scamgate 0.3.3__tar.gz

scamgate-0.3.3/.claude-plugin/marketplace.json

@@ -0,0 +1,18 @@
+{
+  "name": "scamgate",
+  "description": "scamgate for Claude Code: a hook that checks every tool call for scam links and risky payments, plus link and payment check tools.",
+  "owner": {
+    "name": "Odai Ameera",
+    "url": "https://github.com/odaiameera"
+  },
+  "plugins": [
+    {
+      "name": "scamgate",
+      "source": "./claude-plugin",
+      "description": "Blocks known-bad links and risky payments before a tool runs, and asks you when it can't see where a command is going.",
+      "version": "0.3.3",
+      "category": "security",
+      "homepage": "https://odaiameera.github.io/scamgate/"
+    }
+  ]
+}

scamgate-0.3.3/.github/workflows/ci.yml

@@ -0,0 +1,91 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+
+      - name: Install
+        run: uv sync --locked
+
+      - name: Unit tests
+        run: uv run --locked pytest -q
+
+      - name: Scenario bench (must match expected decisions)
+        run: uv run --locked scamgate bench --strict
+
+      - name: Feed update on sample data (scamgate update-feeds, feeds-status)
+        run: uv run --locked pytest -q tests/test_update_feeds_cli.py tests/test_plugin_feed_updates.py
+
+  plugin-install:
+    name: Hermes plugin install (no typer, sample feeds)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          python-version: "3.11"
+
+      - name: Bare venv with only the plugin's python_dependencies
+        run: |
+          uv venv "$RUNNER_TEMP/bare"
+          uv pip install --python "$RUNNER_TEMP/bare" "pydantic>=2.7,<3" "pyyaml>=6.0,<7"
+          mkdir -p "$RUNNER_TEMP/plugins"
+          cp -r src/scamgate "$RUNNER_TEMP/plugins/scamgate"
+
+      - name: hermes scamgate update-feeds, /scamgate update and the update tool
+        run: '"$RUNNER_TEMP/bare/bin/python" scripts/plugin_smoke.py "$RUNNER_TEMP/plugins" tests/fixtures/feeds'
+
+  claude-plugin:
+    name: Claude Code plugin (validate, hook and server from the wheel)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          python-version: "3.11"
+
+      - name: claude plugin validate (plugin and marketplace)
+        run: |
+          npx -y @anthropic-ai/claude-code@2.1.310 plugin validate ./claude-plugin --strict
+          npx -y @anthropic-ai/claude-code@2.1.310 plugin validate . --strict
+
+      - name: The plugin's hook and serve commands, run from the built wheel through uvx
+        run: |
+          uv build --out-dir "$RUNNER_TEMP/dist"
+          uv run --no-project python scripts/claude_plugin_smoke.py "$RUNNER_TEMP"/dist/scamgate-*-py3-none-any.whl

scamgate-0.3.3/.github/workflows/pages.yml

@@ -0,0 +1,35 @@
+name: Pages
+
+on:
+  push:
+    branches: [main]
+    paths: ["site/**", ".github/workflows/pages.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: site
+      - id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

