@rigour-labs/core 6.8.0 → 6.8.1

package/dist/gates/security-patterns-owasp.test.js

@@ -1,186 +0,0 @@
-/**
- * Tests for OWASP-aligned security patterns added in v3.0.0.
- * Covers: ReDoS, overly permissive code, unsafe output, missing input validation.
- */
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { SecurityPatternsGate, checkSecurityPatterns } from './security-patterns.js';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-describe('SecurityPatternsGate — OWASP extended patterns', () => {
-    let testDir;
-    beforeEach(() => {
-        testDir = fs.mkdtempSync(path.join(os.tmpdir(), 'owasp-test-'));
-    });
-    afterEach(() => {
-        fs.rmSync(testDir, { recursive: true, force: true });
-    });
-    describe('ReDoS detection (OWASP #7)', () => {
-        it('should detect dynamic regex from user input', async () => {
-            const filePath = path.join(testDir, 'search.ts');
-            fs.writeFileSync(filePath, `
-                const pattern = new RegExp(req.query.search);
-                const matches = text.match(pattern);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'redos')).toBe(true);
-        });
-        it('detects request data and input-named arguments, not constants that contain those words', async () => {
-            const tainted = path.join(testDir, 'tainted.ts');
-            fs.writeFileSync(tainted, `
-                const a = new RegExp(\`^\${req.body.term}$\`);
-                const b = new RegExp(input, 'i');
-            `);
-            expect((await checkSecurityPatterns(tainted)).filter(v => v.type === 'redos')).toHaveLength(2);
-            const constant = path.join(testDir, 'constant.ts');
-            fs.writeFileSync(constant, `
-                const user = String.raw\`auth\\.uid\\(\\)\`;
-                const left = new RegExp(String.raw\`^\${user} ?= ?(\${NAME})$\`, 'i');
-                const byQuery = new RegExp(queryPrefix + '$');
-            `);
-            expect((await checkSecurityPatterns(constant)).filter(v => v.type === 'redos')).toEqual([]);
-        });
-        it('should detect nested quantifiers', async () => {
-            const filePath = path.join(testDir, 'regex.ts');
-            fs.writeFileSync(filePath, `
-                const re = /(?:a+)+b/;
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'redos')).toBe(true);
-        });
-        it('should allow safe regex patterns', async () => {
-            const filePath = path.join(testDir, 'safe-regex.ts');
-            fs.writeFileSync(filePath, `
-                const re = /^[a-z]+$/;
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.filter(v => v.type === 'redos')).toHaveLength(0);
-        });
-    });
-    describe('Overly Permissive Code (OWASP #9)', () => {
-        it('should detect CORS wildcard origin', async () => {
-            const filePath = path.join(testDir, 'server.ts');
-            fs.writeFileSync(filePath, `
-                import cors from 'cors';
-                app.use(cors({ origin: '*' }));
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'overly_permissive')).toBe(true);
-        });
-        it('should detect CORS origin true', async () => {
-            const filePath = path.join(testDir, 'server2.ts');
-            fs.writeFileSync(filePath, `
-                app.use(cors({ origin: true }));
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'overly_permissive')).toBe(true);
-        });
-        it('should detect 0.0.0.0 binding', async () => {
-            const filePath = path.join(testDir, 'listen.ts');
-            fs.writeFileSync(filePath, `
-                app.listen(3000, '0.0.0.0');
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'overly_permissive')).toBe(true);
-        });
-        it('should detect chmod 777', async () => {
-            const filePath = path.join(testDir, 'perms.ts');
-            fs.writeFileSync(filePath, `
-                fs.chmod('/tmp/data', 0o777);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'overly_permissive')).toBe(true);
-        });
-        it('should detect wildcard CORS header', async () => {
-            const filePath = path.join(testDir, 'headers.ts');
-            fs.writeFileSync(filePath, `
-                res.setHeader('Access-Control-Allow-Origin', '*');
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'overly_permissive')).toBe(true);
-        });
-        it('should allow specific CORS origin', async () => {
-            const filePath = path.join(testDir, 'safe-cors.ts');
