v0.2.0

Feedback-driven release from the launch thread — thanks to everyone who tried it and pushed on the design.

New

• rulesentry fix — opt-in normalizer. Rewrites files into a safe canonical form by removing the unambiguously invisible characters (zero-width, Tag, bidi controls, variation selectors, control chars) and normalizing deceptive whitespace. Homoglyphs and executable strings (!`cmd`, curl | bash) are never auto-rewritten — intent-dependent, so they stay flag-only for human review. Dry-run by default (exits 1 on pending changes, CI-friendly); --write applies. Preserves a benign leading BOM. New rulesentry-fix pre-commit hook.

  npx rulesentry fix # preview
  npx rulesentry fix --write # apply

• Load-boundary receipt — every scanned file now reports a git blob hash + visibleSha256 (what a human reviewer perceives) vs agentReadSha256 (what the agent reads) + a differs flag. Turns "there is hidden Unicode" into a verifiable "the reviewer approved hash X, the agent ingests hash Y." In JSON (receipts) and summarized in pretty output. gitBlobSha1 matches git hash-object.

• Instruction-surface tagging — findings and receipts are tagged with the surface they came from (claude-md, agents-md, skill, slash-command, subagent, mcp-config, cursor-rules, copilot-instructions, …), in JSON and SARIF.

Fixed

• Variation-selector severity: a non-UTF-8 byte payload is no longer mis-ranked as printable text.

Still zero runtime dependencies, MIT. 91 tests across Node 18/20/22 × Linux/Windows.

Full changelog: https://github.com/mohamedzhioua/rulesentry/blob/main/CHANGELOG.md

v0.1.0

rulesentry catches hidden and invisible-unicode instructions smuggled into AI coding-agent config and skill files — CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, .mcp.json, SKILL.md. Zero-config, zero runtime dependencies, MIT.

npx rulesentry demo     # safe built-in sample
npx rulesentry scan     # scan your repo

Highlights

• Rules RS001–RS022: zero-width & invisible chars, bidirectional overrides (Trojan Source), Unicode Tag ASCII smuggling (decoded), variation-selector byte channels (decoded), homoglyph/mixed-script confusables, the !`command` dynamic-context execution prefix, and remote/obfuscated exec strings.
• "What you see vs. what the agent reads" reveal diff with decoded payloads and exact UTF-8 byte offsets.
• Output: pretty (quiet-by-default) / JSON / SARIF 2.1.0 for GitHub code scanning.
• GitHub Action + pre-commit hook.
• Hardened via an independent security review (no ReDoS; O(1)-per-file rendering; terminal-escape sanitization; size caps). 74 tests on Node 18/20/22 × Linux/Windows.
• Dogfooded on a 129-file AI-agent repo — clean at medium+.