v0.0.177

The installer's failure report now says where a failed request was going and which IP family it used, so a report from a machine that cannot reach us can be diagnosed from the report alone. After a failed request to squirrelscan or GitHub it makes one short, bounded request to that same host, outside any proxy, only to read the family, and sends nothing else. A host you set yourself is reported as custom and never probed, a request that failed and then succeeded on a retry is no longer blamed for a later unrelated error, and a failure before the first named step reports startup. The analytics duplicate-tags rule now reads every vendor loader as a URL: an uppercase ID parameter counts, and a lookalike host is no longer mistaken for Segment, Amplitude, Heap, Hotjar or Clarity. The fake-auth-overlay docs state every selector limit exactly, including that a style block is read as applying whatever its media or type attribute says, and the Security rules page shows the right rule count.

Fixed

• analytics/duplicate-tags reads every vendor loader as a URL. A ?ID= in capitals counts like ?id=, and a lookalike (evil.example/?x=cdn.segment.com/..., cdn.segment.io.evil.example, a host hidden behind userinfo) is not mistaken for Segment, Amplitude, Heap, Hotjar or Clarity, as it was already not for Google Tag Manager. A port, userinfo or leading whitespace on the real host still counts, and so does a template-literal inline snippet. (#1691)
• The Security rules page states the right rule count (24), and the docs count guard now also checks every per-category count sentence in docs/rules/*/index.mdx and every "N+ rules" and "N categories" in the README and the docs index against the rule registry, so a prose count that falls behind fails in this repo's CI.
• integrity/fake-auth-overlay limits restated exactly (#1566, #1581, #1576): the v0.0.175 note that :nth-child() and :lang() arguments are not checked is out of date, they are (an invalid argument drops the whole selector list, at the top level, in @media and nested). What a decoy cannot do: a part that is valid in some engine (an unknown pseudo name such as :bogus, the s flag, a media-state pseudo-class Chrome lacks) keeps the rule as undecided instead of dropping it, so .cover, :bogus{position:static} does not hide a cover, but it is not dropped whole as Chrome does; a cover written that way is read as a lone signal. Remaining limits: undecided rules cannot disable a decided cover, @layer order is not modelled, a <style> with a media or type that keeps it from applying is read as applying, and a legacy quirks-mode doctype is read as standards mode. New tests pin the htmlparser2 entityStart field the class cut reads, so a dependency bump that drops it fails a test.
• A failed install.sh network request says where it was going and over which IP family. The failure report (report version 4) now carries host (install.squirrelscan.com, a GitHub host, or custom for an endpoint you set yourself, never a custom name) and ip_family (v4, v6 or unknown), read from curl's own "Trying" line by a detached probe that never delays the install. A request made inside a command substitution used to lose its host, so a report said "an unknown host" for a request that had been made; the host is now kept in a small state file. A failure before the first named step reports startup, not init. After a failed request to our host or GitHub, the installer makes one short probe request to that same host (outside any proxy, a few seconds at most, in the background, and only after the failure) to learn the IP family, and sends nothing else; a custom endpoint is never probed. A host that failed and then succeeded on a retry is no longer reported for an unrelated later error, and a # in an endpoint URL no longer makes a foreign host read as ours. (#1681)