** `scan_indicators` reads whatever it is handed as one string, and the
+  action hands it the whole `git diff`. Most rules fire on a single match, so that was harmless — but
+  two need a PAIR of signals (`pwn-request`: privileged trigger + PR-HEAD checkout;
+  `detached-process-spawn`: detached spawn + `child_process`), and a whole-blob read let those pair
+  ACROSS FILES. A `workflow_run:` added to one workflow plus a `ref: ${{ ... head.sha }}` sitting in a
+  doc example, a test fixture, or the very workflow a change is *deleting*, composed into a `critical`
+  that no single file contained. The new `scan_diff` splits a unified diff on its file headers and
+  scans each segment on its own; non-diff input (a region the planner pulled out of the REPL, a plain
+  file) falls through to the previous whole-text scan. Used by `scan` and by the in-loop
+  `scan_indicators` tool.
+- **The host-side baseline is scoped per file too, via `scan_content`.** An event is not a unified diff:
+  `raw_content` concatenates the title, every `(filename, patch)` and the body with no `diff --git`
+  headers, so pointing the baseline at `scan_diff` would have scoped nothing at all. `scan_content`
+  splits on the structure the event already carries — and gives hits from a file that file's name. The
+  case is not hypothetical: a PR that adds a `workflow_run` workflow AND documents the trap in the same
+  commit is what a careful repo writes, and read as one blob it came out `critical`. `content_segments`
+  is now the single definition `raw_content` is built on, so the two cannot drift, and the
+  detection-quality corpus was moved onto the production path so it guards what actually ships.
+
+### Changed
+- **`astral-sh/setup-uv` bumped to v10.0.1** (from v5.4.2) and **`actions/checkout` to v7**, both for
+  the Node 24 runtime — between them they clear GitHub's Node 20 deprecation warning. The setup-uv bump
+  covers `action.yml` too, so it reaches every repo running this action, not just this one's CI. Five
+  majors in one
+  jump, so what actually applies here was checked: v8 stopped publishing major tags (this repo already
+  SHA-pins), v9 flipped the `prune-cache` default, and v10 disables caching for `release` /
+  `workflow_run` / `pull_request_target` events under `enable-cache: auto` — CI passes `enable-cache:
+  true` explicitly and keeps its cache, and the release job never wanted one.
+
+  checkout v7 also **blocks checking out a fork PR head under `pull_request_target` / `workflow_run`** —
+  the `pwn-request` shape this project exists to detect, now refused by the action itself. Nothing here
+  checks out a PR head, so the bump is behaviour-neutral for these workflows and strictly better posture
+  for a detector to be running.
+
+### Added
+- **`pwn-request` covers `allow-unsafe-pr-checkout: true`.** actions/checkout v5.1/v6.1/v7 refuse to
+  check out a fork PR head under `pull_request_target` / `workflow_run` unless a workflow opts back in
+  with that input. The opt-in is the same attack stated in words — no ref to trace, no dataflow to
+  infer — so it joins the `ref:` value and the hand-rolled `git fetch` as the rule's third form, with
+  its own title so a reader is not sent hunting for a `ref:` that is not there. It only counts under a
+  privileged trigger (beneath `pull_request` the input carries none of that meaning), a removed opt-in
+  does not fire, and neither does an explicit `false`.
+- **Hits name the file they came from.** `location` was the name of the whole diff — `gated.diff` for
+  every hit, which meant reading the raw log to find out where a finding actually was. Per-file
+  scanning gives each hit its real path.
+- **A hit id is now stable between a whole-diff scan and a single-file scan.** The segment the planner
+  pulls out is byte-identical to the one the baseline scanned, so the evidence snippets — and therefore
+  the ids — match, and the two de-duplicate to one union member on read. Whole-blob scanning could not
+  promise that: the snippet window moved with the byte offset.
+
 ## 0.4.1
 
 A correctness release for one rule: `pwn-request` was failing the very pattern this

