ghostrules 0.3.0__tar.gz → 0.4.1__tar.gz

{ghostrules-0.3.0 → ghostrules-0.4.1}/.ghostrules.lock

@@ -3,22 +3,22 @@
     "claude-code": [
       {
         "conditions": [],
-        "lines": "2a3d3f1fb26381e9 e3b0c44298fc1c14 ddabff43c0a4efe5 6aa552cc1598dcb7 be186e6b970ab643 fb78540ec32b52f9 e3b0c44298fc1c14 d393a517d5cbec9f e3b0c44298fc1c14 85b7ae55df076ab0 2f6995b0ecd75c8d e3b0c44298fc1c14 5f2235a1b010f82c 56a4406ad70b7f0a ba2cd86d7e76eff5 a7b723b74ee03fc8 e3b0c44298fc1c14 782729a560418c17 36a8e590ff4c085c e3b0c44298fc1c14 9f4e3cc48918efc0 efeeec23855e4659 2f23b1dcff8841e8 c3abd357eb574eb6 76881ea91e0040bd e3b0c44298fc1c14 36cd3f2bb454f575 ad332335cfaa348c a58865feac87f52b 052081156966d443 5654f9fffd4a2a7a bd0710fd0315ecbb e4d8cec4158bb770 f1b901847390b0ed e3b0c44298fc1c14 966a8946115b377a 5b59b2f749ffabac 9bf96d3c4c385073 43d8bbb16372109c 5226bbb3f5f9e13d add6d744d3ac0c02 3dafca094d79548b 21a3cd5236dfd642 79e12b3b50117933 9cb81024d1184666 f1e7b346d65f35c5 e3b0c44298fc1c14 60ab6be4219694a0 3a1c5dcc5281208a e256f3fb8239bf8c 10d8918d097bebb5 ff85c33a894fab39 10f274c7d25257d2 6216cf539fa87bd8 e3b0c44298fc1c14 7136000e494604c0 aa8d4cf82644ac63 f75f6ee8f0d942eb 1f59b655e6071114 da29957f3e8be475",
+        "lines": "2a3d3f1fb26381e9 e3b0c44298fc1c14 ddabff43c0a4efe5 6aa552cc1598dcb7 be186e6b970ab643 fb78540ec32b52f9 e3b0c44298fc1c14 662c42577f74cece e3b0c44298fc1c14 85b7ae55df076ab0 2f6995b0ecd75c8d e3b0c44298fc1c14 5f2235a1b010f82c 56a4406ad70b7f0a ba2cd86d7e76eff5 a7b723b74ee03fc8 e3b0c44298fc1c14 782729a560418c17 36a8e590ff4c085c e3b0c44298fc1c14 9f4e3cc48918efc0 efeeec23855e4659 2f23b1dcff8841e8 c3abd357eb574eb6 76881ea91e0040bd e3b0c44298fc1c14 36cd3f2bb454f575 ad332335cfaa348c a58865feac87f52b 052081156966d443 5654f9fffd4a2a7a bd0710fd0315ecbb e4d8cec4158bb770 f1b901847390b0ed e3b0c44298fc1c14 966a8946115b377a 5b59b2f749ffabac 9bf96d3c4c385073 43d8bbb16372109c 5226bbb3f5f9e13d add6d744d3ac0c02 3dafca094d79548b 21a3cd5236dfd642 79e12b3b50117933 9cb81024d1184666 f1e7b346d65f35c5 e3b0c44298fc1c14 60ab6be4219694a0 3a1c5dcc5281208a e256f3fb8239bf8c 10d8918d097bebb5 ff85c33a894fab39 10f274c7d25257d2 6216cf539fa87bd8 e3b0c44298fc1c14 7136000e494604c0 aa8d4cf82644ac63 f75f6ee8f0d942eb 1f59b655e6071114 da29957f3e8be475",
         "load": "always",
         "path": "CLAUDE.md",
-        "raw_sha256": "c21de91b03da043818a3d8a83418a2e4ce449e58e1e6a5906e7d7c2212ddfca5",
-        "seen_sha256": "c21de91b03da043818a3d8a83418a2e4ce449e58e1e6a5906e7d7c2212ddfca5",
+        "raw_sha256": "d989296d3afb40ba35cdf955a9dcc549df351fa4a5b0ee4585475e94e86e774c",
+        "seen_sha256": "d989296d3afb40ba35cdf955a9dcc549df351fa4a5b0ee4585475e94e86e774c",
         "via": []
       }
     ],
     "copilot-cli": [
       {
         "conditions": [],
