Add 0.8 normal hardening transforms

README.md

@@ -4,6 +4,12 @@ Python source obfuscator. Give it a `.py` file, get back a single self-contained
 
 Each build is unique by default. Pass `--seed N` if you want a reproducible one.
 
+Version 0.8 adds a normalization layer that lowers f-strings and simple
+sequence `match` statements before the rest of the pipeline. This lets literal
+fragments pass through string protection and lets Abyss cover functions that
+previously fell back because of generator expressions or simple match/case
+syntax.
+
 Version 0.7 hardens Abyss with a second sealed-packet layer: protected VM
 instructions, constants, globals, locals, and entry offsets are individually
 masked inside the encrypted Abyss asset, and the runtime decodes one tagged
@@ -27,6 +33,20 @@ keep-name files, dry runs, stats JSON, HTML reports, manifest verification,
 output budget gates, a version flag, and CI metadata that matches the supported
 Python versions.
 
+## 0.8 Improvements
+
+- F-string literals are lowered into ordinary formatting and joining calls
+  before string encryption, so fragments such as separators, prefixes, and
+  format specs no longer bypass literal protection.
+- Simple sequence `match` cases are lowered into guarded `if` chains before
+  obfuscation, allowing the normal transforms and Abyss to process their
+  literal text and branch structure.
+- Abyss now supports simple single-generator generator expressions and list
+  comprehensions by lowering them into VM-managed loops.
+- The public disrobe sample now protects `rotate_name`, `compact_checksum`,
+  `describe_amounts`, and `build_report` under broad `--abyss` with no skipped
+  functions.
+
 ## 0.7 Improvements
 
 - Abyss assets now use a second internal sealing layer after the outer asset
@@ -177,6 +197,8 @@ python -m patchwork INPUT [-o OUTPUT] [options]
   --no-anti-debug           turn off runtime anti-debug probes
   --abyss                   virtualize eligible functions into encrypted VM assets
   --abyss-functions NAMES   virtualize only these functions, comma-separated or repeatable
+  --no-lower-fstrings       leave f-strings as JoinedStr nodes
+  --no-lower-match          leave match/case statements intact
   --audit-only              analyze the input and exit without writing output
   --audit-json PATH         write static audit metadata as JSON
   --manifest PATH           write build manifest with hashes/options/audit data
@@ -254,6 +276,8 @@ obf = Obfuscator(
     anti_debug=True,
     abyss=False,
     abyss_functions=[],
+    lower_fstrings=True,
+    lower_match=True,
     layers=3,
     stage2_layers=3,
     keep={'public_api_name'},