scamgate-0.3.3/.github/workflows/release.yml

@@ -0,0 +1,114 @@
+name: release
+
+# Runs when a GitHub release is published. Builds the wheel and sdist once, checks them, then publishes the
+# same files to PyPI (trusted publishing, no token), attaches them to the GitHub release with SHA256SUMS.txt,
+# and lists the new version in the MCP Registry (GitHub OIDC, no token).
+#
+# One-time setup on pypi.org: a trusted publisher for project "scamgate", owner "odaiameera", repository
+# "scamgate", workflow "release.yml", environment "pypi".
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - name: The tag names the package version everywhere
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          v=$(uv version --short)
+          test "v$v" = "$TAG" || { echo "tag $TAG doesn't match pyproject version $v"; exit 1; }
+          grep -q "\"version\": \"$v\"" server.json
+          grep -q "\"version\": \"$v\"" claude-plugin/.claude-plugin/plugin.json
+          grep -q "uvx scamgate==$v hook" claude-plugin/hooks/hooks.json
+          grep -q "\"scamgate==$v\"" claude-plugin/.mcp.json
+      - name: Build
+        run: uv build --out-dir dist
+      - name: Check the built wheel the way the plugin runs it
+        run: |
+          uv run --no-project python scripts/claude_plugin_smoke.py dist/scamgate-*-py3-none-any.whl
+          uvx --from dist/scamgate-*-py3-none-any.whl scamgate bench --strict
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment:
+      name: pypi
+      url: https://pypi.org/project/scamgate/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+
+  github-release:
+    needs: pypi
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+      - name: Attach the published files and their checksums
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          cd dist
+          sha256sum scamgate-* > SHA256SUMS.txt
+          gh release upload "$TAG" scamgate-* SHA256SUMS.txt --clobber --repo "$GITHUB_REPOSITORY"
+
+  mcp-registry:
+    needs: pypi
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install mcp-publisher 1.8.4 (checksum-verified)
+        run: |
+          curl -fsSL -o mcp-publisher.tar.gz \
+            https://github.com/modelcontextprotocol/registry/releases/download/v1.8.4/mcp-publisher_linux_amd64.tar.gz
+          echo "5dc2fd415369c73551259f31cd33e2aacc9e0d1021e7f08fef1492d93b781628  mcp-publisher.tar.gz" | sha256sum -c -
+          tar xzf mcp-publisher.tar.gz mcp-publisher
+      - name: Wait until PyPI serves this version
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          for i in $(seq 1 30); do
+            curl -fsS "https://pypi.org/pypi/scamgate/${TAG#v}/json" > /dev/null && exit 0
+            sleep 10
+          done
+          echo "PyPI doesn't list scamgate ${TAG#v} yet"; exit 1
+      - run: ./mcp-publisher login github-oidc
+      - run: ./mcp-publisher publish

scamgate-0.3.3/.gitignore

@@ -0,0 +1,13 @@
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+dist/
+build/
+*.egg-info/
+.env
+.env.*
+# Downloaded third-party feeds (fetched locally, never committed)
+data/feeds/