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/CLAUDE.md

@@ -4,7 +4,7 @@ A **BewAIre-style malicious-change detector** built on `rlm-harness` — a downs
 scaffold. It classifies ONE GitHub change (PR/issue/push)
 for malicious intent: the diff is UNTRUSTED DATA held in a sandboxed REPL, the planner SUBMITs a
 judgement-only verdict, and the deterministic indicator EVIDENCE is unioned on read into a SIEM signal.
-rlm-harness is consumed as an **exact PyPI pin** (`rlm-harness==1.0.0`, resolved from the index and
+rlm-harness is consumed as an **exact PyPI pin** (`rlm-harness==1.10.1`, resolved from the index and
 recorded in `uv.lock`); overlay `uv pip install -e ../rlm-harness` only when co-developing the kit
 locally, and bump the pin once the change ships. See
 `README.md` for the pipeline table + the honest caveats (prompt-injection residual, deep-tier scale),
@@ -100,6 +100,22 @@ One companion rule ships under `.claude/rules/`:
   network-fetch + file-write — are `high`. A rule that needs BOTH halves is how a common primitive
   becomes evidence without becoming noise. The corpus pins this hit/miss behavior, and every rule ships
   with its NEGATIVE case. Hit evidence is a BOUNDED snippet (`_MAX_EVIDENCE`), never the whole diff.
+- **`pwn-request` has THREE checkout forms**, and all three need the privileged trigger to count: the
+  expression on a `ref:` (directly or one binding hop away), a hand-rolled `git fetch`/`gh pr checkout`,
+  and `allow-unsafe-pr-checkout: true` — the input actions/checkout v5.1+ added for opting back into
+  the fork-PR checkout it now blocks. The last one needs no dataflow: the line states the intent. Each
+  form carries its own title, because reporting an opt-in as "checks out the PR HEAD" sends a reader
+  hunting for a `ref:` that is not there.
+- **A paired rule only pairs WITHIN one file.** `scan_diff` splits a unified diff on its file headers;
+  `scan_content` does the same for an EVENT, whose files `raw_content` would otherwise concatenate into
+  one header-less blob that `scan_diff` cannot scope at all. `scan` and the in-loop tool take the first,
+  the host-side baseline takes the second, and `content_segments` is the single definition both
+  `raw_content` and the baseline are built on, so they cannot drift.
+  Scanning the diff as one blob let the two halves come from different files — a `workflow_run:` in one
+  workflow and a `ref: ${{ … head.sha }}` in a doc example composed into a `critical` no file contained.
+  It also makes a hit id stable between a whole-diff scan and a single-file one, because the segment is
+  byte-identical either way, which is what lets the baseline and an in-loop scan de-duplicate (MF3).
+  Non-diff input falls through to a plain whole-text scan; keep that fallback.
 - **The indicator tool registers as exactly `scan_indicators`.** dspy registers a tool under its
   `__name__` and the prompt says `scan_indicators(region)` — a rename makes every sandbox call a
   NameError (a shipped regression; see the `fix(detect)` commit). The inner callable is renamed on
@@ -108,8 +124,12 @@ One companion rule ships under `.claude/rules/`:
   `DS_CLASSIFIER_LM` classifier, defaulting to the analyst). Refer to them by role in code, docs, and
   the prompt. No hardcoded model name.
 - **The budget is HARD — `max_retries=1`, no whole-RLM retry** (set in `detect.setup`). One change =
-  one trajectory, so the trace stays valid training data. An `RLMTaskError` is almost always infra (a
-  planner-endpoint hiccup / an adapter parse failure), NOT a schema bug — check the endpoint first.
+  one trajectory, so the trace stays valid training data. A failed run is INFRA before it is a schema
+  bug — check the endpoint first. Since rlm-harness 1.2.1 the failure names itself: a non-retryable
+  LM error (auth / billing / configuration / unsupported model) escapes after ONE attempt as the raw
+  `dspy.LMError` subclass, while an `RLMTaskError` means the single attempt ended in an adapter parse
+  failure, an invalid result, or a retryable endpoint fault (timeout / 5xx / transport). `cli.run`
+  catches BOTH into a `status=failed` response.
 - **A second model-judgement is a TOOL, never the sub-LM.** `deep_classify` is the swappable
   second-stage SEAM, built on rlm-harness's `make_model_tool` (chat → transient-retry → validate →
   circuit-break) — the planner CHOOSES to consult it, so the decision is a `tool_call` in the
@@ -198,4 +218,9 @@ One companion rule ships under `.claude/rules/`:
 
