v0.11.0

TL;DR

Twenty-two commits since v0.10.0 refactor the two monolithic source files into structured packages, redesign the inspect and review CLI output, add a forget command and an interactive override wizard, graduate R081/R082 from experimental, fix tokeniser and display bugs, and promote python-cryptography to a runtime dependency.

Changed

• inspect output redesigned. Replaced the stacked-Panel layout with a single Panel wrapping metadata, Files changed, Rules Triggered, suppressed rules, Score/Risk, and Status. "Score breakdown" header renamed to "Rules Triggered". Score and Risk rows moved to the bottom. --score and --risk are now independent flags (neither implies the other). Without any flag, rules show IDs and reasons only with a blue border. --score shows per-rule weights; --risk shows per-rule severities.

• review output now has a dedicated "Files changed" section listing every modified/added/removed file with +/~/- prefix, instead of a single summary row. --risk flag added to trustsight review: colours the panel border by risk level and shows a Risk: (level) row. --score/--risk are independent (Score row takes priority when both given).

• R081 (foreign package manager in install hooks) and R082 (shell obfuscation density >= 3 patterns) graduated from experimental and are now enabled by default. Calibrated against a 3243-diff benign corpus: 0 false positives for both.

• python-cryptography promoted from optdepends to a hard dependency (resolves namcap warnings about uninstalled cryptography module at runtime).

• src/trustsight/analysis.py (1080 lines) refactored into the analysis/ package: base.py, build.py, dependencies.py, maintainer.py, pipeline.py, structural.py, temporal.py.

• src/trustsight/cli.py (2035 lines) refactored into the cli/ package: admin.py, app.py, display.py, forget.py, history.py, inspect.py, list_cmd.py, review.py.

• packaging/aur/README.md corrected: python-tldextract is in the extra repository, not the AUR.

Added

• trustsight forget <package> removes a tracked package and all associated history. --prune removes packages no longer installed. --dry-run previews without deleting. --yes skips confirmation.

• trustsight override wizard <package> interactive command. Runs the full analysis pipeline, displays triggered non-FATAL rules, and prompts the user to pick which to suppress with a reason. Already-suppressed rules are skipped.

• --risk flag on trustsight review matches inspect behaviour: coloured border by risk level and a Risk row.

Fixed

• fetch_metadata(on_progress=...) signature mismatch. The review command passed an on_progress callback to fetch_metadata() but the function did not accept it, crashing with TypeError when the metadata-dump download path was taken. Added the on_progress parameter.

• Nested parameter expansions in PKGBUILD variables now resolve correctly (brace-depth tracking instead of stopping at first }).

• __seed__ sentinel excluded from user-facing database queries.

• Version display contract enforced: None shows as -, unresolvable strings as "unresolved", across all CLI paths.

• Conftest fixture conflict resolved.

Removed

• src/trustsight/analysis.py and src/trustsight/cli.py: the two monolithic modules deleted in favour of structured packages.

Stats

• 22 files changed, +578 / -3255
• 805 tests (22 files), all passing
• Package version 0.11.0