scamgate-0.3.3/AGENTS.md

@@ -0,0 +1,66 @@
+# AGENTS.md
+
+Guidance for coding agents working on scamgate.
+
+## Commands
+
+```bash
+uv sync                          # install deps (incl. dev group)
+uv run pytest -q                 # all tests must pass (offline)
+uv run scamgate bench --strict   # scenarios must match expected decisions
+uv run scamgate bench -v         # show reasons per scenario
+uv run scamgate check-url URL --intent "..."
+uv run scamgate serve            # MCP server over stdio
+uv run python scripts/site_demo_data.py   # regenerate site verdicts after rule/weight changes
+```
+
+If a live `scamgate serve` holds `.venv` (Windows locks the exe), use a separate venv:
+`UV_PROJECT_ENVIRONMENT=/some/other/venv uv run pytest`.
+
+## Layout
+
+- `models.py`: input models and the `Verdict` (decision, risk_score, reasons)
+- `registry.py`: `@register(rule_id, kind)` rule registry
+- `rules/url.py`, `rules/payment.py`: rules; `config/rules.yaml`: weights, thresholds, word lists
+- `engine.py`: runs rules, scores, decides; payee facts come from history, not the caller
+- `feeds.py`: known-bad-link feeds. Only `update_feeds()` touches the network; checks read the cache
+  (`LazyFeedIndex` for the hook)
+- `refresh.py`: argument-free feed refresh (lock file, age checks) behind the Hermes plugin's
+  `/scamgate update`, `scamgate_update_feeds` tool, `hermes scamgate ...` CLI and background refresh.
+  Needs only the plugin's dependencies (no typer/rich)
+- `hostnorm.py`: host canonicalisation (percent-decoding, numeric IPv4 forms)
+- `hook.py` / `hook_entry.py`: the enforcement hook (Hermes + Claude Code dialects)
+- `guard.py`: human-only writes (`require_human`) and HMAC signing of state records
+- `overrides.py`, `payees.py`, `asklog.py`, `state.py`: signed overrides, salted payee history,
+  redacted ask log, state dir; `redact.py`: secret stripping; `integrity.py`: install self-check
+- `server.py`: MCP server; `cli.py`: Typer CLI
+- `scenarios/*.yaml`: example scenarios; `src/scamgate/data/blocklist.txt`: example blocklist
+- `site/`: GitHub Pages site; `docs/design/`: design notes and review write-ups
+
+## Rules of the road
+
+- Deterministic and offline: no network calls or LLMs in the check path. Only feed refreshes download,
+  always the default feeds from fixed URLs; nothing an agent can call picks the feeds, URLs or cache folder.
+  Tests never touch the network.
+- The Hermes plugin must work with only `plugin.yaml`'s `python_dependencies` installed: no typer, rich or
+  mcp imports on the plugin path (`scripts/plugin_smoke.py` checks this in CI).
+- Every rule needs a `rules.yaml` entry, tests, a scenario where it makes sense, and a plain-English
+  explanation a non-technical person can act on.
+- The hook never outputs "allow". It may only block or ask; silence means no objection.
+- The hook fails closed on pre events. New detection must not add false positives on everyday dev
+  commands (`git push`, `pip install -r`, `uv sync`, `npm ci/test`, `grep`): add a quiet-path test.
+- Never let agent-supplied text lower a score (stated intent, `is_new_payee`, reasons): it can only add risk.
+- Overrides and payees are written only by a person (`guard.require_human`) and are signed. Don't add
+  any code path that writes them without that check.
+- Write a failing test for every bypass before fixing it (`tests/test_hook_holes.py`,
+  `test_tamper_training.py`, `test_recheck_gaps.py`, `test_final_review.py`).
+- Never bundle third-party blocklist data; feeds live in the cache dir.
+- No invented statistics in docs. Bench numbers come from example scenarios only.
+- Keep the advisory framing: scamgate flags risk; it doesn't certify safety.
+
+## Website
+
+- `site/` is static HTML/CSS/JS (no build step), deployed by `.github/workflows/pages.yml` on pushes
+  to `main` that touch `site/`. Pages source must stay "GitHub Actions", not "Deploy from branch".
+- Verdicts on the site come from `site/assets/demo-data.js`, generated by
+  `scripts/site_demo_data.py`. `tests/test_site_demo.py` fails if it's stale. Never hand-edit verdicts.