 ## Versioning
 
-- Keep `pyproject.toml` `[project].version` and `diff_sentry.__version__` in sync.
+- A release moves FIVE version sites together: `pyproject.toml` `[project].version`,
+  `diff_sentry.__version__`, `action.yml`'s `version` input default, the README quickstart's
+  `uses: qazbnm456/diff-sentry@vX.Y.Z`, and `uv.lock` (via `uv lock`) — plus a `CHANGELOG.md` entry.
+  `release.yml` gates the first three against the tag and the built wheel; the README `uses:` line is
+  gated by nothing, so a stale one sends new adopters to the previous release. Publishing the GitHub
+  Release (tag `vX.Y.Z`) is what builds, verifies, and uploads to PyPI, and what Marketplace lists.

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: diff-sentry
-Version: 0.4.1
+Version: 0.4.3
 Summary: Catch malicious pull requests before they merge: scan a diff for supply-chain attack patterns with deterministic evidence a model cannot suppress.
 Author: Boik Su
 License-Expression: MIT
@@ -9,7 +9,7 @@ Keywords: dspy,malicious-code-detection,prompt-injection,rlm,security,siem,suppl
 Requires-Python: >=3.11
 Requires-Dist: httpx>=0.27
 Requires-Dist: pydantic>=2.0
-Requires-Dist: rlm-harness==1.0.0
+Requires-Dist: rlm-harness==1.10.1
 Provides-Extra: classify
 Requires-Dist: openai>=1.0; extra == 'classify'
 Provides-Extra: observe
@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@v0.4.1
+      - uses: qazbnm456/diff-sentry@v0.4.3
 ```
 
 That is the whole setup. The job fails when an indicator at or above `high` fires.
@@ -53,7 +53,7 @@ That is the whole setup. The job fails when an indicator at or above `high` fire
 
 | Family | Examples |
 |---|---|
-| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI), `permissions: write-all`, CODEOWNERS reassignment |
+| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI) — by `ref:`, by a hand-rolled `git fetch`, or by opting back in with `allow-unsafe-pr-checkout: true` — plus `permissions: write-all` and CODEOWNERS reassignment |
 | Obfuscation | base64 that decodes to a shell payload, `_0x…` machine-mangled JavaScript, high-entropy blobs |
 | Execution | pipe-to-shell installs, `${IFS}` space-evasion, detached child processes, inline `node -e`, fetch-to-disk droppers |
 | Exfiltration | secrets reaching a network sink, cross-process `/proc/<pid>/mem` reads, OAST callback services, IPFS and permaweb gateways |

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/README.md

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@v0.4.1
+      - uses: qazbnm456/diff-sentry@v0.4.3
 ```
 
 That is the whole setup. The job fails when an indicator at or above `high` fires.
@@ -32,7 +32,7 @@ That is the whole setup. The job fails when an indicator at or above `high` fire
 
 | Family | Examples |
 |---|---|
-| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI), `permissions: write-all`, CODEOWNERS reassignment |
+| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI) — by `ref:`, by a hand-rolled `git fetch`, or by opting back in with `allow-unsafe-pr-checkout: true` — plus `permissions: write-all` and CODEOWNERS reassignment |
 | Obfuscation | base64 that decodes to a shell payload, `_0x…` machine-mangled JavaScript, high-entropy blobs |
 | Execution | pipe-to-shell installs, `${IFS}` space-evasion, detached child processes, inline `node -e`, fetch-to-disk droppers |
 | Exfiltration | secrets reaching a network sink, cross-process `/proc/<pid>/mem` reads, OAST callback services, IPFS and permaweb gateways |

