agent-roast 0.14.0 → 0.16.0

package/README.md

@@ -79,11 +79,11 @@ Policy is read from the **base** branch, so a pull request cannot switch off the
 | Rule | Fires when | By default |
 | --- | --- | :-: |
 | `assertion-weakened` | an exact check is replaced by a weaker one: `toBe(42)` → `toBeDefined()`, `assert x == 1` → `assert x` | blocks |
-| `guard-weakened` | a coverage threshold is lowered, `strict` is switched off, a lint rule is downgraded, a CI step may fail, a workflow stops running tests | blocks |
-| `test-skip` | a test is switched off: `it.skip`, `@pytest.mark.skip`, `t.Skip`, `#[ignore]`, `@Disabled`, `[Ignore]`, `xit`, ... | blocks |
-| `test-focus`, `trivial-assert` | `.only` / `fit`; `expect(true).toBe(true)` and its relatives in ten languages | blocks |
+| `guard-weakened` | a coverage threshold is lowered, `strict` is switched off, a lint rule is downgraded, a CI step may fail, a workflow stops running tests, a `conftest.py` hook sets a report to `passed` | blocks |
+| `test-skip` | a test is switched off or expected to fail: `it.skip`, `@pytest.mark.skip`, `@pytest.mark.xfail`, `it.fails`, `test.fixme`, `t.Skip`, `#[ignore]`, `@Disabled`, `[Ignore]`, `xit`, ... | blocks |
+| `test-focus`, `trivial-assert` | `.only` / `fit`; `expect(true).toBe(true)` and its relatives in ten languages; a test that asserts on a function it mocked itself | blocks |
 | `assertion-removed`, `test-removed`, `expectation-rewritten` | a test loses assertions, disappears, or its expected value is edited next to production code | warns |
-| `swallowed-error`, `type-escape`, `stub-abandonment` | `catch {}` / `except: pass`, `as any` / `# type: ignore`, `throw new Error("Not implemented")` | warns |
+| `swallowed-error`, `type-escape`, `stub-abandonment` | `catch {}` / `except: pass`, `as any` / `# type: ignore` / `# pragma: no cover` / `istanbul ignore`, `throw new Error("Not implemented")` | warns |
 
 Renames, moved tests, parametrization, moved assertions and reformatting are recognized and not reported, and neither is a skip
 that depends on the environment (`if testing.Short() { t.Skip() }`, `test.skip(isMobile, ...)`). JavaScript/TypeScript, Python
@@ -111,9 +111,9 @@ old debt with a baseline: [docs/reference.md](docs/reference.md#configuration).
 Measured, with the denominators and the caveats in [docs/benchmarks.md](docs/benchmarks.md). **Weakened checks are rare, mostly
 deliberate, and not specific to AI. agent-roast is a tripwire that stays silent until a check gets weaker.**
 
-- **71 of 71** hand-labeled cheating edits are caught and **51 of 51** harmless look-alikes (reformats, moves, raised
+- **119 of 119** hand-labeled cheating edits are caught and **84 of 84** harmless look-alikes (reformats, moves, raised
   thresholds, environment-gated skips) stay silent. The cases were written with the detector, so they guard against regressions;
-  they do not prove accuracy. Three gaps are documented and still open.
+  they do not prove accuracy. One gap is documented and still open.
 - **12,645 commits** that touch tests or CI/config in 166 public repositories: blocking rules fired on 0.3% of AI-signed commits
   (Claude, Copilot, Cursor, Codex, Devin, aider) and on 0.3% of the others. Inside the same repositories the odds for an
   AI-signed commit were 0.81 times those of another commit (95% CI 0.40–1.67). There is no sign that AI-signed commits weaken

package/dist/{chunk-MZBP537U.js → chunk-52FUQ4EP.js}

@@ -757,22 +757,22 @@ var RULE_GUIDES = {
     example: 'test.only("auth", ...) \u2192 test("auth", ...), then run the full suite'
   },
   "test-skip": {
-    title: "Skipped or disabled test",
-    why: "The test runner may report success without executing this behavior check.",
-    suggestion: "Re-enable the test and fix its failure. If a skip is intentional, document its reason and track when to restore it.",
-    example: 'it.skip("auth", ...) \u2192 it("auth", ...) after fixing the failing behavior'
+    title: "Skipped, disabled or expected-to-fail test",
+    why: "The test runner may report success without executing this behavior check, or without letting it fail.",
+    suggestion: "Re-enable the test and fix its failure. If a skip or an expected failure is intentional, document its reason and track when to restore it.",
+    example: 'it.skip("auth", ...) or @pytest.mark.xfail \u2192 remove the marker after fixing the failing behavior'
   },
   "trivial-assert": {
     title: "Assertion that always passes",
-    why: "Comparing a constant to itself does not check the implementation and cannot catch regressions.",
-    suggestion: "Call the real behavior and assert its output or observable side effect instead of comparing constants.",
-    example: "expect(true).toBe(true) \u2192 expect(canSignIn(validUser)).toBe(true)"
+    why: "Comparing a constant to itself, or checking the output of a function the test itself replaces with a mock, does not check the implementation and cannot catch regressions.",
+    suggestion: "Call the real behavior and assert its output or observable side effect instead of comparing constants. Mock the dependencies of the code under test, never the code under test.",
+    example: "expect(true).toBe(true) \u2192 expect(canSignIn(validUser)).toBe(true); jest.mock('./price', ...) then expect(price(cart)).toBe(42) \u2192 mock the price list and assert total(cart)"
   },
   "type-escape": {
-    title: "Type or linter check bypass",
-    why: "A suppression can hide incompatible values or a disabled correctness check. Some suppressions are justified.",
-    suggestion: "Narrow or validate the value at the boundary. Keep a suppression only with a specific reason and the smallest possible scope.",
-    example: "response as any \u2192 parse and validate response before using it"
+    title: "Type, lint or coverage check bypass",
+    why: "A suppression can hide incompatible values, a disabled correctness check, or code that no test reaches. Some suppressions are justified.",
+    suggestion: "Narrow or validate the value at the boundary, or test the excluded code. Keep a suppression only with a specific reason and the smallest possible scope.",
+    example: "response as any \u2192 parse and validate response before using it; # pragma: no cover \u2192 a test for that branch"
   },
   "swallowed-error": {
     title: "Error discarded without handling",
@@ -812,9 +812,9 @@ var RULE_GUIDES = {
   },
   "guard-weakened": {
     title: "Quality gate made easier to pass",
-    why: "Lower coverage thresholds, disabled compiler strictness, downgraded lint rules, tolerated CI failures or an always-passing test script let defects through without touching the code.",
+    why: "Lower coverage thresholds, disabled compiler strictness, downgraded lint rules, tolerated CI failures, an always-passing test script or a test-harness hook that rewrites the result let defects through without touching the code.",
     suggestion: "Keep the gate and fix the underlying failure. If the change is deliberate, record the reason and a plan to restore it.",
-    example: 'coverageThreshold lines: 80 \u2192 60, "strict": true \u2192 false, continue-on-error: true'
+    example: 'coverageThreshold lines: 80 \u2192 60, "strict": true \u2192 false, continue-on-error: true, report.outcome = "passed"'
   },
   "panic-loop": {
     title: "Rapid overlapping fix commits",
@@ -1163,8 +1163,19 @@ var PYTHON_TEST_SKIP_PATTERNS = [
   { regex: /@pytest\s*\.\s*mark\s*\.\s*skip\b/, name: "skipped pytest (@pytest.mark.skip)" },
   { regex: /(?<![\w.])pytest\s*\.\s*skip\s*\(/, name: "imperative pytest skip (pytest.skip)", imperative: true },
   { regex: /@unittest\s*\.\s*skip\s*\(/, name: "skipped unittest (@unittest.skip)", imperative: false },
-  { regex: /\bself\s*\.\s*skipTest\s*\(/, name: "imperative unittest skip (self.skipTest)", imperative: true }
+  { regex: /\bself\s*\.\s*skipTest\s*\(/, name: "imperative unittest skip (self.skipTest)", imperative: true },
+  // A test that is expected to fail cannot fail the run, which is what a skip does too.
