BGMLAI · BGMLAI · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -0,0 +1,16 @@
+{
+  "name": "gatecat",
+  "owner": {
+    "name": "BGML",
+    "email": "bogumil@bgml.ai",
+    "url": "https://gate.cat"
+  },
+  "plugins": [
+    {
+      "name": "gatecat",
+      "source": "./plugins/gatecat",
+      "description": "Deterministic action veto for Claude Code: blocks rm -rf, DROP TABLE, terraform destroy, disk wipes and secret exfiltration BEFORE the tool call executes. Requires `pip install gate.cat` (free, Apache-2.0).",
+      "version": "0.4.19"
+    }
+  ]
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,59 @@
 All notable changes to `gate.cat` will be documented in this file.
 
 
+## [Unreleased] -- 0.4.20
+
+### Fixed
+- Content-vs-command false-block (issue #4 / F1): a benign
+  `git commit -m "...git clean -f..."` was vetoed by the delete analyzer
+  because it ran on the raw action while inert-literal stripping (commit
+  message / echo / grep bodies) only fed the regex walls. The stripped text
+  is now computed once and shared with both stages, so a danger pattern
+  quoted inside a commit message can't false-block; the bare `git clean -f`
+  command still blocks, and recall stays 43/43 with 0 benign false-blocks.
+  log/raise still use the original action (verbatim audit).
+- The first-veto Team nudge now stays silent when `GATECAT_CLOUD_API_KEY` is
+  set -- a paying Cloud customer already has the off-machine record the nudge
+  pitches (the CLI nudge already did this; the post-veto path did not). No
+  once-per-machine flag is written in that case, so the nudge returns if Cloud
+  is dropped.
+- The policy-pack hint is suppressed for a pack whose module is already loaded
+  via `GATECAT_EXTRA_POLICIES` (suppress-only: it never suggests a *different*
+  pack) -- a Fintech-pack buyer is no longer pitched the Fintech pack.
+
+
+## [0.4.19] -- the hook arms itself (2026-07-23)
+
+### Added
+- `gate.cat setup claude-code [--global] [--dry-run]`: one-command PreToolUse
+  hook activation -- idempotent merge that preserves foreign keys and other
+  hooks, `<file>.gatecat.bak` backup before any modifying write, fail-closed
+  on unparsable settings.json (prints the manual block instead of touching
+  the file). `gate.cat doctor`: minimal install diagnosis (version, hook
+  binary on PATH, where the hook is registered, protection state). The
+  biggest funnel leak was an installed pip package whose hook was never
+  registered -- this automates exactly what the README documents.
+
+### Changed
+- Policy-pack hint v2 (`gatecat/_pack_hint.py`): now also detects the
+  HTTP-API Breadth pack -- via stack-specific CLIs only (`datadog-ci`,
+  `sentry-cli`; deliberately NO docker/gh/curl, which sit on every dev box
+  and would destroy the precision of a once-per-machine hint). All three
+  hints link the pack preview page
+  (`https://gate.cat/packs.html?source=hint#<pack>`) -- full scope before
+  checkout -- instead of a bare Stripe payment link. No policy, recall, or
+  bypass changes.
+
+### Fixed
+- `gatecat.__version__` now tracks pyproject (the 0.4.18 wheel shipped
+  printing "0.4.17" -- distribution metadata was correct, the runtime string
+  was not); a regression test ties the literal, both plugin manifests and
+  the pack-hint anchors to the release.
+- `gate.cat report` footer shipped a literal `*` inside its pasteable URL;
+  the post-veto nudge CTA was the only untagged conversion surface (now
+  `?source=nudge-veto`).
+
+
 ## [0.4.18] -- the listing sells, the CLI hints honestly (2026-07-22)
 
 ### Added

diff --git a/COMPARISON.md b/COMPARISON.md
@@ -60,7 +60,7 @@ blocks it. See F4 in [FACTS.md](FACTS.md).
 ## What gate.cat is NOT
 
 - Not a hallucination / fact-checker (lookup channel empty by default).
-- Not a frontier-model guardrail (signal weakens there — AUC 0.68–0.71 vs 0.77–0.90 on 7–30B).
+- Not a frontier-model guardrail (signal weakens there — AUC 0.68–0.71 vs 0.77–0.90 on 7–30B; internal measurement, artifact not yet published — FACTS F6/F7).
 - Not blanket coverage: it owns OWASP **LLM06 (Excessive Agency)** and part of LLM01/05; it does
   not cover the other seven.
 - Certain only about what it **blocks**. An unmatched action is *unchecked*, not *safe*.