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/action.yml

@@ -44,7 +44,7 @@ inputs:
     # KEEP IN STEP WITH [project].version. release.yml fails the build if this drifts
     # from the tag being released, because a stale default here would silently run an
     # old scanner under a new action tag.
-    default: '0.4.1'
+    default: '0.4.3'
 
 outputs:
   failed:
@@ -69,7 +69,7 @@ runs:
     - name: Install uv
       # SHA-pinned: a moving major tag on a third-party action could be repointed at code that runs
       # with the calling workflow's token. Bump the SHA and the trailing version comment together.
-      uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       with:
         enable-cache: true
 

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/diff_sentry/__init__.py

@@ -22,7 +22,7 @@ from __future__ import annotations
 from .assemble import assemble_verdict, verdict_from_events
 from .config import DetectConfig
 from .emit import EmitResult, emit_signal, signal_payload
-from .indicators import hits_from_events, scan_indicators
+from .indicators import hits_from_events, scan_content, scan_diff, scan_indicators
 from .ingest import event_from_payload, issue_event, pr_event
 from .normalize import event_metadata, normalize_event
 from .response import build_failed_response, build_response
@@ -44,6 +44,8 @@ __all__ = [
     "DetectionResponse",
     "RefusalInfo",
     "ProcessInfo",
+    "scan_content",
+    "scan_diff",
     "scan_indicators",
     "hits_from_events",
     "normalize_event",
@@ -68,7 +70,7 @@ __all__ = [
     "detect_from_event",
 ]
 
-__version__ = "0.4.1"
+__version__ = "0.4.3"
 
 
 def __getattr__(name: str):  # PEP 562 — defer the dspy import to first use

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/diff_sentry/cli.py

@@ -91,10 +91,9 @@ def _baseline_indicators(event: dict) -> list[dict]:
     """The host-side deterministic evidence recorded in run_start meta BEFORE the planner runs: the text
     detectors over the raw content ∪ the provenance detectors over the ingest facts. Both re-source into the
     evidence union on read (MF3), so a false-benign SUBMIT can skew the verdict but never suppress these."""
-    from .indicators import scan_indicators, scan_provenance
-    from .normalize import raw_content
+    from .indicators import scan_content, scan_provenance
 
-    return ([h.model_dump() for h in scan_indicators(raw_content(event))]
+    return ([h.model_dump() for h in scan_content(event)]
             + [h.model_dump() for h in scan_provenance(event.get("provenance") or {})])
 
 
@@ -245,7 +244,7 @@ def _cmd_scan(args) -> int:
     `DS_*` creds, and the only way to hand creds to a fork PR's run is `pull_request_target` — the exact
     misconfiguration that opened the AsyncAPI "Miasma" supply-chain compromise. `scan` needs nothing, so
     it runs under the same read-only `contents: read` token an untrusted fork PR already gets."""
-    from .indicators import scan_indicators
+    from .indicators import scan_diff
     from .schema import severity_rank
 
     threshold = severity_rank(args.fail_on)
@@ -259,7 +258,7 @@ def _cmd_scan(args) -> int:
             label = path
         if not args.include_deletions:
             text = drop_deleted_lines(text)
-        hits.extend(scan_indicators(text, location=label))
+        hits.extend(scan_diff(text, location=label))
 
     worst = max((severity_rank(h.severity) for h in hits), default=-1)
     failed = worst >= threshold

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/diff_sentry/config.py

@@ -72,7 +72,8 @@ class DetectConfig:
     # Generous, NOT None: a reasoning planner truncated before its answer returns empty content.
     planner_max_tokens: int | None = 16384
     # HARD ceiling on the single RLM episode. No outer multi-run loop (max_retries=1) — one change =
-    # one trajectory, so the trace stays valid training data. RLMTaskError is INFRA, not a schema bug.
+    # one trajectory, so the trace stays valid training data. A failed run is INFRA, not a schema bug:
+    # a non-retryable LM error escapes as the raw dspy.LMError (kit >= 1.2.1), the rest as RLMTaskError.
     max_iterations: int = 25
     max_llm_calls: int = 8          # caps ONLY analyst (llm_query) escalations
     max_output_chars: int = 10_000  # head+tail char cap dspy.RLM applies to each REPL output