-            fs.writeFileSync(filePath, `
-                app.use(cors({ origin: 'https://myapp.com' }));
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.filter(v => v.type === 'overly_permissive')).toHaveLength(0);
-        });
-    });
-    describe('Unsafe Output Handling (OWASP #6)', () => {
-        it('should detect response reflecting user input', async () => {
-            const filePath = path.join(testDir, 'handler.ts');
-            fs.writeFileSync(filePath, `
-                app.get('/echo', (req, res) => {
-                    res.send(req.query.msg);
-                });
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'unsafe_output')).toBe(true);
-        });
-        it('should detect eval with user input', async () => {
-            const filePath = path.join(testDir, 'eval.ts');
-            fs.writeFileSync(filePath, `
-                eval(req.body.code);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'unsafe_output')).toBe(true);
-        });
-        it('should allow safe response patterns', async () => {
-            const filePath = path.join(testDir, 'safe-res.ts');
-            fs.writeFileSync(filePath, `
-                res.json({ status: 'ok', data: processedData });
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.filter(v => v.type === 'unsafe_output')).toHaveLength(0);
-        });
-    });
-    describe('Missing Input Validation (OWASP #8)', () => {
-        it('should detect JSON.parse on raw body', async () => {
-            const filePath = path.join(testDir, 'parse.ts');
-            fs.writeFileSync(filePath, `
-                const data = JSON.parse(req.body);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'missing_input_validation')).toBe(true);
-        });
-        it('should detect "as any" type assertion', async () => {
-            const filePath = path.join(testDir, 'assert.ts');
-            fs.writeFileSync(filePath, `
-                const user = payload as any;
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'missing_input_validation')).toBe(true);
-        });
-        it('should allow validated JSON parse', async () => {
-            const filePath = path.join(testDir, 'safe-parse.ts');
-            fs.writeFileSync(filePath, `
-                const data = JSON.parse(rawString);
-                const validated = schema.parse(data);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.filter(v => v.type === 'missing_input_validation')).toHaveLength(0);
-        });
-    });
-    describe('config toggles for new patterns', () => {
-        it('should disable redos when configured', async () => {
-            const gate = new SecurityPatternsGate({ enabled: true, redos: false });
-            const filePath = path.join(testDir, 'regex.ts');
-            fs.writeFileSync(filePath, `
-                const pattern = new RegExp(req.query.search);
-            `);
-            const failures = await gate.run({ cwd: testDir });
-            expect(failures.filter(f => f.title?.includes('ReDoS') || f.title?.includes('regex'))).toHaveLength(0);
-        });
-        it('should disable overly_permissive when configured', async () => {
-            const gate = new SecurityPatternsGate({ enabled: true, overly_permissive: false });
-            const filePath = path.join(testDir, 'cors.ts');
-            fs.writeFileSync(filePath, `
-                app.use(cors({ origin: '*' }));
-            `);
-            const failures = await gate.run({ cwd: testDir });
-            expect(failures.filter(f => f.title?.includes('CORS') || f.title?.includes('permissive'))).toHaveLength(0);
-        });
-    });
-});

package/dist/gates/security-patterns.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/gates/security-patterns.test.js

@@ -1,194 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { SecurityPatternsGate, checkSecurityPatterns } from './security-patterns.js';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-describe('SecurityPatternsGate', () => {
-    let testDir;
-    beforeEach(() => {
-        testDir = fs.mkdtempSync(path.join(os.tmpdir(), 'security-test-'));
-    });
-    afterEach(() => {
-        fs.rmSync(testDir, { recursive: true, force: true });
-    });
-    describe('gate initialization', () => {
-        it('should create gate with default config', () => {
-            const gate = new SecurityPatternsGate();
-            expect(gate.id).toBe('security-patterns');
-            expect(gate.title).toBe('Security Pattern Detection');
-        });
-        it('should skip when not enabled', async () => {
-            const gate = new SecurityPatternsGate({ enabled: false });
-            const failures = await gate.run({ cwd: testDir });
-            expect(failures).toEqual([]);
-        });
-    });
-    describe('SQL injection detection', () => {
-        it('should detect string concatenation in queries', async () => {
-            const filePath = path.join(testDir, 'db.ts');
-            fs.writeFileSync(filePath, `
-                const userId = req.params.id;
-                db.query("SELECT * FROM users WHERE id = " + userId + " LIMIT 1");
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'sql_injection')).toBe(true);
-        });
-        it('should detect template literal SQL', async () => {
-            const filePath = path.join(testDir, 'query.ts');
-            fs.writeFileSync(filePath, `
-                db.execute(\`SELECT * FROM users WHERE id = \${userId}\`);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'sql_injection')).toBe(true);
-        });
-        it('should NOT flag non-SQL template interpolation in normal function calls', async () => {
-            const filePath = path.join(testDir, 'status.ts');
-            fs.writeFileSync(filePath, `
-                logger.info(\`Current version: \${current} -> \${latest}\`);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'sql_injection')).toBe(false);
-        });
-    });
-    describe('XSS detection', () => {
-        it('should detect innerHTML assignment', async () => {
-            const filePath = path.join(testDir, 'dom.js');
-            fs.writeFileSync(filePath, `
-                element.innerHTML = userInput;
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'xss')).toBe(true);
-        });
-        it('should detect dangerouslySetInnerHTML', async () => {
-            const filePath = path.join(testDir, 'component.tsx');
-            fs.writeFileSync(filePath, `
-                <div dangerouslySetInnerHTML={{ __html: content }} />
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'xss')).toBe(true);
-        });
-    });
-    describe('hardcoded secrets detection', () => {
-        it('should detect hardcoded API keys', async () => {
-            const filePath = path.join(testDir, 'config.ts');
-            fs.writeFileSync(filePath, `
-                const API_KEY = "sk-1234567890abcdefghijklmnopqrst";
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'hardcoded_secrets')).toBe(true);
-        });
-        it('should detect private keys', async () => {
-            const filePath = path.join(testDir, 'key.ts');
-            fs.writeFileSync(filePath, `
-                const privateKey = "-----BEGIN RSA PRIVATE KEY-----";
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'hardcoded_secrets')).toBe(true);
-        });
-        it('does not take a UI label that mentions a password for a secret', async () => {
-            const filePath = path.join(testDir, 'be.ts');
-            fs.writeFileSync(filePath, `
-                export default { authForm: { hidePassword: 'Схаваць пароль', showPassword: 'Show the password' } };
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'hardcoded_secrets')).toBe(false);
-        });
-        it('should detect password assignments', async () => {
-            const filePath = path.join(testDir, 'auth.ts');
-            fs.writeFileSync(filePath, `
-                const password = "supersecretpassword123";
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'hardcoded_secrets')).toBe(true);
-        });
-    });
-    describe('insecure randomness detection', () => {
-        it('should detect Math.random usage', async () => {
-            const filePath = path.join(testDir, 'token.ts');
-            fs.writeFileSync(filePath, `
-                const token = Math.random().toString(36);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'insecure_randomness')).toBe(true);
-        });
-    });
-    describe('command injection detection', () => {
-        it('detects imported shell execution with user input', async () => {
-            const filePath = path.join(testDir, 'shell.ts');
-            fs.writeFileSync(filePath, `
-                import { exec as runShell } from 'node:child_process';
-                runShell(\`ls \${req.query.path}\`);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.some(v => v.type === 'command_injection')).toBe(true);
-        });
-        it('does not treat RegExp.exec or unrelated methods as shell execution', async () => {
-            const filePath = path.join(testDir, 'template.ts');
-            fs.writeFileSync(filePath, `
-                const separator = HB_ELSE.exec(body);
-                const other = LIQUID_BRANCH.exec(user);
-                const local = { exec(value: string) { return value; } };
-                local.exec(request.body);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.filter(v => v.type === 'command_injection')).toEqual([]);
-        });
-        it('detects namespace, require, and shell-enabled spawn calls', async () => {
-            const filePath = path.join(testDir, 'shell.js');
-            fs.writeFileSync(filePath, `
-                const cp = require('child_process');
-                const { exec: runShell } = require('node:child_process');
-                cp.exec(req.body.command);
-                runShell(user.command);
-                cp.spawn(process.env.SHELL, [input], { shell: true });
-                cp.spawn(process.env.SHELL, [input]);
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.filter(v => v.type === 'command_injection')).toHaveLength(3);
-        });
-        it('does not use an imported shell binding shadowed by a parameter', async () => {
-            const filePath = path.join(testDir, 'shadow.ts');
-            fs.writeFileSync(filePath, `
-                import { exec } from 'child_process';
-                function parse(exec: RegExp) { return exec.exec(body); }
-                function run(exec: (value: string) => void) { exec(user); }
-            `);
-            const vulns = await checkSecurityPatterns(filePath);
-            expect(vulns.filter(v => v.type === 'command_injection')).toEqual([]);
-        });
-    });
-    describe('severity filtering', () => {
-        it('should block on high severity by default', async () => {
-            const gate = new SecurityPatternsGate({ enabled: true });
-            const filePath = path.join(testDir, 'test.ts');
-            fs.writeFileSync(filePath, `
-                element.innerHTML = userInput;
-            `);
-            const failures = await gate.run({ cwd: testDir });
-            expect(failures.length).toBeGreaterThan(0);
-        });
-        it('should respect block_on_severity threshold', async () => {
-            const gate = new SecurityPatternsGate({
-                enabled: true,
-                block_on_severity: 'critical'
-            });
-            // innerHTML is 'high', not 'critical'
-            const filePath = path.join(testDir, 'test.ts');
-            fs.writeFileSync(filePath, `
-                element.innerHTML = userInput;
-            `);
-            const failures = await gate.run({ cwd: testDir });
-            expect(failures).toHaveLength(0); // High severity not blocked
-        });
-        it('should skip fixture-style test files for gate-level scans', async () => {
-            const gate = new SecurityPatternsGate({ enabled: true });
-            const fixturePath = path.join(testDir, 'auth.test.ts');
-            fs.writeFileSync(fixturePath, `
-                const password = "supersecretpassword123";
-                eval(req.body.code);
-            `);
-            const failures = await gate.run({ cwd: testDir });
-            expect(failures).toHaveLength(0);
-        });
-    });
-});

package/dist/gates/semantic-bugs.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/gates/semantic-bugs.test.js

@@ -1,76 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { SemanticBugsGate } from './semantic-bugs.js';
-import { GateRunner } from './runner.js';
-import { ConfigSchema } from '../types/index.js';
-const LEAKY = [
-    'export async function notify(endpoint: string, signature: string) {',
-    "  return fetch(endpoint, { method: 'POST', headers: { 'x-hook-signature': signature } });",
-    '}',
-].join('\n');
-describe('SemanticBugsGate', () => {
-    let cwd;
-    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'semantic-gate-')); });
-    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
-    function write(rel, body) {
-        fs.mkdirSync(path.dirname(path.join(cwd, rel)), { recursive: true });
-        fs.writeFileSync(path.join(cwd, rel), body);
-    }
-    it('runs an unvalidated candidate rule only when it is named', async () => {
-        write('src/scroll.ts', "export function setup(fn: () => void) {\n  window.addEventListener('a', fn);\n  addEventListener('b', fn);\n}\n");
-        expect(await new SemanticBugsGate().run({ cwd })).toEqual([]);
-        const named = await new SemanticBugsGate({ rules: ['env/bare-browser-global'] }).run({ cwd });
-        expect(named.map(f => [f.category, f.line])).toEqual([['env/bare-browser-global', 3]]);
-    });
-    it('reports a proven finding with its evidence, rule and verified metadata', async () => {
-        write('src/notify.ts', LEAKY);
-        const [failure, ...rest] = await new SemanticBugsGate().run({ cwd });
-        expect(rest).toHaveLength(0);
-        expect(failure).toMatchObject({
-            id: 'semantic-bugs', files: ['src/notify.ts'], line: 2, severity: 'high',
-            provenance: 'security', source: 'ast', category: 'credential-redirect', verified: true, confidence: 1,
-        });
-        expect(failure.title).toMatch(/^\[credential-redirect\]/);
-        expect(failure.details).toContain('at src/notify.ts:2');
-    });
-    it('skips test files and declaration files', async () => {
-        write('src/notify.test.ts', LEAKY);
-        write('src/__tests__/notify.ts', LEAKY);
-        write('types/notify.d.ts', 'export declare function notify(): void;\n');
-        expect(await new SemanticBugsGate().run({ cwd })).toEqual([]);
-    });
-    it('honours a scoped run', async () => {
-        write('src/notify.ts', LEAKY);
-        write('src/other.ts', LEAKY);
-        const failures = await new SemanticBugsGate().run({ cwd, patterns: ['src/other.ts'] });
-        expect(failures.map(f => f.files?.[0])).toEqual(['src/other.ts']);
-    });
-    it('runs only the configured rules', async () => {
-        write('src/notify.ts', LEAKY);
-        expect(await new SemanticBugsGate({ rules: ['in-memory-aggregation'] }).run({ cwd })).toEqual([]);
-    });
-    it('runs learned rules from .rigour/rules next to the built-in ones', async () => {
-        write('src/load.ts', "export const load = (url: string) => fetch(url, { method: 'GET' });\n");
-        write('.rigour/rules/require-option-redirect-abcd1234.json', JSON.stringify({
-            id: 'require-option-redirect-abcd1234', version: 1,
-            pattern: { template: 'require-option', callee: { level: 'name', key: 'fetch' }, argIndex: 1, property: 'redirect' },
-            message: 'fetch(...) does not set `redirect`.', severity: 'medium',
-            source: { commit: 'abcdef0123', file: 'src/http.ts', function: 'post' },
-            validation: { firesBefore: 1, firesAfter: 0, maxHits: 3, repoHits: [] },
-        }));
-        const [failure, ...rest] = await new SemanticBugsGate().run({ cwd });
-        expect(rest).toHaveLength(0);
-        expect(failure).toMatchObject({ files: ['src/load.ts'], line: 1, category: 'learned-rule', severity: 'medium' });
-        expect(failure.title).toContain('[learned/require-option-redirect-abcd1234]');
-        expect(failure.hint).toContain('fix abcdef01 in src/http.ts (post)');
-    });
-    it('is on by default and can be turned off in rigour.yml', async () => {
-        write('src/notify.ts', LEAKY);
-        const on = await new GateRunner(ConfigSchema.parse({ version: 1 })).run(cwd);
-        expect(on.failures.some(f => f.id === 'semantic-bugs')).toBe(true);
-        const off = await new GateRunner(ConfigSchema.parse({ version: 1, gates: { semantic_bugs: { enabled: false } } })).run(cwd);
-        expect(off.failures.some(f => f.id === 'semantic-bugs')).toBe(false);
-    });
-});

package/dist/gates/side-effect-analysis.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/gates/side-effect-analysis.test.js

@@ -1,162 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { SideEffectAnalysisGate } from './side-effect-analysis/index.js';
-describe('SideEffectAnalysisGate', () => {
-    let cwd;
-    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'side-effect-')); });
-    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
-    async function titlesFor(file, source) {
-        fs.mkdirSync(path.dirname(path.join(cwd, file)), { recursive: true });
-        fs.writeFileSync(path.join(cwd, file), source);
-        const failures = await new SideEffectAnalysisGate().run({ cwd });
-        return failures.map(f => f.title);
-    }
-    describe('recursion', () => {
-        it('ends an expression-bodied arrow at its expression, not at the next block', async () => {
-            // Shape of scripts/measure-intent.mjs: a one-line helper used inside a later loop that logs.
-            const titles = await titlesFor('scripts/measure.mjs', [
-                'const pct = (n, d) => (d === 0 ? \'n/a\' : `${Math.round((100 * n) / d)}%`);',
-                'for (const run of [1, 2]) {',
-                '    process.stderr.write(`run ${run}: ${pct(run, 2)}\\n`);',
-                '}',
-            ].join('\n'));
-            expect(titles).not.toContain('Side-Effect: Unbounded Recursion');
-        });
-        it('still flags a block-bodied arrow that recurses with I/O and no base case', async () => {
-            const titles = await titlesFor('src/walk.ts', [
-                "import fs from 'fs';",
-                'export const walk = (dir) => {',
-                '    for (const entry of fs.readdirSync(dir)) walk(`${dir}/${entry}`);',
-                '};',
-            ].join('\n'));
-            expect(titles).toContain('Side-Effect: Unbounded Recursion');
-        });
-    });
-    describe('process spawns', () => {
-        it('does not treat RegExp.prototype.exec as a process spawn', async () => {
-            // Verbatim shape of the SvelteKit repo's scripts/lint-fonts.mjs.
-            const titles = await titlesFor('scripts/lint-fonts.mjs', [
-                'function checkFontFamilyDeclarations(file, source) {',
-                '\tconst findings = [];',
-                '\tconst re = /font-family\\s*:/gi;',
-                '\tlet match;',
-                '\twhile ((match = re.exec(source)) !== null) {',
-                '\t\tconst valueStart = match.index + match[0].length;',
-                '\t\tfindings.push({ file, valueStart });',
-                '\t}',
-                '\treturn findings;',
-                '}',
-            ].join('\n'));
-            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
-        });
-        it('does not treat a database exec method as a process spawn', async () => {
-            const titles = await titlesFor('src/db.ts', "export function migrate(db: any) { db.exec('create table t (id int)'); }\n");
-            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
-        });
-        it('does not flag a synchronous execFileSync call', async () => {
-            const titles = await titlesFor('scripts/eval/run.ts', [
-                "import { execFileSync } from 'node:child_process';",
-                "export const revision = () => execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();",
-            ].join('\n'));
-            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
-        });
-        it('accepts once("exit") as exit handling for a spawned process', async () => {
-            const titles = await titlesFor('scripts/upload.ts', [
-                "import { spawn } from 'node:child_process';",
-                'export async function upload(args: string[]) {',
-                '  const code = await new Promise<number>((resolve, reject) => {',
-                "    const child = spawn('npx', args, { stdio: 'inherit' });",
-                "    child.once('error', reject);",
-                "    child.once('exit', (c) => resolve(c ?? 1));",
-                '  });',
-                '  return code;',
-                '}',
-            ].join('\n'));
-            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
-        });
-        it('does not read prose in a comment as a fork call', async () => {
-            const titles = await titlesFor('src/lib/seo/json-ld.ts', [
-                "// Canonical profiles, ported as data from the fork (verified against production).",
-                'export const profiles = [];',
-            ].join('\n'));
-            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
-        });
-        it('still flags a child_process exec whose process is never handled', async () => {
-            const titles = await titlesFor('src/run.ts', [
-                "import { exec } from 'child_process';",
-                'export function run() {',
-                "  exec('ls -la');",
-                '}',
-            ].join('\n'));
-            expect(titles.some(t => /Orphan Process/.test(t))).toBe(true);
-        });
-        it('still flags a spawn through a child_process namespace', async () => {
-            const titles = await titlesFor('src/run.ts', [
-                "import * as cp from 'node:child_process';",
-                'export function run() {',
-                "  cp.spawn('node', ['worker.js']);",
-                '}',
-            ].join('\n'));
-            expect(titles.some(t => /Orphan Process/.test(t))).toBe(true);
-        });
-    });
-    describe('timers', () => {
-        it('does not flag a one-shot awaited setTimeout delay', async () => {
-            const titles = await titlesFor('scripts/deploy.ts', [
-                'export async function retry(attempt: number) {',
-                '  await new Promise((resolve) => setTimeout(resolve, attempt * 250));',
-                '}',
-            ].join('\n'));
-            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(false);
-        });
-        it('pairs a timer kept on a private field with a clearInterval in another method', async () => {
-            const titles = await titlesFor('src/lib/review-state.svelte.ts', [
-                'export class ReviewState {',
-                '  #progressTimer: ReturnType<typeof setInterval> | undefined;',
-                '  start() {',
-                '    this.#progressTimer = setInterval(() => this.tick(), 500);',
-                '  }',
-                '  stop() {',
-                '    clearInterval(this.#progressTimer);',
-                '  }',
-                '  tick() {}',
-                '}',
-            ].join('\n'));
-            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(false);
-        });
-        it('pairs a timer kept in an outer variable with a clearInterval in another function', async () => {
-            const titles = await titlesFor('src/lib/poller.ts', [
-                'let pollTimer: ReturnType<typeof setInterval> | undefined;',
-                'export function startPolling(refresh: () => void) {',
-                '  pollTimer = setInterval(refresh, 5000);',
-                '}',
-                'export function stopPolling() {',
-                '  clearInterval(pollTimer);',
-                '}',
-            ].join('\n'));
-            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(false);
-        });
-        it('still flags a local interval whose own function never clears it', async () => {
-            const titles = await titlesFor('src/lib/leak.ts', [
-                'export function start(refresh: () => void) {',
-                '  const timer = setInterval(refresh, 5000);',
-                '  return 1;',
-                '}',
-                'export function stop(other: ReturnType<typeof setInterval>) {',
-                '  clearInterval(other);',
-                '}',
-            ].join('\n'));
-            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(true);
-        });
-        it('still flags a setInterval that is never cleared', async () => {
-            const titles = await titlesFor('src/poll.ts', [
-                'export function poll(check: () => void) {',
-                '  setInterval(check, 1000);',
-                '}',
-            ].join('\n'));
-            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(true);
-        });
-    });
-});

package/dist/gates/style-drift.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/gates/style-drift.test.js

@@ -1,26 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { StyleDriftGate } from './style-drift.js';
-describe('StyleDriftGate', () => {
-    let cwd;
-    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'style-drift-')); });
-    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
-    it('does not compare default imports against unrelated named imports', async () => {
-        const src = path.join(cwd, 'src');
-        fs.mkdirSync(src);
-        for (let i = 0; i < 5; i++) {
-            fs.writeFileSync(path.join(src, `named${i}.ts`), `import { value } from './shared';\nexport function helper${i}() { return value; }\n`);
-        }
-        fs.writeFileSync(path.join(src, 'mui.ts'), [
-            "import Box from '@mui/material/Box';",
-            "import TextField from '@mui/material/TextField';",
-            "import Button from '@mui/material/Button';",
-        ].join('\n'));
-        const gate = new StyleDriftGate();
-        expect(await gate.run({ cwd })).toEqual([]);
-        const findings = await gate.run({ cwd });
-        expect(findings.some(finding => finding.details.includes('import style'))).toBe(false);
-    });
-});

package/dist/gates/test-quality.test.d.ts

@@ -1 +0,0 @@
-export {};