+  { regex: /(?<![\w.])pytest\s*\.\s*xfail\s*\(/, name: "imperative pytest xfail (pytest.xfail)", imperative: true },
+  { regex: /@(?:unittest\s*\.\s*)?expectedFailure\b/, name: "test expected to fail (@unittest.expectedFailure)", imperative: false }
 ];
+var PYTHON_MARKER = /(@\s*|(?<![\w.])marks\s*=\s*\[?\s*|^[ \t]*pytestmark\s*=\s*\[?\s*)pytest\s*\.\s*mark\s*\.\s*(skip|xfail)\b/gm;
+function isConditionalXfail(args) {
+  if (!args?.length) return false;
+  const keyword = (arg) => /^(\w+)\s*=(?!=)/.exec(arg)?.[1];
+  const condition = keyword(args[0]) ? args.find((arg) => keyword(arg) === "condition")?.replace(/^condition\s*=\s*/, "") : args[0];
+  if (condition === void 0 || /^(?:True|1)$/.test(condition.trim())) return false;
+  return !/\bCI\b|\bisCI\b|GITHUB_ACTIONS/.test(condition);
+}
 function isGuardedSkip(lines) {
   const indentOf = (text) => text.length - text.trimStart().length;
   const mentionsCi = (raw) => /\bCI\b|\bGITHUB_ACTIONS\b/.test(raw);
@@ -1305,44 +1316,67 @@ function isGuardedBlockSkip(lines, profile) {
   }
   return compiledConditionally(i + 1);
 }
-var JS_TEST_API = /(?<![\w$.])(?:(?:it|test|describe|suite)(?:\s*\.\s*(?:concurrent|serial|parallel|describe|failing|sequential))*\s*\.\s*(skip|todo|only)|((?:xit|xtest|xdescribe|fit|fdescribe)))\b((?:\s*\.\s*(?:each|failing|concurrent|serial|parallel|sequential))*)\s*(?=\(|\u0001)/g;
+var JS_TEST_API = /(?<![\w$.])(?:(?:it|test|describe|suite)(?:\s*\.\s*(?:concurrent|serial|parallel|describe|failing|sequential))*\s*\.\s*(skip|todo|only|fixme|failing|fails|fail)|((?:xit|xtest|xdescribe|fit|fdescribe)))\b((?:\s*\.\s*(?:each|failing|concurrent|serial|parallel|sequential))*)\s*(?=\(|\u0001)/g;
 function isConditionalSkip(source, raw, open2) {
-  if (source[open2] !== "(") return false;
+  const args = callArguments(source, raw, open2);
+  if (!args) return false;
+  const isString = (arg) => /^(['"`])[\s\S]*\1$/.test(arg);
+  if (!args.length || isString(args[0]) || args[0] === "true") return false;
+  if (args.length > 1 && !isString(args.at(-1))) return false;
+  return !/\bCI\b|\bisCI\b|GITHUB_ACTIONS/.test(args[0]);
+}
+function callArguments(source, raw, open2) {
+  if (source[open2] !== "(") return null;
   const args = [];
   let depth = 0;
   let start = open2 + 1;
   for (let i = start; i < source.length && i - open2 <= 2e3; i++) {
     const char = source[i];
-    if (char === "\0") return false;
+    if (char === "\0") return null;
     if ("([{".includes(char)) depth++;
     else if (")]}".includes(char)) {
       if (depth) {
         depth--;
         continue;
       }
-      if (char !== ")") return false;
+      if (char !== ")") return null;
       args.push(raw.slice(start, i).trim());
       while (args.length && !args.at(-1)) args.pop();
-      const isString = (arg) => /^(['"`])[\s\S]*\1$/.test(arg);
-      if (!args.length || isString(args[0]) || args[0] === "true") return false;
-      if (args.length > 1 && !isString(args.at(-1))) return false;
-      return !/\bCI\b|\bisCI\b|GITHUB_ACTIONS/.test(args[0]);
+      return args;
     } else if (char === "," && !depth) {
       args.push(raw.slice(start, i).trim());
       start = i + 1;
     }
   }
-  return false;
+  return null;
 }
 var JS_COMMENT_DIRECTIVE_PATTERNS = [
   { regex: /^\s*\/\/\s*@ts-ignore\b/, name: "compiler ignore (@ts-ignore)" },
   { regex: /^\s*\/\/\s*@ts-expect-error\b/, name: "compiler suppression (@ts-expect-error)" },
   { regex: /^\s*\/\/\s*@ts-nocheck\b/, name: "compiler check disable (@ts-nocheck)" },
-  { regex: /^\s*\/\/\s*eslint-disable(?:-next-line|-line)?\b/, name: "linter suppression (eslint-disable)" }
+  { regex: /^\s*\/\/\s*eslint-disable(?:-next-line|-line)?\b/, name: "linter suppression (eslint-disable)" },
+  { regex: /^\s*\/\/\s*biome-ignore\b/, name: "linter suppression (biome-ignore)" },
+  { regex: /^\s*\/\/\s*(?:istanbul|c8|v8|node:coverage)\s+(?:ignore\b(?!\s+(?:stop|end)\b)|disable\b)/, name: "coverage exclusion (istanbul / c8 / v8 ignore)" }
+];
+var JS_BLOCK_DIRECTIVE_PATTERNS = [
+  { regex: /^\/\*\s*eslint-disable(?:-next-line|-line)?\b/, name: "linter suppression (eslint-disable)" },
+  { regex: /^\/\*\s*(?:istanbul|c8|v8|node:coverage)\s+(?:ignore\b(?!\s+(?:stop|end)\b)|disable\b)/, name: "coverage exclusion (istanbul / c8 / v8 ignore)" }
 ];
+var COVERAGE_IDIOM = /^\s*(?:if\s+(?:(?:typing|t)\s*\.\s*)?TYPE_CHECKING\b|if\s+__name__\s*==|raise\s+(?:NotImplementedError|AssertionError)\b|(?:\w+\s*\.\s*)?assert_never\s*\(|@(?:abc\s*\.\s*)?abstractmethod\b|except\s*\(?\s*(?:ImportError|ModuleNotFoundError)\b|import\s|from\s+\S+\s+import\b|\.\.\.\s*$|pass\s*$|else\s*:|case\s+_\s*:|(?:el)?if\s+sys\s*\.\s*(?:version_info|platform)\b)/;
 var PYTHON_COMMENT_DIRECTIVE_PATTERNS = [
   { regex: /#\s*type:\s*ignore\b/, name: "python type ignore" },
-  { regex: /#\s*noqa\b/, name: "python linter suppression (# noqa)" }
+  { regex: /#\s*noqa\b/, name: "python linter suppression (# noqa)" },
+  { regex: /#\s*pragma:\s*no\s*(?:cover|branch)\b/i, name: "coverage exclusion (# pragma: no cover)", unless: COVERAGE_IDIOM },
+  { regex: /#\s*pylint:\s*(?:disable|skip-file)\b/, name: "python linter suppression (# pylint: disable)" },