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/diff_sentry/indicators.py

@@ -156,6 +156,17 @@ _HEAD_BINDING_RE = re.compile(
     rf"^[+ ]?\s*([A-Za-z_][A-Za-z0-9_-]*)\s*[:=]\s*[^\n]*(?:{_PR_HEAD_EXPR})",
     re.IGNORECASE | re.MULTILINE)
 _REF_VALUE_RE = re.compile(r"^[+ ]?\s*ref\s*:\s*([^\n]*)", re.IGNORECASE | re.MULTILINE)
+
+# The third way to check out a fork PR head, and the only one that says so in words. actions/checkout
+# v5.1/v6.1/v7 REFUSE to check out a fork PR under `pull_request_target`/`workflow_run` unless the
+# workflow opts back in with `allow-unsafe-pr-checkout: true`. There is no ref to trace and no dataflow
+# to infer — the line is the intent, written out. Under `pull_request` it means nothing (no privileged
+# context to protect), which is why it only counts inside `_scan_workflow_config`'s trigger guard.
+# Literal `true` only: an expression value is a parameterisation question, not evidence, and the
+# `^[+ ]?` anchor keeps a REMOVED opt-in (the hardening you want) from firing.
+_UNSAFE_PR_CHECKOUT_RE = re.compile(
+    r"^[+ ]?\s*allow-unsafe-pr-checkout\s*:\s*[\"']?true[\"']?\s*$",
+    re.IGNORECASE | re.MULTILINE)
 _IDENT_RE = re.compile(r"[A-Za-z_][A-Za-z0-9_-]*")
 
 # Diff-PRESENTATION evasion — attacks aimed at the human reading the diff, not at the runtime. Miasma
@@ -308,18 +319,31 @@ def _scan_workflow_perms(text: str) -> list[IndicatorHit]:
             for m in _WRITE_ALL_RE.finditer(text)]
 
 
-def _pr_head_checkout(text: str) -> re.Match[str] | None:
-    """Where a PR-HEAD expression actually reaches a checkout — directly, or through one binding."""
+_PWN_TITLE = ("privileged fork trigger checks out the PR HEAD — untrusted code with the base "
+              "repo's token/secrets")
+_PWN_OPTIN_TITLE = ("privileged fork trigger re-enables the fork-PR checkout actions/checkout now "
+                    "blocks by default — untrusted code with the base repo's token/secrets")
+
+
+def _pr_head_checkout(text: str) -> tuple[re.Match[str], str] | None:
+    """Where a PR-HEAD checkout actually happens, and which of the three forms it took.
+
+    Returns the match to cite plus the title for it — the opt-in reads differently enough from a ref
+    that reporting it as "checks out the PR HEAD" would send a reader looking for a `ref:` that is not
+    there."""
+    optin = _UNSAFE_PR_CHECKOUT_RE.search(text)
+    if optin:
+        return optin, _PWN_OPTIN_TITLE
     direct = _PR_HEAD_CHECKOUT_RE.search(text)
     if direct:
-        return direct
+        return direct, _PWN_TITLE
     # `ref:` is not a binding — a `ref:` holding the expression IS the direct case above.
     bound = {m.group(1).lower() for m in _HEAD_BINDING_RE.finditer(text)} - {"ref"}
     if not bound:
         return None
     for m in _REF_VALUE_RE.finditer(text):
         if any(name.lower() in bound for name in _IDENT_RE.findall(m.group(1))):
-            return m
+            return m, _PWN_TITLE
     return None
 