diff --git a/FACTS.md b/FACTS.md
@@ -21,6 +21,7 @@ Every number gate.cat uses publicly, with its source and allowed wording.
 | F12 | Line coverage | 73% (6339 statements) in CI; 74% locally with the armed-gate-only tests included | CI run [28942984519](https://github.com/BGMLAI/gate.cat/actions/runs/28942984519) — pytest `--cov=gatecat`, printed in every CI job | 2026-07-08 (master `b9a75c0`) | "73% statement coverage, printed by CI on every run" | rounding up to "3/4 of the code is tested"; hiding that proxy/CLI paths are the least covered |
 | F13 | PyPI download proxy | 2,019 downloads excluding known mirrors in the trailing-month API window | `https://pypistats.org/api/packages/gate.cat/recent` and `METRICS.log`, read 2026-07-13 | 2026-07-13 | "2,019 PyPI downloads excluding known mirrors in the measured trailing window; this clears the 100-install proxy" | "2,019 users", "2,019 unique installs", or treating downloads as unique people |
 | F13a | PyPI download proxy (re-pinned) | **2,662** excluding known mirrors / **9,611** including mirrors, over `2026-07-03 … 2026-07-28` — which is the package's entire published life, not a rolling window carved out of a longer history | `https://pypistats.org/api/packages/gate.cat/overall` summed per category, cross-checked against `/recent` (`last_month=2662`, `last_week=134`, `last_day=0`); both read 2026-07-29 | 2026-07-29 (supersedes F13 for current copy; F13 stays valid in dated/version-scoped contexts) | "2,662 PyPI downloads excluding known mirrors between 3 and 28 July 2026 — downloads, not users; mirrors, CI and bots are inside that figure" | "2,662 users"; "2,662 installs"; quoting the 9,611 figure without saying it includes mirrors; implying a steady-state monthly run-rate from a package's first month |
+| F14 | Scaffold-overwrite class (SCAFFOLD_OVERWRITE) | WARN-only (never blocks); v1 fire-list = create-vite family + degit only; adds 0 to F1a/F4 block or false-block counts | `tests/test_scaffold_overwrite.py` (43 twin cases) + `analyze_scaffold_overwrite` in `gatecat/integrations/action_analysis.py`; verified 2026-07-24: F1a still 43/43 + 0/13, F4 still 178/178 + 1/129. This is the FIRST analyzer that reads the live filesystem — its verdict is deterministic GIVEN command+cwd+env+fs-state, but machine/cwd-state-dependent, NOT string-pure like every other check. | loop branch, 2026-07-24 (unreleased; rides 0.4.19/0.4.20) | "gate.cat flags (WARN, advisory) a create-vite/degit scaffold into an existing non-empty dir — the #80730 overwrite shape — without blocking it; adds no false-blocks" | describing a WARN as "prevention"/"blocks" (it surfaces, it does not veto); implying it covers scaffolders beyond create-vite+degit; attaching it to the "Deterministic" claim without the machine-state caveat |
 
 ## Honest-limits block (must accompany capability claims)
 

diff --git a/PRICING.md b/PRICING.md
@@ -73,6 +73,8 @@ benign twin — the same bar as the core gate.
 | **PaaS** | `vercel remove`, `netlify sites:delete`, `fly/heroku apps destroy`, `railway down`, `render/supabase delete` — deploy/list/info stay allowed | [**€29 →**](https://buy.stripe.com/3cI5kw3pbaLeeBO2Vo67S0d) |
 | **HTTP-API Breadth** | destructive raw-HTTP calls to Datadog, Sentry, Slack admin, Atlassian, Docker Hub, PyPI, … — the modality CLI-verb walls never see (requires gate.cat ≥ 0.4.9) | [**€29 →**](https://buy.stripe.com/aFa8wIgbX06AdxK67A67S0e) |
 
+Full scope of every pack, listed before you pay:
+[gate.cat/packs.html](https://gate.cat/packs.html?source=pricing-md).
 Delivery is fully automated: pay → instant download page (wheel + install
 instructions). Install = `pip install <wheel>` + one env var
 (`GATECAT_EXTRA_POLICIES`). VAT is calculated automatically at checkout.