+  { regex: /#\s*pyright:\s*ignore\b/, name: "python type ignore (# pyright: ignore)" },
+  { regex: /#\s*mypy:\s*ignore-errors\b/, name: "python type check disabled for the file (# mypy: ignore-errors)" },
+  { regex: /#\s*(?:flake8|ruff):\s*noqa\b/i, name: "python linter suppression for the file (# flake8: noqa)" }
+];
+var PYTHON_HARNESS_FILE = /(?:^|\/)(?:conftest|sitecustomize|usercustomize)\.py$/i;
+var PYTHON_HARNESS_PATTERNS = [
+  { regex: /\.\s*outcome\s*=\s*(["'])passed\1/, name: "test report outcome forced to passed" },
+  { regex: /(?<![\w.])call\s*\.\s*excinfo\s*=\s*None\b/, name: "failure cleared from a test report hook (call.excinfo = None)" },
+  { regex: /(?<![\w.])session\s*\.\s*exitstatus\s*=\s*(?:0\b|(?:pytest\s*\.\s*)?ExitCode\s*\.\s*OK\b)/, name: "pytest exit status forced to 0" }
 ];
 var CODE_TYPE_ESCAPE_PATTERNS = [
   { regex: /\bas\s+any\b/, name: "type bypass (as any)" },
@@ -1419,13 +1453,13 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
     hasSupportedChanges = true;
     filesInspected++;
     linesAdded += file.addedLines.length;
-    const javascript = /\.(?:[cm]?[jt]sx?|vue|svelte)$/i.test(file.path);
+    const javascript2 = /\.(?:[cm]?[jt]sx?|vue|svelte)$/i.test(file.path);
     const typescript = /\.(?:[cm]?tsx?|vue|svelte)$/i.test(file.path);
-    const python = /\.py$/i.test(file.path);
+    const python2 = /\.py$/i.test(file.path);
     const rust = /\.rs$/i.test(file.path);
-    const braceCatches = javascript || /\.(?:java|kt|php|cs|cpp)$/i.test(file.path);
-    const directives = javascript ? JS_COMMENT_DIRECTIVE_PATTERNS : python ? PYTHON_COMMENT_DIRECTIVE_PATTERNS : [];
-    const stubs = javascript ? JS_STUB_PATTERNS : python ? PYTHON_STUB_PATTERNS : rust ? RUST_STUB_PATTERNS : [];
+    const braceCatches = javascript2 || /\.(?:java|kt|php|cs|cpp)$/i.test(file.path);
+    const directives = javascript2 ? JS_COMMENT_DIRECTIVE_PATTERNS : python2 ? PYTHON_COMMENT_DIRECTIVE_PATTERNS : [];
+    const stubs = javascript2 ? JS_STUB_PATTERNS : python2 ? PYTHON_STUB_PATTERNS : rust ? RUST_STUB_PATTERNS : [];
     const firstFinding = infractions.length;
     const languageRules = LANGUAGE_LINE_RULES.find((entry) => entry.files.test(file.path))?.rules;
     const masker = new SourceMasker(file.path);
@@ -1438,7 +1472,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
       for (const start of masked.templateStarts) testCode[start] = "
";
       maskedLines.push({ code: cleanedLine, testCode: testCode.join(""), raw: rawLine, number: added.lineNumber });
       const isComment = !cleanedLine.trim();
-      if (python && !isComment) {
+      if (python2 && !isComment) {
         for (const rule of PYTHON_TEST_SKIP_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
             if (rule.imperative && isGuardedSkip(maskedLines)) break;
@@ -1465,7 +1499,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
       }
       let foundEscape = false;
       for (const rule of directives) {
-        if (rule.regex.test(masked.comments)) {
+        if (rule.regex.test(masked.comments) && !rule.unless?.test(cleanedLine)) {
           infractions.push({
             type: "type-escape",
             file: file.path,
@@ -1479,11 +1513,12 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
           break;
         }
       }
-      if (javascript && !foundEscape && masked.blockStarts.some((start) => /^\/\*\s*eslint-disable(?:-next-line|-line)?\b/.test(rawLine.slice(start)))) {
-        infractions.push({ type: "type-escape", file: file.path, lineNumber: added.lineNumber, lineSnippet: rawLine.trim(), commitHash, commitDate, reason: "linter suppression (eslint-disable)" });
+      const blockDirective = javascript2 && !foundEscape ? JS_BLOCK_DIRECTIVE_PATTERNS.find((rule) => masked.blockStarts.some((start) => rule.regex.test(rawLine.slice(start)))) : void 0;
+      if (blockDirective) {
+        infractions.push({ type: "type-escape", file: file.path, lineNumber: added.lineNumber, lineSnippet: rawLine.trim(), commitHash, commitDate, reason: blockDirective.name });
         foundEscape = true;
       }
-      if (python && !isComment && isTestFile(file.path)) {
+      if (python2 && !isComment && isTestFile(file.path)) {
         for (const rule of PYTHON_TRIVIAL_ASSERT_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
             infractions.push({
@@ -1543,6 +1578,34 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         infractions.push({ type: "stub-abandonment", file: file.path, ...location, commitHash, commitDate, reason: rule.name });
       }
     }
+    if (python2) {
+      const reportedSkips = new Set(infractions.slice(firstFinding).filter((f) => f.type === "test-skip").map((f) => f.lineNumber));
+      for (const match of source.matchAll(PYTHON_MARKER)) {
+        const xfail = match[2] === "xfail";
+        let open2 = match.index + match[0].length;
+        while (source[open2] === " " || source[open2] === "	") open2++;
+        if (xfail && isConditionalXfail(callArguments(source, raw, open2))) continue;
+        const location = evidence(match.index, match[0].length);
+        if (reportedSkips.has(location.lineNumber)) continue;