 
@@ -330,10 +354,9 @@ def _scan_workflow_config(text: str) -> list[IndicatorHit]:
         return []
     checkout = _pr_head_checkout(text)
     if checkout:
-        return [_hit("pwn-request", "critical",
-                     "privileged fork trigger checks out the PR HEAD — untrusted code with the base "
-                     "repo's token/secrets",
-                     _snip(text, checkout.start(), checkout.end()))]
+        match, title = checkout
+        return [_hit("pwn-request", "critical", title,
+                     _snip(text, match.start(), match.end()))]
     head = _PR_HEAD_REF_RE.search(text)
     if head:
         # Reads the head ref without checking it out. That is the validating-publisher shape, which is
@@ -442,6 +465,72 @@ def _sev_rank(sev: str) -> int:
     return severity_rank(sev)
 
 
+# ── diff SCOPING ──────────────────────────────────────────────────────────────────────────────────────
+# A change is many files, and `scan_indicators` reads whatever it is handed as ONE string. That is right
+# for the rules that fire on a single match, but two of them require a PAIR of signals — `pwn-request`
+# (privileged trigger + PR-HEAD checkout) and `detached-process-spawn` (detached spawn + child_process).
+# Read as one blob, those pair ACROSS FILES: a `workflow_run:` added to one workflow and a
+# `ref: ${{ github.event.pull_request.head.sha }}` sitting in an unrelated file — a doc example, a test
+# fixture, or the very workflow the change is DELETING — compose into a `critical` that no single file
+# contains. Scoping the scan per file removes that class outright, and names the file in `location`
+# while it is there: evidence that used to read `gated.diff` for every hit now points at what to open.
+#
+# The trade is explicit: a payload deliberately split across two files no longer pairs. That is the
+# right way round — a detector that invents a critical out of two unrelated files trains people to
+# disable it, and the single-signal rules (which are most of them) are unaffected either way.
+_DIFF_FILE_RE = re.compile(r"^diff --git a/(?P<a>.+?) b/(?P<b>.+?)$", re.MULTILINE)
+
+
+def split_diff_by_file(text: str) -> list[tuple[str, str]]:
+    """Split a unified diff into `(path, segment)` pairs; `[]` when `text` is not a diff.
+
+    Anything BEFORE the first file header comes back first with an empty path. That chunk is not
+    padding — for `raw_content` it is the PR title and body, which is exactly where prompt injection
+    lives, so it has to keep being scanned rather than skipped as preamble."""
+    marks = list(_DIFF_FILE_RE.finditer(text or ""))
+    if not marks:
+        return []
+    out: list[tuple[str, str]] = []
+    head = text[:marks[0].start()]
+    if head.strip():
+        out.append(("", head))
+    for i, m in enumerate(marks):
+        end = marks[i + 1].start() if i + 1 < len(marks) else len(text)
+        out.append((m.group("b") or m.group("a"), text[m.start():end]))
+    return out
+
+
+def scan_content(event: dict) -> list[IndicatorHit]:
+    """Scan ONE event's untrusted content with the same per-file scoping `scan_diff` gives a raw diff.
+
+    An event is not a unified diff — `raw_content` concatenates the title, the author, every
+    (filename, patch) and the body into one string, with no `diff --git` headers for `scan_diff` to
+    split on. Handing that blob to `scan_diff` therefore scopes NOTHING: a paired rule could still take
+    one half from a workflow and the other from an unrelated file. The event already carries the
+    structure a raw diff has to be parsed for, so scan it piece by piece and let hits from a file name
+    that file."""
+    from .normalize import content_segments
+    deduped: dict[str, IndicatorHit] = {}
+    for label, text in content_segments(event):
+        for h in scan_indicators(text, location=label):
+            deduped.setdefault(h.id, h)
+    return list(deduped.values())
+
+
+def scan_diff(text: str, *, location: str = "") -> list[IndicatorHit]:
+    """`scan_indicators` with per-file scoping — a paired rule can only fire when ONE file carries both
+    halves. Non-diff input (a region the planner pulled out, a plain file) falls through to a single
+    whole-text scan, so this is safe as the entry point for either shape."""
+    segments = split_diff_by_file(text)
+    if not segments:
+        return scan_indicators(text, location=location)
+    deduped: dict[str, IndicatorHit] = {}
+    for path, segment in segments:
+        for h in scan_indicators(segment, location=path or location):
+            deduped.setdefault(h.id, h)
+    return list(deduped.values())
+
+
 def scan_indicators(text: str, *, location: str = "") -> list[IndicatorHit]:
     """Run every detector over `text` and return the DEDUPED union of hits (by deterministic id).
 