-        "lines": "2a3d3f1fb26381e9 e3b0c44298fc1c14 ddabff43c0a4efe5 6aa552cc1598dcb7 be186e6b970ab643 fb78540ec32b52f9 e3b0c44298fc1c14 d393a517d5cbec9f e3b0c44298fc1c14 85b7ae55df076ab0 2f6995b0ecd75c8d e3b0c44298fc1c14 5f2235a1b010f82c 56a4406ad70b7f0a ba2cd86d7e76eff5 a7b723b74ee03fc8 e3b0c44298fc1c14 782729a560418c17 36a8e590ff4c085c e3b0c44298fc1c14 9f4e3cc48918efc0 efeeec23855e4659 2f23b1dcff8841e8 c3abd357eb574eb6 76881ea91e0040bd e3b0c44298fc1c14 36cd3f2bb454f575 ad332335cfaa348c a58865feac87f52b 052081156966d443 5654f9fffd4a2a7a bd0710fd0315ecbb e4d8cec4158bb770 f1b901847390b0ed e3b0c44298fc1c14 966a8946115b377a 5b59b2f749ffabac 9bf96d3c4c385073 43d8bbb16372109c 5226bbb3f5f9e13d add6d744d3ac0c02 3dafca094d79548b 21a3cd5236dfd642 79e12b3b50117933 9cb81024d1184666 f1e7b346d65f35c5 e3b0c44298fc1c14 60ab6be4219694a0 3a1c5dcc5281208a e256f3fb8239bf8c 10d8918d097bebb5 ff85c33a894fab39 10f274c7d25257d2 6216cf539fa87bd8 e3b0c44298fc1c14 7136000e494604c0 aa8d4cf82644ac63 f75f6ee8f0d942eb 1f59b655e6071114 da29957f3e8be475",
+        "lines": "2a3d3f1fb26381e9 e3b0c44298fc1c14 ddabff43c0a4efe5 6aa552cc1598dcb7 be186e6b970ab643 fb78540ec32b52f9 e3b0c44298fc1c14 662c42577f74cece e3b0c44298fc1c14 85b7ae55df076ab0 2f6995b0ecd75c8d e3b0c44298fc1c14 5f2235a1b010f82c 56a4406ad70b7f0a ba2cd86d7e76eff5 a7b723b74ee03fc8 e3b0c44298fc1c14 782729a560418c17 36a8e590ff4c085c e3b0c44298fc1c14 9f4e3cc48918efc0 efeeec23855e4659 2f23b1dcff8841e8 c3abd357eb574eb6 76881ea91e0040bd e3b0c44298fc1c14 36cd3f2bb454f575 ad332335cfaa348c a58865feac87f52b 052081156966d443 5654f9fffd4a2a7a bd0710fd0315ecbb e4d8cec4158bb770 f1b901847390b0ed e3b0c44298fc1c14 966a8946115b377a 5b59b2f749ffabac 9bf96d3c4c385073 43d8bbb16372109c 5226bbb3f5f9e13d add6d744d3ac0c02 3dafca094d79548b 21a3cd5236dfd642 79e12b3b50117933 9cb81024d1184666 f1e7b346d65f35c5 e3b0c44298fc1c14 60ab6be4219694a0 3a1c5dcc5281208a e256f3fb8239bf8c 10d8918d097bebb5 ff85c33a894fab39 10f274c7d25257d2 6216cf539fa87bd8 e3b0c44298fc1c14 7136000e494604c0 aa8d4cf82644ac63 f75f6ee8f0d942eb 1f59b655e6071114 da29957f3e8be475",
         "load": "always",
         "path": "CLAUDE.md",
-        "raw_sha256": "c21de91b03da043818a3d8a83418a2e4ce449e58e1e6a5906e7d7c2212ddfca5",
-        "seen_sha256": "c21de91b03da043818a3d8a83418a2e4ce449e58e1e6a5906e7d7c2212ddfca5",
+        "raw_sha256": "d989296d3afb40ba35cdf955a9dcc549df351fa4a5b0ee4585475e94e86e774c",
+        "seen_sha256": "d989296d3afb40ba35cdf955a9dcc549df351fa4a5b0ee4585475e94e86e774c",
         "via": []
       }
     ],
@@ -26,6 +26,6 @@
     "generic": []
   },
   "configs": [],
-  "generator": "ghostrules 0.3.0",
+  "generator": "ghostrules 0.4.1",
   "lock_version": 1
 }

ghostrules-0.4.1/.github/dependabot.yml

@@ -0,0 +1,10 @@
+# Keeps the commit-pinned actions in .github/workflows and action.yml up to date: each update is a
+# pull request that changes the SHA and its version comment.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore"