scamgate-0.3.3/CHANGELOG.md

@@ -0,0 +1,245 @@
+# Changelog
+
+## [Unreleased]
+
+## [0.3.3] - 2026-10-26
+
+scamgate as a Claude Code plugin, and on PyPI. One install in Claude Code brings the enforcing hook, the
+link and payment check tools, and a refresh of the phishing lists. The plugin runs scamgate from PyPI with
+`uvx scamgate==0.3.3`, pinned to one version.
+
+### Claude Code plugin
+- New `claude-plugin/` with a `SessionStart`, `PreToolUse` (fails closed), `PostToolUse` and
+  `PostToolUseFailure` hook and the MCP server, and a marketplace in `.claude-plugin/marketplace.json`:
+  `/plugin install scamgate --marketplace odaiameera/scamgate`. Settings: `auto_update_feeds` (on) and an
+  optional URLhaus key, kept in the system's credential store. `claude-plugin/README.md` lists what it
+  runs, downloads and stores.
+- Tested in Claude Code 2.1.310: the hook blocked a listed host before `curl` ran, `echo` ran without a
+  prompt, `check_url` and `update_feeds` worked, and lists 8 hours old refreshed during the session.
+- `scamgate hook` goes straight to the hook without loading the command line (about 0.8 s per checked
+  tool call on a Windows PC, with `uvx` adding almost nothing).
+
+### MCP server
+- New `update_feeds` tool, the same no-argument refresh as the Hermes plugin's: default lists from fixed
+  sources, at most once an hour.
+- `scamgate serve` started with `SCAMGATE_AUTO_UPDATE=1` refreshes the lists by itself when they are 6
+  hours old. It stays off unless set, so a hand-configured server downloads nothing unasked.
+- An unset or unfilled URLhaus key (empty, or a `${...}` placeholder) now means "no key" instead of a
+  download address with the placeholder in it.
+
+### Tamper guard
+- Protects what a Claude Code install adds: `~/.claude/plugins` (the installed plugin's own hooks), project
+  and user `settings.local.json`, and the same files under `CLAUDE_CONFIG_DIR`. Reading them stays quiet.
+- Blocks agent commands that disable or remove a Claude Code plugin or its marketplace, or start Claude in
+  bare mode (which skips every hook), and asks before an agent installs, enables or configures a plugin or
+  starts Claude with other settings sources.
+- The plugin's own check tools (`mcp__plugin_scamgate_scamgate__check_url`, `..._check_payment`) may name a
+  listed link, like the other spellings of scamgate's tools.
+
+### Packaging
+- Published to PyPI as `scamgate`, from a GitHub Actions workflow with trusted publishing; the release
+  workflow also attaches the same wheel and sdist with `SHA256SUMS.txt`, and lists the server in the MCP
+  Registry as `io.github.odaiameera/scamgate` (`server.json`).
+- Project URLs, keywords and classifiers in `pyproject.toml`. Install commands use `scamgate==0.3.3`.
+- New CI job: `claude plugin validate` on the plugin and the marketplace, and the plugin's hook and server
+  commands run from the built wheel (`scripts/claude_plugin_smoke.py`).
+
+### Docs
+- README banner and badge row, notes on #21, #22 and #24, and thanks to @simin-yuan (#25).
+- New `CONTRIBUTING.md` and `SECURITY.md`.
+
+## [0.3.2] - 2026-10-26
+
+Feed refreshes that work on a plain Hermes plugin install, fewer false blocks from the tamper guard,
+and a hook that stays fast on very long commands (PRs #21, #22, #23 and #24). Install commands are pinned
+to `v0.3.2`. Reported from a real install, where `/scamgate update` told people to run a
+`scamgate update-feeds` command a plugin install doesn't have.
+
+### Speed on long commands (#20)
+- A 100,000-character command kept the hook busy for about 40 s, and the hook accepts up to 2 MiB.
+  The call-looking check is now one linear pass and each segment is split once (#21), and a one-pass
+  reader returns exactly the words `shlex` would (#22), both by @simin-yuan. The script check in
+  `harden.py` now uses the same reader (#24), so the whole hook call, not just `extract()`, is linear:
+  a 2,000,000-character quoted command went from over 200 s to about 5 s on one Windows machine.
+- No decision changed: 11,350 commands (every string in the test suites plus quoting and spacing
+  variants around listed hosts) gave the same decision and message before and after #21 and #22.
+- The tamper guard's read-only check reads only each segment's first word, without `shlex`, and runs
