v0.5.0

ADDED

• ghost-deps reads install commands out of documentation and agent instruction files (*.md, *.mdx, *.mdc, *.txt, *.yml, *.rules, AGENTS.md, SKILL.md) and verifies every package they would install. Supported commands: npm/pnpm/yarn/bun (install, i, add), npx, pnpx, bunx, pip install, uv add, uv pip install, poetry add, pipx install.
• --ghosts, --only <ids> and --skip <ids> to narrow a scan; only and skip inputs on the GitHub Action.
• The terminal report opens with a Ghost packages block listing each name that does not resolve, its location, and the install command behind it.
• examples/ai-slop, a deliberately unsafe demo project that scores 0/100.
• scripts/ghost-hunt.ts, batch research over public repositories, producing a markdown report and a JSON dataset; docs/RESEARCH.md defines the protocol.

CHANGED

• Equally severe findings are ordered by detector, with ghost-deps first.

FIXED

• Manifest entries whose specifier is a git, file, link, workspace, catalog or URL protocol are no longer looked up on the registry, and npm: aliases now resolve to the package actually installed.
• Python import names are mapped to their PyPI distribution before lookup (import yaml → PyYAML, cv2 → opencv-python), and shared namespace roots (google, azure, zope) are no longer attributed to a single distribution.