+        reportedSkips.add(location.lineNumber);
+        infractions.push({
+          type: "test-skip",
+          file: file.path,
+          ...location,
+          commitHash,
+          commitDate,
+          reason: xfail ? "test marked as expected to fail (pytest.mark.xfail)" : "test skipped by a marker (pytest.mark.skip)"
+        });
+      }
+      if (isTestFile(file.path) || PYTHON_HARNESS_FILE.test(file.path)) {
+        for (const rule of PYTHON_HARNESS_PATTERNS) {
+          for (const match of raw.matchAll(new RegExp(rule.regex.source, "g"))) {
+            if (code[match.index] !== raw[match.index]) continue;
+            infractions.push({ type: "guard-weakened", file: file.path, ...evidence(match.index, match[0].length), commitHash, commitDate, reason: rule.name });
+          }
+        }
+      }
+    }
     if (typescript) {
       const reported = new Set(infractions.slice(firstFinding).filter((f) => f.type === "type-escape").map((f) => f.lineNumber));
       for (const rule of CODE_TYPE_ESCAPE_PATTERNS) {
@@ -1554,7 +1617,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         }
       }
     }
-    if (javascript) {
+    if (javascript2) {
       for (const match of source.matchAll(JS_TEST_API)) {
         let previous = match.index - 1;
         while (previous >= 0 && /\s/.test(source[previous])) previous--;
@@ -1562,15 +1625,16 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         if (match[2] && !isTestFile(file.path)) continue;
         if (/\bfunction$/.test(source.slice(Math.max(0, previous - 8), previous + 1))) continue;
         if (source[match.index + match[0].length] === "
" && !/\.\s*each\s*$/.test(match[3])) continue;
-        if (match[1] === "skip" && !match[3] && isConditionalSkip(source, raw, match.index + match[0].length)) continue;
+        if ((match[1] === "skip" || match[1] === "fixme" || match[1] === "fail") && !match[3] && isConditionalSkip(source, raw, match.index + match[0].length)) continue;
         const focus = match[1] === "only" || match[2] === "fit" || match[2] === "fdescribe";
+        const expectedToFail = match[1] === "failing" || match[1] === "fails" || match[1] === "fail";
         infractions.push({
           type: focus ? "test-focus" : "test-skip",
           file: file.path,
           ...evidence(match.index, match[0].length),
           commitHash,
           commitDate,
-          reason: focus ? "focused test or suite excludes other tests from the run" : `skipped, disabled or placeholder test registration (${match[0].replace(/\s/g, "")})`
+          reason: focus ? "focused test or suite excludes other tests from the run" : expectedToFail ? `test expected to fail, so its failure cannot fail the run (${match[0].replace(/\s/g, "")})` : `skipped, disabled or placeholder test registration (${match[0].replace(/\s/g, "")})`
         });
       }
       if (isTestFile(file.path)) {
@@ -1595,9 +1659,9 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
     }
     for (let index = 0; index < maskedLines.length; index++) {
       const start = maskedLines[index];
-      const inlineExcept = python && /^\s*except(?:\*?\s+[^:]+)?:\s*pass\s*;?\s*$/.test(start.code);
+      const inlineExcept = python2 && /^\s*except(?:\*?\s+[^:]+)?:\s*pass\s*;?\s*$/.test(start.code);
       if (inlineExcept) infractions.push({ type: "swallowed-error", file: file.path, lineNumber: start.number, lineSnippet: start.raw.trim(), commitHash, commitDate, reason: "silent python error swallow (except: pass)" });
-      const isExcept = python && /^\s*except(?:\*?\s+[^:]+)?:\s*$/.test(start.code);
+      const isExcept = python2 && /^\s*except(?:\*?\s+[^:]+)?:\s*$/.test(start.code);
       if (!isExcept) continue;
       let next = index + 1;
       while (next < maskedLines.length && maskedLines[next].number === maskedLines[next - 1].number + 1 && !maskedLines[next].code.trim()) next++;
@@ -3100,6 +3164,351 @@ import path6 from "path";
 
 // src/tampering.ts
 import { createHash as createHash3 } from "crypto";
+
+// src/mocks.ts
+function views(text, language) {
+  const masker = new SourceMasker(language === "js" ? "file.ts" : "file.py");
+  const lines = text.split(/\r?\n/);
+  const code = lines.map((line, index) => masker.mask(line, index + 1).code).join("\n");
+  const starts = [];
+  let offset = 0;
+  for (const line of lines) {
+    starts.push(offset);
+    offset += line.length + 1;
+  }
+  const lineOf2 = (index) => {
+    let low = 0, high = starts.length - 1;
+    while (low < high) {
+      const middle = low + high + 1 >>> 1;
+      if (starts[middle] <= index) low = middle;
+      else high = middle - 1;
+    }
+    return low + 1;
+  };
+  return { raw: lines.join("\n"), code, lines, starts, lineOf: lineOf2 };
+}
+function closing(code, open2) {
+  let depth = 0;
+  for (let i = open2; i < code.length && i - open2 < 2e4; i++) {
+    if (code[i] === "(") depth++;
+    else if (code[i] === ")" && --depth === 0) return i;
+  }
+  return -1;
+}
+var STRING_AFTER = /^\s*(['"`])([^'"`\n]+)\1/;
+var within = (range, index) => !range || index >= range[0] && index <= range[1];
+var innermost = (ranges, index) => ranges.filter((range) => index >= range[0] && index <= range[1]).sort((a, b) => a[1] - a[0] - (b[1] - b[0]))[0] ?? null;