+  only after a write or feed-call pattern matched.
+
+### Hermes plugin
+- `/scamgate update` now downloads the phishing lists instead of pointing at a missing command, and
+  `/scamgate status` lists each feed with its age.
+- New `hermes scamgate update-feeds` and `hermes scamgate feeds-status`. They use Hermes' own command line, so
+  they need no extra packages (no typer, no `scamgate` on `PATH`).
+- New agent tool `scamgate_update_feeds`. It takes no arguments: it always downloads the default feeds from
+  their fixed sources into the configured cache, and does nothing if they were refreshed in the last hour.
+  An agent can ask for a refresh, but can't choose what lands in the cache.
+- Background refresh: about two minutes after Hermes starts, then every 6 hours. A lock file keeps
+  Hermes processes from downloading at the same time. Off with `auto_update_feeds: false` or
+  `SCAMGATE_AUTO_UPDATE=0`. No cron line needed.
+- Stale-list warnings now name the plugin commands as well as `scamgate update-feeds`.
+
+### Tamper guard
+- A path in a command only counts when it names the protected folder itself: a log file next to the feed
+  cache folder (`scamgate-feeds.log`) is no longer treated as inside it. `./`, `//` and `..` spellings of a
+  protected path are now caught too.
+- Read-only commands on protected paths pass: `ls`, `cat`, `head`, `tail`, `grep`, `rg`, `find`, `stat`,
+  `which`, `wc`, `du`, `sha256sum` (and a few more), with `2>/dev/null` or `2>&1` allowed. A redirect,
+  `$(...)`, backticks, `-exec`, `-delete`, `-fprint`, `--pre` or any other command in the line makes it a
+  write check again, as before.
+- Commands that call the feed downloader with their own arguments (`update_feeds(fetch=...)`,
+  `_atomic_write`, swapping the downloader) are blocked: use the update tool or `/scamgate update`.
+
+### Tests and CI
+- New `tests/test_guard_boundaries.py` (quiet reads, the log file next to the cache, writes that must still
+  block, cache poisoning), `tests/test_plugin_feed_updates.py` and `tests/test_update_feeds_cli.py`.
+- CI runs `update-feeds` and `feeds-status` on sample feed data, and a new `plugin-install` job runs
+  `scripts/plugin_smoke.py` in a venv that has only the plugin's dependencies.
+- `tests/test_hook_perf.py` (#21, #22) and `tests/test_hook_perf_full.py` (#24) time the hook in a
+  subprocess with a hard timeout; the second times the whole `hook.run`, not just `extract()`.
+
+## [0.3.1] - 2026-10-22
+
+Security fixes from two review rounds (PRs #17 and #18). Install commands are pinned to `v0.3.1`.
+
+### Link checks
+- New rule `url.unreadable` (40, asks): a link scamgate can't read never gets `allow`. That covers links
+  that don't parse, site names with characters a browser refuses (spaces, slashes), site names longer than
+  DNS allows, addresses over 8 KiB, and `javascript:`, `data:`, `vbscript:`, `file:` and `blob:` links.
+  No other rule runs on such a link, so its text never appears in a reason.
+- `\` before the query is read as `/`, as browsers do: `https://a.example\.paypal.com/` is checked as
+  `a.example`, not as a PayPal address.
+- Ideographic and halfwidth full stops (`。`, `｡`) in a site name count as dots.
+- Site names over 253 characters are rejected before the brand checks run (a 24 KB one took 37 s).
+- Hook: `http://[::1]:3000/` is read as one link (the address used to be cut at `]`).
+- `amazonaws.com` is no longer an official Amazon domain. Its subdomains are customers' buckets and
+  servers (583 Public Suffix List entries), so a sign-in page there is judged like any other site, and a
+  feed listing of one bucket's host counts.
+- A feed listing of a shared suffix such as `s3.amazonaws.com` no longer condemns every site under it:
+  a parent-domain listing counts only at or below the site's own registrable domain.
+- Three-label shared suffixes in the curated list (`s3.amazonaws.com`) now take effect. Only the last two
+  labels used to be compared, so each bucket was treated as part of `amazonaws.com`.
+- New `lists.shared_hosting` in `rules.yaml` (`amazonaws.com`, `googleusercontent.com`, `cloudapp.azure.com`):
+  a host under one of these is a customer's or user's own site, so it's never an official brand site, and a
+  feed listing counts only for that exact host. `googleusercontent.com` is no longer an official Google
+  domain (Google uses it to sandbox untrusted user content, such as Apps Script web apps). `azure.com` stays
+  official for Microsoft's own portal; only the VM names customers pick under `cloudapp.azure.com` are carved out.
+- Faster link checks, same verdicts: the brand-padding search is linear (a 12,000-character word went from
+  7.5 s to 0.03 s), the typo check skips words whose length rules out a one-letter edit, each link is
+  parsed once per check, and each word's look-alike variants are worked out once instead of once per brand.
+  At the 253-character cap the slowest link went from 23 ms to 1.4 ms. Verdicts on 16,050 generated
+  brand-shaped links are unchanged.
+- The fake-address check (`paypal.com@evil.example`) now fires however the scheme is written:
+  `https:/…`, `https:\\…` and tabs or newlines inside the scheme reach the same host as `https://…`, so
+  they're judged the same. A domain or brand before the `@` counts as a disguise on any scheme
+  (`sftp://`, `git+https://`, `hxxps://`); a plain username is flagged only on web links, so
+  `ssh://git@github.com/…` no longer asks.
+
+### Hook
+- Shell commands are read the way the shell passes them: quotes and escapes are removed first, and each
+  word that is a link is checked whole. A quoted `@` or `)` can no longer cut a link short and hide its
+  real host.
+- `curl "https://evil""shop.com/"` is now checked as `https://evilshop.com/` (it used to ask as a link
+  built at run time). Variables and `$(…)` still ask.
+- A network command the shell can't split (an unbalanced quote) asks.
+- Bash `/dev/tcp/HOST/PORT` and `/dev/udp/HOST/PORT` are checked like any other destination.
+- Only scamgate's own check tools skip the gate (`mcp__scamgate__check_url`, `mcp_scamgate_check_url`,
+  `scamgate_check_url` and the `check_payment` forms). A tool whose name merely contains them, like
+  `mcp__notscamgate__check_url`, used to skip every check, tamper checks included. If you registered the
+  MCP server under another name, asking it about a bad link may now ask you first.
+
+### Local state
+- The state dir is created private (0700), and an existing `…/scamgate` state dir from an older install is
+  tightened to 0700. A custom `SCAMGATE_STATE_DIR` is left as you set it. The ask log (`asks.jsonl`,
+  `outcomes.jsonl`) is written 0600: it shows which sites your agent tried to visit.
+- The signing key and payee salt are created once, even when two scamgate processes start together. One
+  used to overwrite the other's key, and records already signed with it stopped verifying.
+- If override rules can't be verified (the signing key is missing or was changed, or a line was edited),
+  checks now warn instead of dropping your deny rules silently.
+
+### Input checks
+- Payment `amount` and `budget` must be real numbers: `inf`, `nan` and a negative budget are rejected.
+- In the hook, a payment tool call whose amount is JSON `Infinity` or `NaN`, or a digit string too long
+  to be a number, asks ("can't read how much") instead of failing with an internal error.
+- The Hermes plugin fails closed: if the gate itself errors on a pre-tool call, the call is blocked, as
+  the shell hook already did.
+- Domain-age lookups (`SCAMGATE_RDAP=live`) send only a plain host name to the registry, and look up
+  international names in their `xn--` form (they used to fail). A name Python's older IDNA rules would
+  change (`faß` to `fass`) isn't looked up at all, rather than looked up wrong.
+- `update-feeds` refuses a feed download over 256 MB and keeps the old cache.
+
+### MCP server and Hermes plugin
+- Both MCP tools are marked read-only (`readOnlyHint`, not destructive, idempotent). `check_url` reports
+  `openWorldHint` only when domain-age lookups go online (`SCAMGATE_RDAP=live`).
+- Both tools return a typed `Verdict` with a published output schema, so clients get structured content.
+- New `checked_host` in every link verdict: the host a browser would open. Empty for payments and for
+  links scamgate can't read.
+- Input limits on the MCP tools (a 64 KiB link, 2,000-character intent, 20,000-character context). A link
+  over 8 KiB but under the limit still gets a verdict (`url.unreadable` asks) rather than an error.