@@ -589,7 +678,11 @@ def make_indicator_tool() -> Callable[[str], str]:
         injection, obfuscated payloads, secret exfiltration, known exfil/OAST callback services,
         CI/CODEOWNERS tampering, workflow permission escalation, CI-skip bypass, prompt injection. Returns
         the hits found (id, rule, severity, title). Cite an id in your final `indicator_ids`."""
-        hits = scan_indicators(region or "")
+        # scan_diff, not scan_indicators: when the planner hands back a whole diff this scopes it per
+        # file exactly as the host-side baseline did, so the two scans of the same content still mint
+        # the same ids and de-duplicate to one union member (MF3). A sub-region is not a diff and falls
+        # through to the plain whole-text scan.
+        hits = scan_diff(region or "")
         record_tool_call("scan_indicators", args={"region": (region or "")[:200]}, ok=True,
                          hits=[h.model_dump() for h in hits], n=len(hits))
         if not hits:

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/diff_sentry/normalize.py

@@ -159,13 +159,25 @@ def has_groundable_content(event_str: str) -> bool:
     return bool(body) and body != NO_CONTENT_SENTINEL
 
 
+def content_segments(event: dict) -> list[tuple[str, str]]:
+    """The untrusted content split the way the event already carries it: `(label, text)` per piece —
+    the title+author, then one segment per file, then the body.
+
+    `raw_content` is the concatenation of exactly these, in this order, so the two cannot drift and the
+    content digest built on it stays byte-stable. The split exists because the baseline scan needs the
+    same per-file scoping `scan_diff` gives a raw diff: read as one blob, a rule that needs two signals
+    could take one from a workflow and the other from an unrelated file. A file's segment keeps its
+    filename INSIDE the text as well as in the label — `workflow-tamper` reads the path itself."""
+    files = _files(event)
+    segments = [("", f"{event.get('title', '') or ''}\n{event.get('author', '') or ''}")]
+    segments += [(f["filename"], f"{f['filename']}\n{f['patch']}") for f in files]
+    segments.append(("", str(event.get("body", "") or "")))
+    return segments
+
+
 def raw_content(event: dict) -> str:
     """The concatenated untrusted content the host-side BASELINE scan runs on — TITLE + author +
     (filename + patch) per file + body. The title is included so a title-borne prompt injection is caught
     by the deterministic baseline even when the planner is skewed by the same payload (MF3): an issue/PR
     title is a canonical injection channel, and its hits must reach the signal regardless of the verdict."""
-    files = _files(event)
-    parts = [str(event.get("title", "") or ""), str(event.get("author", "") or "")]
-    parts += [f"{f['filename']}\n{f['patch']}" for f in files]
-    parts.append(str(event.get("body", "") or ""))
-    return "\n".join(parts)
+    return "\n".join(text for _, text in content_segments(event))

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "diff-sentry"
-version = "0.4.1"
+version = "0.4.3"
 description = "Catch malicious pull requests before they merge: scan a diff for supply-chain attack patterns with deterministic evidence a model cannot suppress."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -8,8 +8,8 @@ license = "MIT"
 authors = [{ name = "Boik Su" }]
 keywords = ["rlm", "dspy", "security", "malicious-code-detection", "supply-chain-security", "prompt-injection", "siem"]
 dependencies = [
-    # Pinned exactly: 1.0.0 freezes the kit's public surface under SemVer.
-    "rlm-harness==1.0.0",
+    # Pinned exactly (the kit's public surface has been SemVer-frozen since 1.0.0); bump deliberately.
+    "rlm-harness==1.10.1",
     "pydantic>=2.0",
     "httpx>=0.27",      # the GitHub-allowlisted enrichment fetcher + the host-side SIEM emitter
 ]