+function javascript(text) {
+  const { raw, code, lines, lineOf: lineOf2 } = views(text, "js");
+  const callbacks = [];
+  for (const match of code.matchAll(/(?<![\w$.])(?:it|test|beforeEach|beforeAll|afterEach|afterAll)(?:\s*\.\s*\w+)*\s*\(/g)) {
+    const open2 = match.index + match[0].length - 1;
+    const end = closing(code, open2);
+    if (end > 0) callbacks.push([open2, end]);
+  }
+  const programLevel = (index) => {
+    let depth = 0;
+    for (let i = 0; i < index; i++) {
+      const char = code[i];
+      if (char === "(" || char === "{" || char === "[") depth++;
+      else if (char === ")" || char === "}" || char === "]") depth--;
+    }
+    return depth === 0;
+  };
+  const mocked = /* @__PURE__ */ new Map();
+  for (const match of code.matchAll(/(?<![\w$.])(?:jest|vi)\s*\.\s*mock\s*\(/g)) {
+    if (!programLevel(match.index)) continue;
+    const open2 = match.index + match[0].length - 1;
+    const specifier = STRING_AFTER.exec(raw.slice(open2 + 1))?.[2];
+    if (!specifier) continue;
+    const end = closing(code, open2);
+    const args = end > 0 ? raw.slice(open2, end) : "";
+    if (/requireActual|importActual|importOriginal/.test(args)) continue;
+    const factory = /^\(\s*(['"`])[^'"`\n]+\1\s*,/.test(args) && !/,\s*\{\s*spy\s*:\s*true\b/.test(args);
+    if (!mocked.has(specifier)) mocked.set(specifier, { index: match.index, fake: factory });
+  }
+  if (!mocked.size) return [];
+  const bindings = /* @__PURE__ */ new Map();
+  const bind = (clause, specifier) => {
+    const named = /\{([^}]*)\}/.exec(clause)?.[1];
+    for (const part of (named ?? "").split(",")) {
+      const item = part.trim().replace(/^type\s+/, "");
+      if (!item) continue;
+      const [imported, local] = item.includes(" as ") ? item.split(/\s+as\s+/) : item.includes(":") ? item.split(/\s*:\s*/) : [item, item];
+      if (/^[\w$]+$/.test(imported) && /^[\w$]+$/.test(local)) bindings.set(local, { specifier, name: imported, namespace: false });
+    }
+    const namespace = /\*\s*as\s+([\w$]+)/.exec(clause)?.[1];
+    if (namespace) bindings.set(namespace, { specifier, name: "*", namespace: true });
+    const standalone = /^\s*([\w$]+)\s*(?:,|$)/.exec(clause.replace(/\{[^}]*\}/, ""))?.[1];
+    if (standalone && standalone !== "type" && !/^\s*\{/.test(clause)) bindings.set(standalone, { specifier, name: "default", namespace: false });
+  };
+  for (const match of code.matchAll(/\bimport\s+([^;'"`]*?)\bfrom\b/g)) {
+    const specifier = STRING_AFTER.exec(raw.slice(match.index + match[0].length))?.[2];
+    if (specifier) bind(match[1], specifier);
+  }
+  for (const match of code.matchAll(/\b(?:const|let|var)\s+(\{[^}]*\}|[\w$]+)\s*=\s*(?:await\s+)?require\s*\(/g)) {
+    const specifier = STRING_AFTER.exec(raw.slice(match.index + match[0].length))?.[2];
+    if (!specifier) continue;
+    if (match[1].startsWith("{")) bind(match[1], specifier);
+    else bindings.set(match[1], { specifier, name: "*", namespace: true });
+  }
+  const found = /* @__PURE__ */ new Map();
+  for (const match of code.matchAll(/(?<![\w$.])expect\s*\(/g)) {
+    const open2 = match.index + match[0].length - 1;
+    const end = closing(code, open2);
+    if (end < 0) continue;
+    const checked = code.slice(open2 + 1, end);
+    let call = /^\s*(?:await\s+)?([A-Za-z_$][\w$]*)\s*(?:\.\s*([A-Za-z_$][\w$]*)\s*)?\(/.exec(checked);
+    const variable = /^\s*([A-Za-z_$][\w$]*)\s*$/.exec(checked)?.[1];
+    if (!call && variable) {
+      const from = innermost(callbacks, match.index)?.[0] ?? 0;
+      const name2 = variable.replace(/\$/g, "\\$");
+      const assigned = [...code.slice(from, match.index).matchAll(new RegExp(`(?<![\\w$.])${name2}\\s*=(?!=)\\s*(?:await\\s+)?([A-Za-z_$][\\w$]*)\\s*(?:\\.\\s*([A-Za-z_$][\\w$]*)\\s*)?\\(`, "g"))].at(-1);
+      if (assigned) call = assigned;
+    }
+    if (!call) continue;
+    const binding = bindings.get(call[1]);
+    const mock = binding && mocked.get(binding.specifier);
+    if (!binding || !mock) continue;
+    const name = binding.namespace ? call[2] : call[2] ? void 0 : binding.name;
+    if (!name) continue;
+    const identifier = call[1].replace(/\$/g, "\\$");
+    const configured = new RegExp(`(?<![\\w$.])${identifier}\\b[^;]{0,80}?\\.\\s*mock(?:Return|Resolved|Rejected|Implementation)\\w*\\s*\\(`).test(raw);
+    if (!mock.fake && !configured) continue;
+    const key = `${binding.specifier}::${name}`;
+    if (found.has(key)) continue;
+    const line = lineOf2(mock.index);
+    found.set(key, {
+      key,
+      line,
+      snippet: lines[line - 1].trim().slice(0, 120),
+      reason: `assertion on the output of ${name}(), which this test replaces with a mock of "${binding.specifier}"`
+    });
+  }
+  return [...found.values()];
+}
+var DOTTED = /^[A-Za-z_][\w.]*$/;
+function python(text) {
+  const { raw, code, lines, starts, lineOf: lineOf2 } = views(text, "py");
+  const alias = /* @__PURE__ */ new Map();
+  for (const match of code.matchAll(/^[ \t]*import\s+([\w.]+)\s+as\s+(\w+)/gm)) alias.set(match[2], match[1]);
+  for (const match of code.matchAll(/^[ \t]*from\s+([\w.]+)\s+import\s+([^\n(]+)/gm)) {
+    for (const part of match[2].split(",")) {
+      const [name, local] = part.trim().split(/\s+as\s+/);
+      if (/^\w+$/.test(name)) alias.set(local || name, `${match[1]}.${name}`);
+    }
+  }
+  const expand = (dotted) => {
+    const [head, ...rest] = dotted.split(".");
+    return rest.length && alias.has(head) ? [alias.get(head), ...rest].join(".") : dotted;
+  };
+  const expandObject = (dotted) => {
+    const [head, ...rest] = dotted.split(".");
+    return alias.has(head) ? [alias.get(head), ...rest].join(".") : dotted;
+  };
+  const codeLines2 = code.split("\n");
+  const indent = (line) => line.length - line.trimStart().length;
+  const functions = [];
+  codeLines2.forEach((line, i) => {
+    if (!/^\s*(?:async\s+)?def\s+\w+/.test(line)) return;
+    let end = i;
+    for (let j = i + 1; j < codeLines2.length; j++) {
+      if (!codeLines2[j].trim()) continue;
+      if (indent(codeLines2[j]) <= indent(line)) break;
+      end = j;
+    }
+    functions.push({ range: [i, end], header: i });
+  });
+  const lineIndex = (offset) => lineOf2(offset) - 1;
+  const scopeOf = (line) => {
+    if (/^\s*@/.test(codeLines2[line] ?? "")) {
+      for (let j = line; j < codeLines2.length && j < line + 40; j++) {
+        const owner = functions.find((fn) => fn.header === j);
+        if (owner) return owner.range;
+      }
+    }
+    return innermost(functions.map((fn) => fn.range), line);
+  };
+  const blockOf = (line) => {
+    if (!/^\s*with\b/.test(codeLines2[line] ?? "")) return null;
+    let end = line;
+    for (let j = line + 1; j < codeLines2.length; j++) {
+      if (!codeLines2[j].trim()) continue;
+      if (indent(codeLines2[j]) <= indent(codeLines2[line])) break;
+      end = j;
+    }
+    return [line, end];
+  };
+  const patched = /* @__PURE__ */ new Map();
+  const patchCall = /(?<![\w.])(?:(?:mock|unittest\s*\.\s*mock)\s*\.\s*)?patch(\s*\.\s*object)?\s*\(|(?<![\w.])mocker\s*\.\s*patch(\s*\.\s*object)?\s*\(|(?<![\w.])monkeypatch\s*\.\s*setattr\s*\(/g;
+  for (const match of code.matchAll(patchCall)) {
+    const open2 = match.index + match[0].length - 1;
+    const end = closing(code, open2);
+    if (end < 0) continue;
+    const args = raw.slice(open2 + 1, end);
+    if (/\bwraps\s*=/.test(args)) continue;
+    const target = STRING_AFTER.exec(args);
+    const parts = target ? null : /^\s*([A-Za-z_][\w.]*)\s*,\s*(['"])(\w+)\2/.exec(args);
+    const key = target ? target[2] : parts ? `${expandObject(parts[1])}.${parts[3]}` : void 0;
+    if (!key || !DOTTED.test(key)) continue;
+    const line = lineIndex(match.index);
+    patched.set(key, [...patched.get(key) ?? [], { index: match.index, scope: blockOf(line) ?? scopeOf(line) }]);
+  }
+  if (!patched.size) return [];
+  const found = /* @__PURE__ */ new Map();
+  const assertion = /^[ \t]*assert\s+(?:not\s+)?([A-Za-z_][\w.]*)\s*(\()?|\bself\s*\.\s*assert\w*\s*\(\s*([A-Za-z_][\w.]*)\s*(\()?/gm;
+  for (const match of code.matchAll(assertion)) {
+    let callee = (match[1] ?? match[3]) && (match[2] ?? match[4]) ? match[1] ?? match[3] : void 0;
+    const variable = !callee ? match[1] ?? match[3] : void 0;
+    if (!callee && variable && /^[A-Za-z_]\w*$/.test(variable)) {
+      const owner = scopeOf(lineIndex(match.index));
+      const from = owner ? starts[owner[0]] ?? 0 : 0;
+      const assigned = [...code.slice(from, match.index).matchAll(new RegExp(`^[ \\t]*${variable}\\s*=(?!=)\\s*(?:await\\s+)?([A-Za-z_][\\w.]*)\\s*\\(`, "gm"))].at(-1);
+      callee = assigned?.[1];
+    }
+    if (!callee) continue;
+    const key = expand(callee);
+    if (found.has(key)) continue;
+    const at = lineIndex(match.index);
+    const patch = patched.get(key)?.find((item) => item.scope && within(item.scope, at) && (at >= lineIndex(item.index) || /^\s*@/.test(codeLines2[lineIndex(item.index)] ?? "")));
+    if (!patch) continue;
+    const line = lineOf2(patch.index);
+    found.set(key, {
+      key,
+      line,
+      snippet: lines[line - 1].trim().slice(0, 120),
+      reason: `assertion on the output of ${callee}(), which this test replaces with a mock`
+    });
+  }
+  return [...found.values()];
+}
+function mockedSubjects(text, file) {
+  if (/mock|monkeypatch/i.test(file)) return [];
+  if (/\.[cm]?[jt]sx?$/i.test(file)) return javascript(text);
+  if (/\.py$/i.test(file)) return python(text);
+  return [];
+}
+
+// src/pyconfig.ts
+function openBrackets(text) {
+  const bare = text.replace(/"(?:\\.|[^"\\\n])*"|'[^'\n]*'/g, '""').replace(/#.*$/gm, "");
+  let depth = 0;
+  for (const char of bare) {
+    if (char === "[" || char === "{") depth++;
+    else if (char === "]" || char === "}") depth--;
+  }
+  return depth;
+}
+function configEntries(text, toml) {
+  const lines = text.split(/\r?\n/);
+  const entries = [];
+  let section = "";
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+    const header = /^\[\[?\s*([^\]]+?)\s*\]\]?\s*(?:[#;].*)?$/.exec(trimmed);
+    if (header) {
+      section = header[1].replace(/["']/g, "");
+      continue;
+    }
+    const pair = /^("[^"]*"|'[^']*'|[\w.-]+)\s*=\s*(.*)$/.exec(trimmed);
+    if (!pair) continue;
+    const start = i;
+    let value = pair[2];
+    if (toml) {
+      while (openBrackets(value) > 0 && i + 1 < lines.length) value += "\n" + lines[++i];
+    } else {
+      while (i + 1 < lines.length && /^\s+\S/.test(lines[i + 1]) && !/^\s*[#;]/.test(lines[i + 1])) value += "\n" + lines[++i].trim();
+    }
+    entries.push({ section, key: pair[1].replace(/["']/g, ""), value, line: start + 1 });
+  }
+  return entries;
+}
+function members(value) {
+  const quoted = [...value.matchAll(/"((?:\\.|[^"\\\n])*)"|'([^'\n]*)'/g)].map((match) => (match[1] ?? match[2]).trim()).filter(Boolean);
+  if (quoted.length) return quoted;
+  return value.replace(/[#;].*$/gm, "").split(/[\s,]+/).map((word) => word.trim()).filter(Boolean);
+}
+function covers(selector, code) {
+  if (selector === "ALL") return true;
+  const wanted = /^([A-Za-z]+)(\d*)$/.exec(selector), actual = /^([A-Za-z]+)(\d*)$/.exec(code);
+  if (!wanted || !actual) return code.startsWith(selector);
+  const linter = (letters) => letters.toUpperCase().replace(/^TCH$/, "TC");
+  return linter(wanted[1]) === linter(actual[1]) && actual[2].startsWith(wanted[2]);
+}
+var truthy = (value) => /^(?:true|1|yes|on)$/i.test(value.replace(/\s*[#;].*$/, "").trim());
+function toolOf(file, section) {
+  const name = section.toLowerCase();
+  if (/(?:^|\/)\.?ruff\.toml$/i.test(file) || name.startsWith("tool.ruff")) return "ruff";
+  if (name === "flake8" || /(?:^|\/)\.flake8$/i.test(file)) return "flake8";
+  if (/messages[ _]control/.test(name)) return "pylint";
+  if (name === "mypy" || name.startsWith("mypy-") || name.startsWith("tool.mypy") || /(?:^|\/)\.?mypy\.ini$/i.test(file)) return "mypy";
+  return null;
+}
+var IGNORE_LISTS = {
+  ruff: /^(?:extend-)?(?:ignore|per-file-ignores)$/,
+  flake8: /^(?:extend[-_])?ignore$|^per[-_]file[-_]ignores$/,
+  pylint: /^disable$/,
+  mypy: /^disable_error_code$/
+};
+var MYPY_SWITCHES = /^(?:strict|disallow_untyped_defs|disallow_incomplete_defs|disallow_untyped_calls|disallow_any_generics|disallow_untyped_decorators|disallow_subclassing_any|check_untyped_defs|warn_return_any|warn_unreachable|warn_redundant_casts|no_implicit_optional|strict_optional)$/;
+var looksLikeCode = (word) => !/[/*:]/.test(word);
+function analyzePythonConfig(file, oldText, newText, report) {
+  const toml = /\.toml$/i.test(file);
+  const before = configEntries(oldText, toml), after = configEntries(newText, toml);
+  const configured = new Set(before.map((entry) => toolOf(file, entry.section)).filter(Boolean));
+  const ignored = (entries) => {
+    const found = /* @__PURE__ */ new Map();
+    for (const entry of entries) {
+      const tool = toolOf(file, entry.section);
+      if (!tool) continue;
+      const perFile = tool === "ruff" ? /per-file-ignores$/i.test(entry.section) : false;
+      if (!perFile && !IGNORE_LISTS[tool].test(entry.key)) continue;
+      const bucket = found.get(tool) ?? /* @__PURE__ */ new Map();
+      found.set(tool, bucket);
+      for (const code of members(entry.value)) if (looksLikeCode(code) && !bucket.has(code)) bucket.set(code, entry.line);
+    }
+    return found;
+  };
+  const was = ignored(before);
+  const enforced = (tool, code) => {
+    if (tool !== "ruff" && tool !== "flake8") return true;
+    const chosen = (key) => before.filter((entry) => toolOf(file, entry.section) === tool && key.test(entry.key)).flatMap((entry) => members(entry.value));
+    const explicit = chosen(/^select$/), extra = chosen(/^extend[-_]select$/);
+    const base = explicit.length ? explicit : tool === "ruff" ? ["E4", "E7", "E9", "F"] : ["E", "F", "W", "C90"];
+    return [...base, ...extra].some((selected2) => covers(selected2, code) || covers(code, selected2));
+  };
+  for (const [tool, bucket] of ignored(after)) {
+    if (!configured.has(tool)) continue;
+    const old = [...was.get(tool)?.keys() ?? []];
+    const fresh = [...bucket].filter(([code]) => !old.some((known) => covers(known, code)) && enforced(tool, code));
+    if (fresh.length) report(Math.min(...fresh.map(([, line]) => line)), `${tool} ignore: ${fresh.slice(0, 4).map(([code]) => "+" + code).join(", ")}${fresh.length > 4 ? ", \u2026" : ""}`, "Lint or type checks switched off in the configuration");
+  }
+  const selected = (entries, tool) => entries.filter((entry) => toolOf(file, entry.section) === tool && entry.key === "select").flatMap((entry) => members(entry.value));
+  for (const tool of ["ruff", "flake8"]) {
+    const old = selected(before, tool), now = selected(after, tool);
+    if (!old.length || !now.length || now.includes("ALL")) continue;
+    const dropped = old.filter((code) => !now.some((kept) => covers(kept, code)));
+    if (dropped.length) {
+      const line = after.find((entry) => toolOf(file, entry.section) === tool && entry.key === "select")?.line ?? 1;
+      report(line, `${tool} select: ${dropped.slice(0, 4).map((code) => "-" + code).join(", ")}${dropped.length > 4 ? ", \u2026" : ""}`, "Lint rules removed from the selected set");
+    }
+  }
+  const switches = new Map(before.filter((entry) => toolOf(file, entry.section) === "mypy" && MYPY_SWITCHES.test(entry.key)).map((entry) => [`${entry.section}|${entry.key}`, truthy(entry.value)]));
+  for (const entry of after) {