{ghostrules-0.3.0 → ghostrules-0.4.1}/.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install

{ghostrules-0.3.0 → ghostrules-0.4.1}/.github/workflows/corpus.yml

@@ -21,8 +21,8 @@ jobs:
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
       - name: Install ghostrules from this checkout
@@ -36,7 +36,7 @@ jobs:
         run: python corpus/badge.py --out corpus-public
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: corpus-results
           path: |
@@ -46,27 +46,28 @@ jobs:
           if-no-files-found: ignore
 
   publish:
-    # Only the default branch publishes; the badge reads corpus/badge.json from gh-pages.
+    # Only the default branch publishes; the badge reads corpus/badge.json from the orphan
+    # branch "badges" (gh-pages is not served: Pages is deployed from Actions by pages.yml).
     needs: corpus
     if: always() && needs.corpus.result != 'skipped' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: corpus-results
           path: artifact
-      - name: Publish to gh-pages
+      - name: Publish to the badges branch
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           test -f artifact/corpus-public/badge.json
-          git clone --quiet --depth 1 --branch gh-pages \
+          git clone --quiet --depth 1 --branch badges \
             "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" site \
-            || { mkdir site && git -C site init --quiet -b gh-pages \
+            || { mkdir site && git -C site init --quiet -b badges \
               && git -C site remote add origin \
               "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git"; }
           mkdir -p site/corpus
@@ -76,4 +77,4 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add corpus
           git diff --cached --quiet || git commit --quiet -m "corpus: weekly summary"
-          git push origin gh-pages
+          git push origin badges

{ghostrules-0.3.0 → ghostrules-0.4.1}/.github/workflows/release.yml

@@ -14,9 +14,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
 
@@ -41,7 +41,7 @@ jobs:
           python -m pip install --disable-pip-version-check --quiet build
           python -m build
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: dist
           path: |
@@ -55,10 +55,10 @@ jobs:
     permissions:
       id-token: write # Trusted Publishing
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: dist
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
 
   github-release:
     needs: publish-pypi
@@ -66,7 +66,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: dist
       - name: Create the GitHub release
@@ -75,3 +75,24 @@ jobs:
           TAG: ${{ github.ref_name }}
           REPO: ${{ github.repository }}
         run: gh release create "$TAG" dist/* --repo "$REPO" --title "$TAG" --notes-file release-notes.md
+
+  move-major-tag:
+    # Users pin BardLaudian/ghostrules@v0 (or an exact tag). Only a stable x.y.z release moves it.
+    needs: github-release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Move the v0 tag to this release
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          if ! [[ "$TAG" =~ ^v0\.[0-9]+\.[0-9]+$ ]]; then
+            echo "$TAG is not a stable v0.x.y release: the v0 tag stays where it is"
+            exit 0
+          fi
+          git tag -f v0 "$TAG"
+          git push --force origin v0
+

{ghostrules-0.3.0 → ghostrules-0.4.1}/.github/workflows/self-test.yml

@@ -13,7 +13,7 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Poisoned demo with fail-on none (must pass, must report findings)
         id: poisoned
@@ -75,7 +75,7 @@ jobs:
   import-chain:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Import-chain demo, following imports (default)
         uses: ./
@@ -125,6 +125,9 @@ jobs:
         uses: ./
         with:
           path: ${{ runner.temp }}/acme/base
+          # not a git repository: scanned with its own settings
+          trust-repo-config: "true"
+          inline-suppressions: all
           fail-on: none
           lock-check: "true"
           upload-sarif: "false"
@@ -140,6 +143,9 @@ jobs:
         continue-on-error: true
         with:
           path: ${{ runner.temp }}/acme/pr
+          # not a git repository: scanned with its own settings
+          trust-repo-config: "true"
+          inline-suppressions: all
           fail-on: none
           lock-check: "true"
           upload-sarif: "false"

{ghostrules-0.3.0 → ghostrules-0.4.1}/.gitignore

@@ -18,3 +18,6 @@ corpus/.cache/
 corpus/results/*
 !corpus/results/latest-summary.json
 _site/
+
+# benchmark: findings of third-party repositories
+bench/.cache/

{ghostrules-0.3.0 → ghostrules-0.4.1}/CHANGELOG.md

@@ -5,6 +5,147 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-10-29
+
+Follow-up to 0.4.0: fewer false positives on scripts, fewer misses on visible attacks, and a
+benchmark headline that no longer counts cases the author wrote. No breaking changes.
+
+### Changed
+
+- **Visible prose that reads as an attack stays `high`.** Inside one paragraph, exfiltration plus
+  concealment (GR013 + GR011), override plus exfiltration (GR010 + GR013) and a sensitive file plus
+  a URL outside `allow_domains` (GR014 + URL) keep the rule's severity even though the text is
+  visible. Examples, quotations, code blocks and descriptions stay `low`. On the held-out set no
+  repository starts to fail the check, but two GR014 findings already labelled false positive now
+  report `high`.
+- **GR110 no longer reports a token sent to the service it belongs to**: `GITHUB_*`/`GH_*` to
+  `api.github.com`, `github.com` or `uploads.github.com`; `AZURE_*`, `ADO_*` and `SYSTEM_ACCESSTOKEN`
+  to `dev.azure.com` or `*.visualstudio.com`; `<X>_API_KEY` to a host that contains `x`. It still
+  reports any other host, a collector domain, the whole environment, a credentials file, a variable
+  with no known service and a destination it cannot read. The held-out GR110 finding is still
+  reported: its shape is not covered.
+- **The benchmark headline counts only the independent cases.** Recall is split by origin (`author`,
+  `review`, `public`; `ours` is now `author`) and the README states the independent figure first,
+  with its sample size. Every number in `README.md` and `bench/README.md` is generated from the data
+  (`python bench/run.py report --write`) and a test fails when one is stale.
+
+### Added
+
+- **Inline hook code is read as a script**: the code in `python3 -c`, `node -e`, `bash -c` and `sh -c`
+  (and the other interpreters in the hook table) is checked by GR110–GR113. The finding points at the
+  command in the settings file.
+
+## [0.4.0] - 2026-10-29
+
+Remediation release, from an independent review of 0.3.0 ([plan](docs/design/v0.4/REMEDIATION.md)).
+The scanned change can no longer switch the scanner off, the lock cannot be re-blessed by a pull
+request, visible prose no longer drowns the check, claims are corrected and measured, and the scanner
+reads more of what agents run. On a new benchmark (101 attack cases and a 100-repository held-out
+set, `bench/`): 87 of 101 attacks reported, 50 fail the default check; precision for a user on the
+held-out set is 19% (4 of 21 findings, labels provisional). Both numbers come with their misses.
+
+**Upgrading: breaking changes.** (1) On pull requests the Action reads the config, the ignore comments,
+the baseline and the lock from the base commit; a path outside a git repository needs
+`trust-repo-config: "true"` and `inline-suppressions: all`. (2) Plain visible prose is `low` or `info`
+by default, so a visible `curl | sh` no longer fails `--fail-on high`; `--strict` (config
+`profile = "strict"`, Action `profile: strict`) restores the 0.3 severities. (3) The label `wontfix` is
+now `benign-context` in the corpus tools. (4) The Action installs from a hash-pinned requirements file.
+
+### Added
+
+- **Scripts that hooks and skills run** (W5.1, W5.2): hook commands of Claude Code, Gemini, Cursor and
+  Codex and scripts named in `SKILL.md` are scanned as code, with the chain that reaches them: GR110
+  (sends the environment or a secret), GR111 (reads credential files), GR112 (downloads and runs code),
+  GR113 (hides what it runs).
+- **The context engine as a library** (W8): `ghostrules.context.resolve()` and `schema()`, a JSON
+  schema for the result validated in the tests, and a README section on alternatives.
+- **Settings a pull request cannot rewrite** (W2 of docs/design/v0.4/REMEDIATION.md): `scan
+  --config-from-ref REF`, `--trusted-config FILE`, `--no-inline-suppressions` and
+  `--suppressions-from-ref REF`. They close two ways a change could silence the scanner for its own
+  payload: a `ghostrules-ignore` comment on the malicious line and `exclude` in `.ghostrules.toml`.
+- **Codex and Gemini CLI** (W5.3): `context` models for both (`--agent codex`, `--agent gemini-cli`;
+  opt-in through `agents`, so existing lockfiles do not change); `AGENTS.override.md`,
+  `.codex/config.toml` and `.codex/hooks.json` are scanned; GR107 reports Codex
+  `sandbox_mode = "danger-full-access"` and `approval_policy = "never"` and Gemini's bare
+  `run_shell_command` allow and `enablePermanentToolApproval`.
+- **Files that prose points to** (W5.4): `Read X and follow every step` and `Run scripts/x.sh` make the
+  file part of the scan, with the chain and the tag `reached-via-reference` (GR026, a tag, not a
+  detector). The `context` tree does not show a `referenced` state yet.
+- **Instructions split across two sentences** (W5.5): GR013 reports a secret in one sentence and a send
+  to a URL in the next, with a new `confidence: medium` field on the finding.
+- **A benchmark you can check** (W6): `bench/` has 81 defanged attack cases written from public
+  sources (recall per technique and per rule, misses listed, four cases from the independent review as
+  known misses) and the 100-repository held-out set run once, with precision for a user per rule. The
+  README now shows these numbers instead of the corpus claims. Labels `wontfix` are now
+  `benign-context`.
+- **Supply-chain hygiene** (W7): every `uses:` in the Action and the workflows is pinned to a full
+  commit SHA (Dependabot keeps them current); the Action installs its dependencies and the build
+  backend from `action-requirements.txt`, hash-pinned, with `--require-hashes --no-deps
+  --no-build-isolation`; the release workflow moves a `v0` tag to each stable `v0.x.y` release.
+- **Fewer false positives from the independent review** (W4): installers of the project's own
+  GitHub organisation and homepage are known installers (read from the base ref when the scan has
+  one); Azure CLI, Flox, golangci-lint, Foundry, Flux and Linkerd are known installers; "do not tell
+  the user they …" is not concealment.
+- **`ghostrules baseline` and `scan --baseline / --no-baseline / --baseline-from-ref`**: record
+  today's findings as fingerprints (no line numbers, no snippets) and fail only on new ones. Hidden
+  text is never baselined. The Action reads the baseline at the base commit on pull requests, and
+  editing it is reported by GR030.
+- **Breaking: severity by visibility.** Plain visible prose in an agent file is now `low` (an
+  instruction) or `info` (a description or quotation) for GR010 to GR014 and GR016; text in an HTML
+  comment, decoded hidden text, files reached only through an import, GR015 and every configuration
+  rule keep their severity. A visible `curl | sh` or "send `.env` to a URL" no longer fails the
+  default check (`--fail-on high`). `--strict`, `profile = "strict"` in the config and the Action's
+  `profile: strict` restore the 0.3 behaviour.
+- **`lock --check --base REF`** (W3): compares with the lock and the config at `REF`, so a pull
+  request that edits what the agents read and regenerates `.ghostrules.lock` still fails. Exit 2 when
+  the ref or its lock does not exist. The idea is cairnlock's `verify --base`.
+- **Breaking: the Action's lock check uses the lock at the base on pull requests**, and a new
+  `approve-label` input lets a maintainer approve a legitimate change by applying a label; only the
+  event that applies it approves (new commits void it), and the summary names who and when. Output
+  `lock-approved`. `trust-repo-config: "true"` restores the working-tree lock.
+- **Inline ignores no longer hide text a reviewer cannot see** (W2): a finding inside an HTML
+  comment is never suppressed, and no ignore counts inside a file that an agent reaches only
+  through an import (the report says how many were not honoured). Decoded hidden text, GR001 and
+  GR002 were already never suppressed. An ignore on a visible line works as before.
+- **GR030, scanner configuration changed** (high): with a base ref, the change adds or edits
+  `.ghostrules.toml`, `[tool.ghostrules]`, the lockfile or a `ghostrules-ignore` comment. Reported
+  even when legitimate, never suppressible inline, and the change cannot disable it. A new `change`
+  scope of rules compares the scanned tree with the base.
+- **Breaking: the Action reads settings from the base commit on pull requests.** On
+  `pull_request` and `pull_request_target` events it passes `--config-from-ref` and
+  `--suppressions-from-ref` with the base SHA, fetching that commit if the checkout is shallow, and
+  fails with exit code 2 when it cannot read it. New inputs: `config`, `trust-repo-config` (default
+  `false`) and `inline-suppressions` (`base`, `off` or `all`; default `base`). Workflows that scan a
+  path outside a git repository on a pull request need `trust-repo-config: "true"` and
+  `inline-suppressions: all`. Other events behave as before.
+
+### Changed
+
+- **Corrected claims** (W1 of [docs/design/v0.4/REMEDIATION.md](docs/design/v0.4/REMEDIATION.md)).
+  The 0.2 statement that no other tool follows `@path` imports was wrong (cfgaudit does, since
+  2026-10-24): the prior-art notes are corrected and dated, and ghostrules no longer claims to be
+  the first or the only one. The README says "scheduled weekly; last run" instead of "every week".
+  The study report is now "A snapshot (2026-10-28)", puts hygiene statistics apart from security
+  indicators, shows a numerator and denominator next to each percentage, explains the MCP
+  denominator (a lower bound, so the share is an upper bound), counts benign-context matches as noise
+  in a per-rule precision table, and has a "Threats to validity" section. The 0.3.0 notes below are
+  left as published.
+- README restructured as a landing page; option tables, configuration, supported files, FAQ and limits
+  moved to `docs/USAGE.md`, and the rules table to `docs/RULES.md`.
+- SARIF `helpUri` points to `docs/RULES.md#grNNN` (the rules table moved there).
+
+### Known limits
+
+- Paraphrases, languages other than English and Spanish (GR013 has no Spanish patterns), a few read
+  verbs (`Open ~/.npmrc`), `exec(urlopen())`, endpoint overrides in settings and the descriptions an MCP
+  server serves are not caught: 14 of the 101 attack cases (`bench/RESULTS.md`).
+- Only 4 of the review's 18 evasion cases are in the attack set; the rest were not available.
+- The held-out labels are provisional (given by the assistant that ran the benchmark, not reviewed by a
+  person) and 21 findings are too few for a per-rule precision estimate.
+- The `context` tree does not show files reached by a prose reference, and the lock does not record
+  them; Codex and Gemini CLI models are opt-in.
+- The MCP share in the study is an upper bound (its denominator is a lower bound).
+
 ## [0.3.0] - 2026-10-28
 