+- The Hermes plugin's tools now take the same arguments as the MCP tools, from one shared definition
+  (`scamgate.tools`). `scamgate_check_payment` used to drop `budget`, `is_new_payee`,
+  `bank_details_changed` and `vop_result`, so the over-budget check never ran there. Bad arguments come
+  back as an error instead of crashing the tool.
+- Hermes `/scamgate review` lists each host with how many times it asked, what you did, and the top rule.
+  It used to print a line of `?` per host.
+
+## [0.3.0] - 2026-10-16
+
+Hermes plugin, and the holes found while making it.
+
+### Hermes plugin
+- In-process plugin (`src/scamgate/plugin.yaml`): `pre_tool_call`, `post_tool_call`, `scamgate_check_url`, `scamgate_check_payment`, `/scamgate`.
+- Same decisions as the shell hook, without a subprocess. Needs Hermes 0.19.1+.
+- When `/yolo` or `approvals.mode: off` would auto-approve an ask, the plugin blocks instead. Set `plugins.entries.scamgate.settings.when_approvals_off: allow` to keep the old behaviour.
+
+### Hook
+- Blocks Hermes safety switches (`approvals.mode off`, `--yolo`, `plugins uninstall`, `--safe-mode`, `--dangerously-skip-permissions`, and the same idea in code or another tool).
+- Blocks reading the signing key and payee salt.
+- Reads a script before running it, including scripts a cron job would run later with no agent.
+- Checks the body of files other tools run (Makefile, package.json, git hooks, CI, Hermes cron scripts). Notes are still just notes.
+- scamgate's own check tools are not gated for naming the link they were asked about.
+- Other Hermes profiles' config is protected.
+- `https:/host` and `https:///host` are checked as `https://host`.
+- `scp`, `sftp` and `rsync` to a blocklisted host are denied, including `user@host:/absolute/path`. Local copies stay quiet.
+- `base32 -d`, `b64 -d`, a decoded file that is then run, and Perl or Ruby `eval` of decoded text ask before they run.
+
+Install commands are pinned to `v0.3.0`.
+
+## [0.2.0] - 2026-10-12
+
+First tagged release. Everything since 0.1.0 (the MCP server and rules) is new here.
+
+### Enforcement hook
+- `scamgate-hook`: a Hermes `pre_tool_call` / Claude Code `PreToolUse` hook, so the agent can't skip
+  the check. Never outputs "allow"; fails closed; asks are logged (redacted) with the outcome.
+- Links in any tool call are checked, including disguised hosts (percent-encoding, integer/hex/octal
+  IPs), per command segment, so one clean link can't hide a second fetch.
+- Destinations it can't read (variables, `$(…)`, string-built, base64/hex-decoded links, named
+  package installs, new git remotes) go to a human. Decoded-and-run code (`base64 -d | bash`,
+  `exec(b64decode(…))`, `powershell -enc`) always does.
+- **Payments are gated**: money-moving tool calls are scored with `check_payment` and local payee
+  history; payments in shell/code (crypto CLIs, payment-API writes) go to a human.
+- Routine dev commands stay quiet (lockfile installs, `git push/pull`, text-only commands).
+- Tamper resistance: agent writes to scamgate, its state, feed cache, venv and the Claude/Hermes hook
+  config are blocked however the path is spelled; integrity check against wheel RECORD hashes and
+  unknown `.pth` files.
+
+### Human-only state
+- `review` / `promote` overrides and `record-payment` payee history: written only by a person at an
+  interactive terminal (refused inside known agents), HMAC-signed, salted hashes for payees,
+  near-name and account-reuse detection, salt-swap detection.
+
+### Rules
+- `url.credential_page`: a sign-in page on an unrecognised site asks; the agent's wording can't clear it.
+- `url.domain_age`: RDAP domain age, **opt-in** (`SCAMGATE_RDAP=cache|live`), cached.
+- Brand pack of ~50 commonly phished brands plus Irish/UK banks and couriers; brand-inside-a-word
+  false positives fixed (applebees, revolution, pineapple); curated public-suffix list incl. shared hosts.
+- New-payee bank transfers ask unless Verification of Payee matched; `pay.unbacked_known_claim`.
+- 0.0.0.0 / loopback treated as local.
+
+### Docs and site
+- GitHub Pages site and docs; Claude Code config uses `"onFailure": "block"`; install commands pinned to `v0.2.0`.
+
+## [0.1.0]
+
+- MCP server with `check_url` and `check_payment`, YAML-configured rules, known-bad-link feeds, bench scenarios.