Known Version Gaps

9 PyPI versions were never published, 7 of them pre launch plus 0.2.27 and 0.2.30 which failed as silent uploads. 8 git tags were missing for versions that did ship.

All 8 missing tags were created retroactively pointing at the right commits, then pushed.

Left alone. pip install sunglasses works fine, and retroactive uploads carrying stale code would create more confusion than they resolve.

A preflight gate blocks any new ship that would skip a patch number, and a daily integrity check audits PyPI against git tags, the changelog and the live site so drift surfaces before it builds up.

Matcher cost is roughly linear in input length for ordinary whitespace separated text, and roughly quadratic for a single unbroken token such as a base64 blob, a data: URI, a minified bundle line, a long hex string or a JWT.

The PreToolUse firewall hook has a 10 second timeout, and Claude Code does not treat a timed out hook as a block. The tool call continues through the normal permission flow. So an input of this shape can push the hook past its timeout and the call then proceeds unscanned. That is reachable from attacker controlled input, which makes it a bypass of the enforcement surface rather than a performance complaint. The same curve stalls a repository scan in CI.

MAX_SCAN_BYTES is 1 MB. It bounds the length of the input. It does not bound the cost, because for this input shape the cost is quadratic in that length.

The test that exists to prove exactly this builds its payload as "a " * n, which is the whitespace separated shape, meaning the fast one. The gate stayed green while the quadratic shape was unbounded underneath it.

Open. A ratio based regression test documents the curve without asserting a wall clock ceiling. The repair belongs in the matcher and lands in v0.6 along with a bounded mitigation so an unscannable input shape fails visibly instead of failing open. Exact byte counts and timings for the quadratic case stay in internal release evidence, so this states the boundary without also handing over a tuned recipe.

Treat the firewall as best effort on inputs containing very long unbroken tokens. The static scanner still does not execute scanned content. This is about what gets inspected, not about what runs.

A \b written immediately before a literal that is not a word character, meaning -, . or /, can never assert after whitespace, so the alternative behind it never matches. A static sweep of the pattern database finds 198 unreachable alternatives across 89 patterns, of which 175 are high, 13 medium and 10 critical severity.

Four were repaired, including GLS-EX-007 where every alternative began with -. That pattern matched nothing at all from 2026-04-08 until the repair.

No pattern is wholly unreachable any more. The remaining 89 still fire on their other branches, so the effect is that those rules are quietly narrower than they read. A full sweep, plus a permanent gate that makes this class unshippable, is a v0.6 item.

scan --file big.txt reads the first 1 MiB, reports truncated: true and inspection_complete: false, and exits 1, so a finding in the first KB of a 1.1 MB file is found alongside an explicit statement that the rest was not read. scan --repo skips any member over the 1 MB walker limit entirely, names it in skipped, and exits 3. Stated plainly, an attacker who pads a poisoned file past 1 MB is invisible to a repository scan while remaining visible to a direct file scan of that same file.

The walker declines members by extension. The file path routes by content. Crossing the two lists, .bmp .gif .jpeg .jpg .pdf .png .webp are skipped and named in repository mode, while .tif and .tiff are scanned because they are simply absent from the walker's skip list. So an instruction hidden in a committed PNG's EXIF, a GIF's later frame or a PDF's annotations is reported by scan --repo as uninspected scope and by scan --file as a finding. The same instruction in a committed TIFF is found by both.

Every skipped member is named, in every output format, and the scan exits 3 rather than 0. Nothing claims to have read them. The skip line also says what closes it, namely scanning that path directly. A consumer that reads skipped is not misled, though a consumer that reads only the exit code learns "incomplete" rather than "there is an injection in here".

Reconciling the lists means the walker runs OCR over every committed image, which changes what a repository scan costs, seconds per image and per frame, and what it promises. That is a scope decision with a performance budget attached, taken deliberately in v0.6.

attack-db/ is generated from the pattern source and has not been regenerated in some time. Re running the exporter rewrites 51 existing files and creates 409 that were never exported. The engine is the source of truth, so treat attack-db/ as a lagging mirror until v0.6 re syncs and gates it.

sunglasses pin asks before starting your MCP servers, but that gate lives in the CLI. A Python caller that imports the firewall module and calls the probe or build functions directly still spawns the configured servers with no prompt. The CLI is the only shipped surface that reaches those functions, so nothing we distribute launches a server unasked. The boundary is still real and anyone embedding the library should know where the gate is before assuming they inherited it. Moving it changes a public API signature, so it is a v0.6 item.

Outside the scan path, sunglasses check skips a settings file it cannot parse and a hook command it cannot lex, and sunglasses receipts skips a receipt line that is not valid JSON. They are the same shape as the defects this release fixed, a thing we could not read passed over without saying so, and in the first two cases that means check can report a healthy firewall while sitting next to a settings file it never managed to read. Recorded rather than fixed, so the next round starts with them on the list.

Anything a caller assembles by hand from ScanResult attributes without going through normalize(). The firewall hook verdicts, which answer allow, deny or defer for a tool call rather than a coverage question. And info(), check, version and the other non scan commands.

The matrix test module runs one test per asserted cell, and the table generator reads the same module the tests parametrize over, so the table cannot claim a cell the suite does not assert. Note what that does not prove. A generated table proves the table and the tests read one source, not that the tests assert anything. That is what the 18 mutation cases in the same file are for, each feeding a response with its coverage evidence stripped and requiring it to fail.

A FIFO, socket, device node or directory at the input path is an operational error, meaning CLI exit 2. Previously the readability probe proved a path readable by opening it, and opening a FIFO with no writer blocks in the kernel, so an MCP scan of a named pipe never returned at all. The type check now happens on metadata before any file object exists. Note the consequence, scan --file /dev/null is now exit 2 where an empty regular file is exit 0. A device is not a thing we can scan. An empty file is.

Every text read used to ignore decoding errors, which silently drops undecodable bytes. A 256 byte file of non UTF-8 pairs scanned 128 bytes and returned complete and clean. We still scan what decodes, because throwing the file away would lose real coverage, but the answer is exit 3 and the warning names how many bytes went unread. On stdin the answer differs because the transport does. Undecodable stdin is an operational error, since decoding with replacement there would mean reporting on a substitution the caller never sent.

An empty text argument, empty stdin, an empty file and an empty MCP string all return exit 0 with 0 bytes scanned. Nothing went unread, so nothing was hidden. Both human renderings say the input was empty rather than reporting no threats detected, so a reader can tell a clean scan of a document from a clean scan of nothing.

blocked_paths in the firewall policy asks what a call touches. For Write, Edit, MultiEdit, NotebookEdit and Read that question is now answered from the documented path fields, so prose that merely names a protected path is no longer treated as touching it.

For Bash the same false positive remains. Subtracting quoted heredoc bodies from a command before asking the path question was tried twice and was unsafe both times. An independent review executed nine commands where the parser removed text the shell really runs, and seven of them survived the hardened second attempt. The failure underneath is that a fallback for a parser which fails does nothing for a parser which is confidently wrong.

A Bash command is judged on all of its text, so writing about a blocked path inside a shell heredoc is refused. The repair needs a real shell grammar rather than another special case, and a named test asserts the limit is still present so it cannot quietly disappear.