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/studio/diff_sentry_studio/iterations.py

@@ -57,11 +57,19 @@ def _gap(ts: float | None, prev: float | None) -> float | None:
     return round(ts - prev, 3) if (ts is not None and prev is not None) else None
 
 
+def _took(p: dict, gap: float | None) -> float | None:
+    """How long a tool / analyst call took. rlm-harness >= 1.8.3 measures every call and writes
+    `payload.duration_s`; prefer that. The gap since the previous live event is only a FALLBACK for a
+    trace that predates it — it charges the whole preceding planner turn to a sub-millisecond scan."""
+    d = p.get("duration_s")
+    return round(float(d), 6) if isinstance(d, (int, float)) and not isinstance(d, bool) else gap
+
+
 def _tool_entry(p: dict, gap: float | None) -> dict:
     """One tool_call → a UI-ready entry: a label, the input it was given, the output it returned."""
     tool = p.get("tool")
     args = p.get("args") or {}
-    e: dict = {"kind": "tool", "tool": tool, "ok": p.get("ok"), "duration_s": gap}
+    e: dict = {"kind": "tool", "tool": tool, "ok": p.get("ok"), "duration_s": _took(p, gap)}
     if tool == "scan_indicators":
         hits = p.get("hits") or []
         e.update(label="scan", target=_preview(args.get("region")), n=p.get("n") or len(hits),
@@ -92,7 +100,7 @@ def _tool_entry(p: dict, gap: float | None) -> dict:
 def _sub_entry(p: dict, gap: float | None) -> dict:
     """One sub_call (an analyst escalation) → the distilled question + the answer it returned."""
     return {"kind": "analyst", "label": "analyst", "model": p.get("name") or p.get("model"),
-            "duration_s": gap, "input": _preview(p.get("input")),
+            "duration_s": _took(p, gap), "input": _preview(p.get("input")),
             "output": _preview(p.get("processed") or p.get("raw")), "error": p.get("error")}
 
 
@@ -141,7 +149,8 @@ def build_iterations(events: list[dict]) -> dict:
       finalize, so their ts cluster at one instant; we detect that, set `per_turn_timing=False`, and skip
       per-turn durations rather than fake them.
     - `timeline` — the `tool_call`/`sub_call` events, ALWAYS recorded LIVE with real `ts`. Each entry
-      carries `rel_s` (since run start) and `duration_s` (the gap since the previous live event). The
+      carries `rel_s` (since run start) and `duration_s` (the kit's measured call time, else the gap
+      since the previous live event). The
       accurate "where did the time go" signal either way, and the headline for debugging a slow run.
     """
     evs = sorted(events, key=_step_key)

{diff_sentry-0.4.1 → diff_sentry-0.4.3}/studio/diff_sentry_studio/live.py

@@ -123,7 +123,9 @@ def _describe_exc(exc: BaseException) -> str:
     """One line describing a run failure, INCLUDING its underlying cause. `RLMTaskError` reports the
     opaque "Failed to produce a valid 'result' after N attempts"; the real reason (a planner-endpoint
     error, an adapter parse failure) is on `__cause__`. Surfacing it stops an infra hiccup from reading
-    like a content/schema problem (diff-sentry's own CLAUDE.md: an RLMTaskError is almost always infra)."""
+    like a content/schema problem (diff-sentry's own CLAUDE.md: a failed run is infra before it is a
+    schema bug). A non-retryable LM error (rlm-harness >= 1.2.1) arrives unwrapped as the raw
+    `dspy.LMError` subclass, so its own class name already says "fix the credential"."""
     out = f"{type(exc).__name__}: {exc}"
     cause = exc.__cause__ or exc.__context__
     if cause is not None and cause is not exc: