push-guard 0.2.0__tar.gz → 0.2.2__tar.gz

{push_guard-0.2.0 → push_guard-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: push-guard
-Version: 0.2.0
+Version: 0.2.2
 Summary: Local pre-push guard for likely secret leaks and private file paths.
 Author: Dragon Lady
 License-Expression: Apache-2.0
@@ -60,6 +60,14 @@ matched values.
 - private key block markers
 - generic long `api_key`, `token`, `secret`, or `password` assignments,
   including underscore/dash-delimited names such as `AWS_SECRET_ACCESS_KEY`
+- Astro config loader/C2 patterns in `astro.config.*` and related
+  `.gitignore` helper-artifact hiding, based on reported config-as-code
+  supply-chain abuse
+- OpenClaw dependency versions before `2026.4.23` and risky OpenClaw
+  open-DM/wildcard/unsandboxed configuration lines
+- npm v12 readiness regressions in pushed npm metadata, including old npm pins,
+  Git or remote tarball dependency sources, and broad repo `.npmrc` opt-ins for
+  install-time execution or dependency fetching
 
 All evidence is redacted as `<redacted>`.
 

{push_guard-0.2.0 → push_guard-0.2.2}/README.md

@@ -39,6 +39,14 @@ matched values.
 - private key block markers
 - generic long `api_key`, `token`, `secret`, or `password` assignments,
   including underscore/dash-delimited names such as `AWS_SECRET_ACCESS_KEY`
+- Astro config loader/C2 patterns in `astro.config.*` and related
+  `.gitignore` helper-artifact hiding, based on reported config-as-code
+  supply-chain abuse
+- OpenClaw dependency versions before `2026.4.23` and risky OpenClaw
+  open-DM/wildcard/unsandboxed configuration lines
+- npm v12 readiness regressions in pushed npm metadata, including old npm pins,
+  Git or remote tarball dependency sources, and broad repo `.npmrc` opt-ins for
+  install-time execution or dependency fetching
 
 All evidence is redacted as `<redacted>`.
 

{push_guard-0.2.0 → push_guard-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "push-guard"
-version = "0.2.0"
+version = "0.2.2"
 description = "Local pre-push guard for likely secret leaks and private file paths."
 readme = "README.md"
 requires-python = ">=3.11"

{push_guard-0.2.0 → push_guard-0.2.2}/src/push_guard/guard.py

@@ -6,6 +6,7 @@ import os
 import re
 import subprocess
 import sys
+import urllib.parse
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -141,6 +142,99 @@ HADES_PYPI_PATTERNS = [
     ),
 ]
 
+OTTERCOOKIE_NPM_PATTERNS = [
+    (
+        "workflow.ottercookie_vercel_c2",
+        re.compile(
+            r"cloudflare(?:insights|firewall|security)(?:\[\.\]|\.)vercel(?:\[\.\]|\.)app",  # push-guard: ignore
+            re.I,
+        ),  # push-guard: ignore
+        "OtterCookie npm Vercel-hosted C2 domain",
+    ),
+    (
+        "workflow.ottercookie_npm_package",
+        re.compile(
+            r"\b(?:bjs-lint-builders|bjs-lint-builder|bjs-biginteger|"  # push-guard: ignore
+            r"hjs-lint-builders|sjs-builders|sjs-builder|npm-doc-builder)\b",  # push-guard: ignore
+            re.I,
+        ),  # push-guard: ignore
+        "Panther OtterCookie npm package indicator",
+    ),
+    (
+        "workflow.ottercookie_ssh_backdoor_shape",
+        re.compile(r"authorized_keys|ufw\s+allow\s+22/tcp|/api/ssh-key", re.I),  # push-guard: ignore
+        "OtterCookie SSH key or firewall backdoor behavior",
+    ),
+]
+
+ASTRO_CONFIG_C2_PATTERNS = [
+    (
+        "workflow.astro_config_create_require",
+        re.compile(r"\bcreateRequire\s*\(", re.I),
+        "Astro config reconstructs CommonJS require",
+    ),
+    (
+        "workflow.astro_config_eval_sink",
+        re.compile(r"\b(?:eval|Function)\s*\(", re.I),
+        "Astro config contains JavaScript eval/function execution sink",
+    ),
+    (
+        "workflow.astro_config_network_loader",
+        re.compile(
+            r"\brequire\s*\(\s*['\"](?:node:)?https?['\"]\s*\)|"
+            r"\bfrom\s+['\"](?:node:)?https?['\"]|"
+            r"\bhttps?\s*\.\s*(?:request|get)\s*\(|"
+            r"\bfetch\s*\(",
+            re.I,
+        ),
+        "Astro config contains network loader behavior",
+    ),
+    (
+        "workflow.astro_config_blockchain_c2",
+        re.compile(
+            r"trongrid|aptoslabs|bsc-dataseed|publicnode|eth_getTransactionByHash|"
+            r"Sec-V|TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP",  # push-guard: ignore
+            re.I,
+        ),
+        "Astro config contains blockchain/C2 relay marker",
+    ),
+]
+
+ASTRO_GITIGNORE_HIDE_FILES = re.compile(
+    r"\b(?:branch_structure\.json|temp_auto_push\.bat|temp_interactive_push\.bat)\b",
+    re.I,
+)
+
+OPENCLAW_FIXED_VERSION = "2026.4.23"
+OPENCLAW_VERSION_RE = re.compile(
+    r"\bopenclaw\b[^\n\r]{0,80}\b([0-9]{4}\.[0-9]{1,2}\.[0-9]{1,2})\b",
+    re.I,
+)
+OPENCLAW_OPEN_DM_POLICY_RE = re.compile(r"\bdmPolicy[\"']?\s*[:=]\s*[\"']open[\"']", re.I)
+OPENCLAW_WILDCARD_ALLOW_RE = re.compile(
+    r"\ballowFrom[\"']?\s*[:=][^\n\r]{0,160}[\"']\*[\"']",
+    re.I,
+)
+OPENCLAW_DISABLED_SANDBOX_RE = re.compile(
+    r"(?:agents\.defaults\.sandbox\.mode|sandbox[^\n\r]{0,80}\bmode)"
+    r"[\"']?\s*[:=]\s*[\"'](?:none|off|host|main|disabled)[\"']",
+    re.I,
+)
+NPM_V12_PREPARE_MIN_VERSION = "11.16.0"
+NPM_VERSION_RE = re.compile(r"\bnpm\b[^\n\r0-9]{0,12}([0-9]+\.[0-9]+\.[0-9]+)\b", re.I)
+NPM_REMOTE_TARBALL_RE = re.compile(
+    r"[\"']https?://[^\"'\s]+(?:\.tgz|\.tar\.gz)(?:[?#][^\"'\s]*)?[\"']",
+    re.I,
+)
+NPM_GIT_DEPENDENCY_RE = re.compile(
+    r"[\"'](?:git\+https?|git|github|gitlab|bitbucket):[^\"']+[\"']|github\.com[:/]",
+    re.I,
+)
+NPM_BROAD_ALLOW_RE = re.compile(
+    r"^\s*(allow-git|allow-remote|allow-scripts)\s*=\s*(?:true|all|\*)\s*$",
+    re.I,
+)
+
 
 # ---------------------------------------------------------------------------
 # Private-path rules.
@@ -488,6 +582,11 @@ def _scan_line(line: str, path: str, line_number: int) -> list[SecretFinding]:
                 )
             )
 
+    if not findings:
+        findings.extend(
+            _scan_normalized_high_confidence_token_shapes(line, path, line_number)
+        )
+
     # Only consider the lower-confidence generic-assignment rule when no
     # specific token already matched this line. This avoids double-reporting a
     # single leak (e.g. OPENAI_API_KEY=sk-...) while still catching secrets that
@@ -508,10 +607,62 @@ def _scan_line(line: str, path: str, line_number: int) -> list[SecretFinding]:
 
     findings.extend(_scan_line_for_workflow_compromise(line, path, line_number))
     findings.extend(_scan_line_for_hades_pypi(line, path, line_number))
+    findings.extend(_scan_line_for_ottercookie_npm(line, path, line_number))
+    findings.extend(_scan_line_for_astro_config_c2(line, path, line_number))
+    findings.extend(_scan_line_for_openclaw_agent_exposure(line, path, line_number))
+    findings.extend(_scan_line_for_npm_v12_readiness(line, path, line_number))
 
     return findings
 
 
+def _scan_normalized_high_confidence_token_shapes(
+    line: str, path: str, line_number: int
+) -> list[SecretFinding]:
+    findings: list[SecretFinding] = []
+    seen_rules: set[str] = set()
+
+    for variant in _normalized_secret_shape_variants(line):
+        for rule_id, pattern, reason, high_confidence in SECRET_PATTERNS:
+            if not high_confidence or rule_id in seen_rules:
+                continue
+            if pattern.search(variant):
+                seen_rules.add(rule_id)
+                findings.append(
+                    SecretFinding(
+                        rule_id=rule_id,
+                        path=path,
+                        line=line_number,
+                        reason=f"{reason} in encoded or split text",
+                        evidence="<redacted>",
+                    )
+                )
+
+    return findings
+
+
+def _normalized_secret_shape_variants(line: str) -> list[str]:
+    variants: list[str] = []
+
+    decoded = urllib.parse.unquote(line)
+    if decoded != line:
+        variants.append(decoded)
+
+    compact = re.sub(r"[\"'`]", "", line)
+    compact = re.sub(r"\s*\+\s*", "", compact)
+    compact = re.sub(r"\s+", "", compact)
+    if compact != line:
+        variants.append(compact)
+
+    if decoded != line:
+        decoded_compact = re.sub(r"[\"'`]", "", decoded)
+        decoded_compact = re.sub(r"\s*\+\s*", "", decoded_compact)
+        decoded_compact = re.sub(r"\s+", "", decoded_compact)
+        if decoded_compact != decoded and decoded_compact not in variants:
+            variants.append(decoded_compact)
+
+    return variants
+
+
 def _scan_line_for_workflow_compromise(
     line: str, path: str, line_number: int
 ) -> list[SecretFinding]:
@@ -599,6 +750,237 @@ def _scan_line_for_hades_pypi(
     return findings
 
 
+def _scan_line_for_ottercookie_npm(
+    line: str, path: str, line_number: int
+) -> list[SecretFinding]:
+    normalized_path = path.replace("\\", "/")
+    lowered_path = normalized_path.lower()
+    if lowered_path.endswith((".md", ".mdx", ".txt", ".rst")):
+        return []
+    if not _is_workflow_or_script_path(normalized_path):
+        return []
+
+    findings: list[SecretFinding] = []
+    for rule_id, pattern, reason in OTTERCOOKIE_NPM_PATTERNS:
+        if pattern.search(line):
+            findings.append(
+                SecretFinding(
+                    rule_id=rule_id,
+                    path=path,
+                    line=line_number,
+                    reason=reason,
+                    evidence="<redacted>",
+                )
+            )
+    return findings
+
+
+def _scan_line_for_astro_config_c2(
+    line: str, path: str, line_number: int
+) -> list[SecretFinding]:
+    normalized_path = path.replace("\\", "/")
+    lowered_path = normalized_path.lower()
+    findings: list[SecretFinding] = []
+
+    if lowered_path.endswith("/.gitignore") or lowered_path == ".gitignore":
+        if ASTRO_GITIGNORE_HIDE_FILES.search(line):
+            findings.append(
+                SecretFinding(
+                    rule_id="workflow.gitignore_hidden_pr_tooling",
+                    path=path,
+                    line=line_number,
+                    reason="Gitignore hides PR automation/helper artifact names used in Astro config C2 reporting",
+                    evidence="<redacted>",
+                )
+            )
+        return findings
+
+    if not _is_astro_config_path(normalized_path):
+        return findings
+
+    for rule_id, pattern, reason in ASTRO_CONFIG_C2_PATTERNS:
+        if pattern.search(line):
+            findings.append(
+                SecretFinding(
+                    rule_id=rule_id,
+                    path=path,
+                    line=line_number,
+                    reason=reason,
+                    evidence="<redacted>",
+                )
+            )
+
+    if len(line) > 300 and re.search(r"[ \t]{80,}\S", line) and _astro_config_line_has_loader_signal(line):
+        findings.append(
+            SecretFinding(
+                rule_id="workflow.astro_config_hidden_payload_line",
+                path=path,
+                line=line_number,
+                reason="Astro config contains a long horizontally hidden executable-looking payload line",
+                evidence="<redacted>",
+            )
+        )
+
+    return findings
+
+
+def _is_astro_config_path(path: str) -> bool:
+    name = path.replace("\\", "/").rsplit("/", 1)[-1].lower()
+    return name.startswith("astro.config.") and name.endswith((".js", ".cjs", ".mjs", ".ts", ".mts", ".cts"))
+
+
+def _astro_config_line_has_loader_signal(line: str) -> bool:
+    return bool(
+        re.search(
+            r"createRequire|eval\s*\(|Function\s*\(|global\s*(?:\.|\[)|"
+            r"Buffer\.from|https?\.|\.request\s*\(|\.get\s*\(|fetch\s*\(|"
+            r"trongrid|aptoslabs|bsc-dataseed|publicnode",
+            line,
+            re.I,
+        )
+    )
+
+
+def _scan_line_for_openclaw_agent_exposure(
+    line: str, path: str, line_number: int
+) -> list[SecretFinding]:
+    normalized_path = path.replace("\\", "/")
+    findings: list[SecretFinding] = []
+
+    if _is_dependency_metadata_path(normalized_path):
+        for match in OPENCLAW_VERSION_RE.finditer(line):
+            version = match.group(1)
+            if _compare_dotted_version(version, OPENCLAW_FIXED_VERSION) < 0:
+                findings.append(
+                    SecretFinding(
+                        rule_id="workflow.openclaw_vulnerable_version",
+                        path=path,
+                        line=line_number,
+                        reason=f"OpenClaw {version} predates the {OPENCLAW_FIXED_VERSION} message-object prompt-boundary fix",
+                        evidence="<redacted>",
+                    )
+                )
+
+    if not _is_openclaw_config_path(normalized_path):
+        return findings
+
+    has_open_dm = OPENCLAW_OPEN_DM_POLICY_RE.search(line)
+    if has_open_dm and OPENCLAW_WILDCARD_ALLOW_RE.search(line):
+        findings.append(
+            SecretFinding(
+                rule_id="workflow.openclaw_open_dm_wildcard",
+                path=path,
+                line=line_number,
+                reason="OpenClaw config allows public inbound DMs with a wildcard allowlist",
+                evidence="<redacted>",
+            )
+        )
+
+    if has_open_dm and OPENCLAW_DISABLED_SANDBOX_RE.search(line):
+        findings.append(
+            SecretFinding(
+                rule_id="workflow.openclaw_open_dm_unsandboxed",
+                path=path,
+                line=line_number,
+                reason="OpenClaw config combines open inbound DMs with host/main/disabled sandbox mode",
+                evidence="<redacted>",
+            )
+        )
+
+    return findings
+
+
+def _is_dependency_metadata_path(path: str) -> bool:
+    name = path.replace("\\", "/").rsplit("/", 1)[-1].lower()
+    return name in {
+        "package.json",
+        "package-lock.json",
+        "npm-shrinkwrap.json",
+        "pnpm-lock.yaml",
+        "yarn.lock",
+    }
+
+
+def _is_openclaw_config_path(path: str) -> bool:
+    name = path.replace("\\", "/").rsplit("/", 1)[-1].lower()
+    return name in {".crabbox.yaml", ".crabbox.yml"} or bool(
+        re.match(r"openclaw\.(?:json|jsonc|ya?ml|toml)$", name, re.I)
+    )
+
+
+def _compare_dotted_version(left: str, right: str) -> int:
+    left_parts = [int(part) for part in left.split(".")]
+    right_parts = [int(part) for part in right.split(".")]
+    length = max(len(left_parts), len(right_parts))
+    left_parts.extend([0] * (length - len(left_parts)))
+    right_parts.extend([0] * (length - len(right_parts)))
+    if left_parts == right_parts:
+        return 0
+    return -1 if left_parts < right_parts else 1
+
+
+def _scan_line_for_npm_v12_readiness(
+    line: str, path: str, line_number: int
+) -> list[SecretFinding]:
+    normalized_path = path.replace("\\", "/")
+    name = normalized_path.rsplit("/", 1)[-1].lower()
+    findings: list[SecretFinding] = []
+
+    if name == ".npmrc":
+        match = NPM_BROAD_ALLOW_RE.search(line)
+        if match:
+            findings.append(
+                SecretFinding(
+                    rule_id=f"workflow.npm_v12_broad_{match.group(1).replace('-', '_')}",
+                    path=path,
+                    line=line_number,
+                    reason="Repo .npmrc broadly re-enables an npm v12 install-time execution or fetch surface",
+                    evidence="<redacted>",
+                )
+            )
+        return findings
+
+    if not _is_dependency_metadata_path(normalized_path):
+        return findings
+
+    for match in NPM_VERSION_RE.finditer(line):
+        version = match.group(1)
+        if _compare_dotted_version(version, NPM_V12_PREPARE_MIN_VERSION) < 0:
+            findings.append(
+                SecretFinding(
+                    rule_id="workflow.npm_v12_old_npm_pin",
+                    path=path,
+                    line=line_number,
+                    reason=f"npm {version} is older than {NPM_V12_PREPARE_MIN_VERSION}, which surfaces npm v12 migration warnings",
+                    evidence="<redacted>",
+                )
+            )
+
+    if NPM_REMOTE_TARBALL_RE.search(line):
+        findings.append(
+            SecretFinding(
+                rule_id="workflow.npm_v12_remote_tarball_dependency",
+                path=path,
+                line=line_number,
+                reason="npm dependency resolves from a remote tarball URL; npm v12 requires explicit --allow-remote approval",
+                evidence="<redacted>",
+            )
+        )
+
+    if NPM_GIT_DEPENDENCY_RE.search(line):
+        findings.append(
+            SecretFinding(
+                rule_id="workflow.npm_v12_git_dependency",
+                path=path,
+                line=line_number,
+                reason="npm dependency resolves from a Git source; npm v12 requires explicit --allow-git approval",
+                evidence="<redacted>",
+            )
+        )
+
+    return findings
+
+
 def _is_workflow_or_script_path(path: str) -> bool:
     lowered = path.lower()
     if lowered.endswith((".md", ".mdx", ".txt", ".rst")):

{push_guard-0.2.0 → push_guard-0.2.2}/src/push_guard.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: push-guard
-Version: 0.2.0
+Version: 0.2.2
 Summary: Local pre-push guard for likely secret leaks and private file paths.
 Author: Dragon Lady
 License-Expression: Apache-2.0
@@ -60,6 +60,14 @@ matched values.
 - private key block markers
 - generic long `api_key`, `token`, `secret`, or `password` assignments,
   including underscore/dash-delimited names such as `AWS_SECRET_ACCESS_KEY`
+- Astro config loader/C2 patterns in `astro.config.*` and related
+  `.gitignore` helper-artifact hiding, based on reported config-as-code
+  supply-chain abuse
+- OpenClaw dependency versions before `2026.4.23` and risky OpenClaw
+  open-DM/wildcard/unsandboxed configuration lines
+- npm v12 readiness regressions in pushed npm metadata, including old npm pins,
+  Git or remote tarball dependency sources, and broad repo `.npmrc` opt-ins for
+  install-time execution or dependency fetching
 
 All evidence is redacted as `<redacted>`.
 

{push_guard-0.2.0 → push_guard-0.2.2}/tests/test_guard.py

@@ -65,6 +65,28 @@ class PushGuardTests(unittest.TestCase):
         self.assertEqual("secret.aws_access_key", findings[0].rule_id)
         self.assertNotIn(secret, findings[0].evidence)
 
+    def test_detects_url_encoded_provider_token_shape(self):
+        secret = "gh" + "p_" + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJ"  # push-guard: ignore
+        encoded = secret.replace("_", "%5F")
+        findings = scan_text_for_secrets(f"token={encoded}", path="config.txt")
+
+        self.assertEqual(1, len(findings))
+        self.assertEqual("secret.github_token", findings[0].rule_id)
+        self.assertNotIn(secret, findings[0].evidence)
+
+    def test_detects_split_provider_token_shape(self):
+        key = "OPENAI" + "_API_KEY"
+        prefix = "s" + "k-"
+        secret_tail = "abcdefghijklmnopqrstuvwxyzABCDEF"  # push-guard: ignore
+        findings = scan_text_for_secrets(
+            f'{key} = "{prefix}" + "{secret_tail}"',  # push-guard: ignore
+            path="config.py",
+        )
+
+        self.assertEqual(1, len(findings))
+        self.assertEqual("secret.openai_token", findings[0].rule_id)
+        self.assertNotIn(secret_tail, findings[0].evidence)
+
     def test_detects_generic_secret_assignment_without_returning_secret_value(self):
         secret = "superlongsecretvalue1234567890"
         findings = scan_text_for_secrets(f"api_key = '{secret}'", path="config.py")
@@ -252,6 +274,241 @@ class PushGuardTests(unittest.TestCase):
 
         self.assertEqual([], _scan_diff(diff_text))
 
+    def test_scan_diff_blocks_ottercookie_npm_c2_and_backdoor_shapes(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/scripts/install.js b/scripts/install.js",
+                "index 1111111..2222222 100644",
+                "--- a/scripts/install.js",
+                "+++ b/scripts/install.js",
+                "@@ -1,0 +1,4 @@",
+                "+const pkg = 'bjs-lint-builder';",  # push-guard: ignore
+                "+const c2 = 'https://cloudflareinsights.vercel.app/api/v1';",  # push-guard: ignore
+                "+fs.appendFileSync(`${home}/.ssh/authorized_keys`, key);",  # push-guard: ignore
+                "+child_process.execSync('sudo ufw allow 22/tcp');",  # push-guard: ignore
+            ]
+        )
+
+        findings = _scan_diff(diff_text)
+        rule_ids = {finding.rule_id for finding in findings}
+
+        self.assertIn("workflow.ottercookie_npm_package", rule_ids)
+        self.assertIn("workflow.ottercookie_vercel_c2", rule_ids)
+        self.assertIn("workflow.ottercookie_ssh_backdoor_shape", rule_ids)
+
+    def test_scan_diff_does_not_block_markdown_ottercookie_notes(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/docs/ottercookie.md b/docs/ottercookie.md",
+                "index 1111111..2222222 100644",
+                "--- a/docs/ottercookie.md",
+                "+++ b/docs/ottercookie.md",
+                "@@ -1,0 +1,3 @@",
+                "+Watch bjs-lint-builder package references.",  # push-guard: ignore
+                "+Watch cloudflareinsights.vercel.app traffic.",  # push-guard: ignore
+                "+Check authorized_keys and ufw allow 22/tcp changes.",  # push-guard: ignore
+            ]
+        )
+
+        self.assertEqual([], _scan_diff(diff_text))
+
+    def test_scan_diff_blocks_astro_config_loader_behavior(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/homepage/astro.config.mjs b/homepage/astro.config.mjs",
+                "index 1111111..2222222 100644",
+                "--- a/homepage/astro.config.mjs",
+                "+++ b/homepage/astro.config.mjs",
+                "@@ -1,0 +1,4 @@",
+                "+import { createRequire } from 'module';",
+                "+const require = createRequire(import.meta.url);",
+                "+const http = require('http');",
+                "+eval(stageBody);",
+            ]
+        )
+
+        findings = _scan_diff(diff_text)
+        rule_ids = {finding.rule_id for finding in findings}
+
+        self.assertIn("workflow.astro_config_create_require", rule_ids)
+        self.assertIn("workflow.astro_config_network_loader", rule_ids)
+        self.assertIn("workflow.astro_config_eval_sink", rule_ids)
+
+    def test_scan_diff_blocks_astro_config_hidden_payload_line(self):
+        hidden_tail = " " * 320 + "global['x']=Buffer.from(payload);eval(stageBody);"
+        diff_text = "\n".join(
+            [
+                "diff --git a/astro.config.mjs b/astro.config.mjs",
+                "index 1111111..2222222 100644",
+                "--- a/astro.config.mjs",
+                "+++ b/astro.config.mjs",
+                "@@ -1,0 +1,1 @@",
+                "+export default defineConfig({});" + hidden_tail,
+            ]
+        )
+
+        findings = _scan_diff(diff_text)
+        rule_ids = {finding.rule_id for finding in findings}
+
+        self.assertIn("workflow.astro_config_hidden_payload_line", rule_ids)
+        self.assertIn("workflow.astro_config_eval_sink", rule_ids)
+
+    def test_scan_diff_blocks_gitignore_hidden_pr_tooling(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/.gitignore b/.gitignore",
+                "index 1111111..2222222 100644",
+                "--- a/.gitignore",
+                "+++ b/.gitignore",
+                "@@ -1,0 +1,2 @@",
+                "+branch_structure.json",
+                "+temp_auto_push.bat",
+            ]
+        )
+
+        findings = _scan_diff(diff_text)
+        rule_ids = {finding.rule_id for finding in findings}
+
+        self.assertIn("workflow.gitignore_hidden_pr_tooling", rule_ids)
+
+    def test_scan_diff_allows_plain_astro_config(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/astro.config.mjs b/astro.config.mjs",
+                "index 1111111..2222222 100644",
+                "--- a/astro.config.mjs",
+                "+++ b/astro.config.mjs",
+                "@@ -1,0 +1,6 @@",
+                "+import { defineConfig } from 'astro/config';",
+                "+import tailwindcss from '@tailwindcss/vite';",
+                "+export default defineConfig({",
+                "+  site: process.env.SITE_URL || 'https://example.org',",
+                "+  vite: { plugins: [tailwindcss()] },",
+                "+});",
+            ]
+        )
+
+        self.assertEqual([], _scan_diff(diff_text))
+
+    def test_scan_diff_blocks_openclaw_vulnerable_version(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/package.json b/package.json",
+                "index 1111111..2222222 100644",
+                "--- a/package.json",
+                "+++ b/package.json",
+                "@@ -1,0 +1,5 @@",
+                "+{",
+                "+  \"dependencies\": {",
+                "+    \"openclaw\": \"2026.4.20\"",
+                "+  }",
+                "+}",
+            ]
+        )
+
+        findings = _scan_diff(diff_text)
+        rule_ids = {finding.rule_id for finding in findings}
+
+        self.assertIn("workflow.openclaw_vulnerable_version", rule_ids)
+
+    def test_scan_diff_blocks_openclaw_open_dm_wildcard_and_unsandboxed(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/openclaw.yaml b/openclaw.yaml",
+                "index 1111111..2222222 100644",
+                "--- a/openclaw.yaml",
+                "+++ b/openclaw.yaml",
+                "@@ -1,0 +1,2 @@",
+                "+channels: { slack: { dmPolicy: \"open\", allowFrom: [\"*\"] } }",
+                "+agents.defaults.sandbox.mode: \"none\", dmPolicy: \"open\"",
+            ]
+        )
+
+        findings = _scan_diff(diff_text)
+        rule_ids = {finding.rule_id for finding in findings}
+
+        self.assertIn("workflow.openclaw_open_dm_wildcard", rule_ids)
+        self.assertIn("workflow.openclaw_open_dm_unsandboxed", rule_ids)
+
+    def test_scan_diff_allows_openclaw_pairing_config_and_fixed_version(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/openclaw.yaml b/openclaw.yaml",
+                "index 1111111..2222222 100644",
+                "--- a/openclaw.yaml",
+                "+++ b/openclaw.yaml",
+                "@@ -1,0 +1,3 @@",
+                "+version: 2026.4.23",
+                "+channels: { slack: { dmPolicy: \"pairing\", allowFrom: [\"U123\"] } }",
+                "+agents.defaults.sandbox.mode: \"non-main\"",
+            ]
+        )
+
+        self.assertEqual([], _scan_diff(diff_text))
+
+    def test_scan_diff_blocks_npm_v12_old_pin_and_nonregistry_sources(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/package.json b/package.json",
+                "index 1111111..2222222 100644",
+                "--- a/package.json",
+                "+++ b/package.json",
+                "@@ -1,0 +1,8 @@",
+                "+{",
+                "+  \"packageManager\": \"npm@11.15.0\",",
+                "+  \"dependencies\": {",
+                "+    \"tool-a\": \"github:example/tool-a\",",
+                "+    \"tool-b\": \"https://example.invalid/tool-b-1.0.0.tgz\"",
+                "+  }",
+                "+}",
+            ]
+        )
+
+        findings = _scan_diff(diff_text)
+        rule_ids = {finding.rule_id for finding in findings}
+
+        self.assertIn("workflow.npm_v12_old_npm_pin", rule_ids)
+        self.assertIn("workflow.npm_v12_git_dependency", rule_ids)
+        self.assertIn("workflow.npm_v12_remote_tarball_dependency", rule_ids)
+
+    def test_scan_diff_blocks_broad_npm_v12_allow_config(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/.npmrc b/.npmrc",
+                "index 1111111..2222222 100644",
+                "--- a/.npmrc",
+                "+++ b/.npmrc",
+                "@@ -1,0 +1,3 @@",
+                "+allow-git=true",
+                "+allow-remote=all",
+                "+allow-scripts=*",
+            ]
+        )
+
+        findings = _scan_diff(diff_text)
+        rule_ids = {finding.rule_id for finding in findings}
+
+        self.assertIn("workflow.npm_v12_broad_allow_git", rule_ids)
+        self.assertIn("workflow.npm_v12_broad_allow_remote", rule_ids)
+        self.assertIn("workflow.npm_v12_broad_allow_scripts", rule_ids)
+
+    def test_scan_diff_allows_npm_v12_ready_package_metadata(self):
+        diff_text = "\n".join(
+            [
+                "diff --git a/package.json b/package.json",
+                "index 1111111..2222222 100644",
+                "--- a/package.json",
+                "+++ b/package.json",
+                "@@ -1,0 +1,5 @@",
+                "+{",
+                "+  \"packageManager\": \"npm@11.16.0\",",
+                "+  \"dependencies\": { \"left-pad\": \"1.3.0\" }",
+                "+}",
+            ]
+        )
+
+        self.assertEqual([], _scan_diff(diff_text))
+
     def test_ignore_marker_suppresses_secret_and_workflow_rules(self):
         # A line carrying the explicit opt-out marker is skipped by every rule,
         # even when it contains a real token shape and an IOC pattern.