HookTripwire v0.3.0 — HookGraph execution provenance

HookGraph adds bounded static provenance from supported AI-agent hook configuration to literal repository-local scripts and their findings.

Highlights:

• Maps config → script → finding paths without executing commands.
• Makes dynamic, missing, outside-root, symlink, cycle, depth, and resource boundaries explicit.
• Renders graph evidence in terminal, JSON, Markdown, HTML, and the reusable GitHub Action.

Proof boundary: HookGraph shows statically provable local references; it does not predict runtime control flow or prove that a hook is safe.

Full Changelog: v0.2.0...v0.3.0

HookTripwire v0.2.0 — Zero-setup demo and reusable GitHub Action

HookTripwire v0.2.0 turns the first audit into one command and adds a reusable CI integration.

Highlights

• Added a deterministic --demo with seven actionable agent-automation findings.
• Added a zero-install composite GitHub Action with safely array-encoded inputs and no shell evaluation.
• Kept the demo isolated from ambient policy and baseline files unless explicitly requested.
• Reworked the first-run guide, project positioning, roadmap, and social-preview artwork.

Try the CLI:

npx --yes github:mockingbird777/hooktripwire#v0.2.0 --demo --fail-on none

Use the Action:

- uses: mockingbird777/hooktripwire@v0.2.0
  with:
    target: .
    fail-on: high

For high-assurance workflows, pin the Action to this release's full commit SHA. Requires Node.js 20 or newer.

HookTripwire v0.1.0

First public release of HookTripwire.\n\nHighlights:\n- Offline static analysis for AI-agent hooks, workflow files, permissions, and shell-backed automation\n- Fifteen evidence-based rules for destructive commands, remote execution, secret exfiltration, unsafe approvals, mutable dependencies, and credential exposure\n- Terminal, JSON, Markdown, SARIF 2.1, and self-contained HTML output\n- Policy and baseline workflows for gradual CI adoption\n- Redacted evidence, bounded no-follow input, atomic output, and zero runtime dependencies\n\nRequires Node.js 20 or newer.