v0.2.65: +19 discovery_file_poisoning patterns (1019→1038) + credibility fix

CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to Sunglasses are documented here.
 
 
+## [0.2.65] — 2026-06-10
+
+### Added (discovery_file_poisoning expansion)
+
+- **+19 discovery_file_poisoning patterns** (`GLS-DFP-058`..`GLS-DFP-082`, excluding 060/063/066/069/070/076) — new coverage for poisoned discovery surfaces: Allure/test-report metadata, `security.txt`, `.well-known` manifests, syndication feeds, and related agent-policy carriers. **1,019 → 1,038 patterns / 65 categories / 7,548 keywords.**
+- 6 patterns from the same batch were **held back** for false-positive tightening (they fired on clean code/docs) — the FP credibility gate from v0.2.64 caught them before ship. They will return after regex hardening.
+
+### Fixed (credibility)
+
+- Genericized 3 pattern descriptions that referenced internal operator paths/filenames (no detection change) — public surfaces no longer expose internal infrastructure naming.
+
 ## [0.2.64] — 2026-06-09
 
 ### Fixed (engine reliability — false positives + scanner hang)

README.md

@@ -139,8 +139,8 @@ result = scanner.scan_auto("any_file.ext")
 |--------|-------|
 | Average text scan | <1ms (avg 0.26ms on M3 Max, single-threaded) |
 | Throughput | ~3,800 scans/sec (single-threaded, M3 Max) |
-| Patterns | 1019 |
-| Keywords | 7,350 |
+| Patterns | 1038 |
+| Keywords | 7,548 |
 | Languages | 23 |
 | Attack categories | 65 |
 | Normalization techniques | 17 |
@@ -151,15 +151,15 @@ result = scanner.scan_auto("any_file.ext")
 | Core dependencies | Zero for text scan; optional deps for media |
 | Platforms | Mac, Windows, Linux — anywhere Python runs |
 
-_All performance numbers verified against `stats/current.json` (v0.2.64, updated Jun 6, 2026). Measured on Apple M3 Max, 48GB RAM, single-threaded Python 3.11. Your hardware will differ._
+_All performance numbers verified against `stats/current.json` (v0.2.65, updated Jun 6, 2026). Measured on Apple M3 Max, 48GB RAM, single-threaded Python 3.11. Your hardware will differ._
 
 ## 23 Languages
 
 English, Spanish, Portuguese, French, German, Italian, Dutch, Russian, Ukrainian, Polish, Czech, Turkish, Azerbaijani, Arabic, Hebrew, Persian, Chinese, Japanese, Korean, Hindi, Bengali, Indonesian, Vietnamese — plus normalization handles romanization, Unicode confusables, and 17 other obfuscation techniques. Community language contributions welcome.
 
-## What Works Today (v0.2.64)
+## What Works Today (v0.2.65)
 
-- ✅ Text scanning: 1019 patterns, 7,350 keywords, 23 languages, 65 attack categories
+- ✅ Text scanning: 1038 patterns, 7,548 keywords, 23 languages, 65 attack categories
 - ✅ Negation handling: "do NOT run rm -rf" correctly downgrades severity
 - ✅ Multi-stage pipeline: normalization (17 techniques) → pattern match → decision
 - ✅ Image scanning: OCR + EXIF metadata + hidden text detection (requires Tesseract)

setup.py

@@ -2,7 +2,7 @@
 
 setup(
     name="sunglasses",
-    version="0.2.64",
+    version="0.2.65",
     description="Sunglasses for AI agents. Protection layer + neighborhood watch.",
     long_description=open("README.md").read(),
     long_description_content_type="text/markdown",

stats/current.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.2.64",
-  "patterns": 1019,
-  "keywords": 7350,
+  "version": "0.2.65",
+  "patterns": 1038,
+  "keywords": 7548,
   "categories": 65,
   "languages": 23,
   "normalization_techniques": 17,
@@ -16,8 +16,8 @@
   "media_types": 6,
   "reports_published": 3,
   "team_size": 5,
-  "last_updated": "2026-06-09T23:43:25-07:00",
+  "last_updated": "2026-06-10T04:23:21-07:00",
   "last_updated_by": "sunglasses-publish-sh",
   "_note": "THIS IS THE SINGLE SOURCE OF TRUTH. All pages, JSON-LD, meta tags, llms.txt, and sitemap must read from this file. Do NOT hardcode numbers anywhere else.",
-  "released": "2026-06-09"
+  "released": "2026-06-10"
 }

sunglasses/__init__.py

@@ -4,4 +4,4 @@
 #
 # "Don't let your agents get fooled."
 
-__version__ = "0.2.64"
+__version__ = "0.2.65"