 Measurement release. ghostrules now runs against real repositories every week, a browser playground

{ghostrules-0.3.0 → ghostrules-0.4.1}/CLAUDE.md

@@ -5,7 +5,7 @@
 machine) for **hidden instructions and risky configuration in the files AI coding agents read and
 obey**: `AGENTS.md`, `CLAUDE.md`, `.cursorrules`, Copilot instructions, skills, MCP configs, etc.
 
-Tagline: *"Find the instructions your AI agent sees but you don't."*
+Tagline: *"Know exactly what your AI agent reads — and approve every change to it."*
 
 It is a **defensive** security tool. It only reads files and reports findings. It never executes
 anything it finds, never makes network requests, and never phones home.

{ghostrules-0.3.0 → ghostrules-0.4.1}/CONTRIBUTING.md

@@ -55,7 +55,7 @@ pull request.
 
 3. **Document it.** Describe the rule in `docs/RULES.md` (ID, severity, logic, true and false
    positive examples), note any judgement call in `docs/DECISIONS.md`, add a line to
-   `CHANGELOG.md`, then refresh the README table:
+   `CHANGELOG.md`, then refresh the rule index in `docs/RULES.md`:
 
    ```bash
    python scripts/make_demo.py
@@ -88,6 +88,20 @@ model is one module, one section of `docs/AGENT_MODELS.md` and its tests:
    in `ContextGraph.notes`, and add a line to `CHANGELOG.md` and a decision to
    `docs/DECISIONS.md` for every judgement call.
 
+## Supply chain
+
+- Every `uses:` in `action.yml` and `.github/workflows/` is pinned to a full commit SHA with the
+  version in a comment (`actions/checkout@<sha> # v4`). Dependabot opens the update pull requests;
+  a test fails on a tag or branch reference.
+- The Action installs from `action-requirements.txt`, which has a hash for every package, the build
+  backend included. Regenerate it when `pyproject.toml` dependencies change:
+
+  ```bash
+  pip install pip-tools
+  pip-compile --generate-hashes --strip-extras --allow-unsafe \
+    -o action-requirements.txt action-requirements.in
+  ```
+
 ## Rules of the repository
 
 - **Defanged only.** Fixtures, demos and tests use `attacker.example`, `exfil.example`,