+    if (toolOf(file, entry.section) !== "mypy" || !MYPY_SWITCHES.test(entry.key)) continue;
+    if (switches.get(`${entry.section}|${entry.key}`) === true && !truthy(entry.value)) report(entry.line, `mypy ${entry.key}: true \u2192 false`, "Type checker strictness switched off");
+  }
+  const ignoring = (entries) => entries.filter((entry) => toolOf(file, entry.section) === "mypy" && entry.key === "ignore_errors" && truthy(entry.value));
+  const before_ = ignoring(before), after_ = ignoring(after);
+  if (configured.has("mypy") && after_.length > before_.length) {
+    const known = new Set(before_.map((entry) => entry.section));
+    const fresh = after_.find((entry) => !known.has(entry.section)) ?? after_[after_.length - 1];
+    report(fresh.line, `mypy ignore_errors = true (${fresh.section})`, "Type errors ignored for a module");
+  }
+}
+
+// src/tampering.ts
 var EMPTY = { immediate: [], removedTests: [], addedHashes: [], rewritten: [] };
 function languageOf(file) {
   if (/\.(?:[cm]?[jt]sx?)$/i.test(file)) return "js";
@@ -3259,14 +3668,45 @@ function parseTests(text, language) {
 function skeleton(assertion) {
   return assertion.replace(/(['"`])(?:\\.|(?!\1)[^\\])*\1/g, "S").replace(/\b\d+(?:\.\d+)?\b/g, "N").replace(/\b(?:true|false|null|undefined|None|True|False|nil)\b/g, "V").replace(/\s+/g, "");
 }
-var WEAK_JS = /\.(?:toBeDefined|toBeTruthy|toBeFalsy|toBeUndefined)\s*\(|\.not\s*\.\s*(?:toBeNull|toBeUndefined|toThrow)\s*\(|\.toBeGreaterThanOrEqual\s*\(\s*0\s*\)/;
+var WEAK_JS = /\.(?:toBeDefined|toBeTruthy|toBeFalsy|toBeUndefined)\s*\(|\.not\s*\.\s*(?:toBeNull|toBeUndefined|toThrow)\s*\(|\.toBeGreaterThanOrEqual\s*\(\s*0\s*\)|(?<!\.not)\.(?:toHaveBeenCalled|toBeCalled)\s*\(\s*\)|\.(?:toBe|toEqual|toStrictEqual)\s*\(\s*expect\s*\.\s*(?:anything\s*\(\s*\)|any\s*\(\s*\w+\s*\))\s*\)/;
+var BOUND_JS = /\.toBeGreaterThan\s*\(\s*(?:0|-1)\s*\)|\.toBeGreaterThanOrEqual\s*\(\s*[01]\s*\)/;
+var ZERO_JS = /\.(?:toBe|toEqual|toStrictEqual|toHaveLength|toHaveBeenCalledTimes)\s*\(\s*(?:0|\[\s*\]|\{\s*\}|null|undefined|false|"")\s*\)/;
 var WEAK_PY = /^\s*assert\s+[\w.\[\]]+\s*(?:,.*)?$|^\s*assert\s+.+\bis\s+not\s+None\s*(?:,.*)?$|^\s*assert\s+True\b/;
+var BOUND_PY = /^\s*assert\s+.+(?:>\s*0|>=\s*[01])\s*(?:,.*)?$/;
+var EMPTY_PY = /==\s*(?:0|\[\s*\]|\{\s*\}|""|''|None|False)\b|\bis\s+None\b|\bnot\b|!=\s*(?:0|None)\b/;
 var PY_SPECIFIC = /==|!=|<=|>=|\bin\b|\bis\b|\bisinstance\s*\(|\.startswith\s*\(|\.endswith\s*\(|\bcallable\s*\(/;
-var JS_SPECIFIC = /\.(?:toBe|toEqual|toStrictEqual|toHaveLength|toContain|toContainEqual|toMatch|toMatchObject|toHaveProperty|toHaveBeenCalledWith|toHaveBeenCalledTimes|toHaveTextContent|toHaveAttribute|toHaveValue|toThrow\w*|toBeGreaterThan\w*|toBeLessThan\w*)\s*\(/;
+var JS_SPECIFIC = /\.(?:toBe|toEqual|toStrictEqual|toHaveLength|toContain|toContainEqual|toMatch|toMatchObject|toHaveProperty|toHaveBeenCalledWith|toHaveBeenLastCalledWith|toHaveBeenNthCalledWith|toBeCalledWith|toHaveBeenCalledTimes|toHaveBeenCalledOnce|toHaveTextContent|toHaveAttribute|toHaveValue|toThrow\w*|toBeGreaterThan\w*|toBeLessThan\w*)\s*\(/;
 var THROWING_QUERY = /\b(?:get|find)(?:All)?By\w*\s*\(/;
+function pinsLess(oldAssertion, newAssertion, language) {
+  if (language === "js") {
+    const was = /\.toThrow(?:Error)?\s*\(\s*([^)\s][^)]*)\)/.exec(oldAssertion);
+    const now = /\.toThrow(?:Error)?\s*\(\s*([^)]*)\)/.exec(newAssertion);
+    return !!was && !!now && (now[1].trim() === "" || now[1].trim() === "Error" && was[1].trim() !== "Error");
+  }
+  if (language === "py") {
+    const raised = (text) => {
+      const captured = /\)\s*as\s+\w+/.test(text);
+      const marker = /\bpytest\s*\.\s*raises\s*\(\s*([\w.]+|\([^)]*\))([^)]*)\)/.exec(text);
+      if (marker) return { type: marker[1], message: /\bmatch\s*=/.test(marker[2]), captured };
+      const unit = /\bassertRaises(Regex)?\s*\(\s*([\w.]+|\([^)]*\))/.exec(text);
+      return unit ? { type: unit[2], message: !!unit[1], captured } : null;
+    };
+    const was = raised(oldAssertion), now = raised(newAssertion);
+    const broad = (type) => /^(?:builtins\.)?(?:Base)?Exception$/.test(type);
+    return !!was && !!now && (was.message && !now.message && !now.captured || !broad(was.type) && broad(now.type));
+  }
+  return false;
+}
 function isWeaker(oldAssertion, newAssertion, language) {
-  if (language === "js") return !THROWING_QUERY.test(newAssertion) && WEAK_JS.test(newAssertion) && !WEAK_JS.test(oldAssertion) && JS_SPECIFIC.test(oldAssertion);
-  if (language === "py") return WEAK_PY.test(newAssertion) && !WEAK_PY.test(oldAssertion) && PY_SPECIFIC.test(oldAssertion);
+  if (pinsLess(oldAssertion, newAssertion, language)) return true;
+  if (language === "js") {
+    if (THROWING_QUERY.test(newAssertion) || !JS_SPECIFIC.test(oldAssertion) || WEAK_JS.test(oldAssertion) || BOUND_JS.test(oldAssertion)) return false;
+    return WEAK_JS.test(newAssertion) || BOUND_JS.test(newAssertion) && !ZERO_JS.test(oldAssertion);
+  }
+  if (language === "py") {
+    if (WEAK_PY.test(oldAssertion) || BOUND_PY.test(oldAssertion) || !PY_SPECIFIC.test(oldAssertion)) return false;
+    return WEAK_PY.test(newAssertion) || BOUND_PY.test(newAssertion) && !EMPTY_PY.test(oldAssertion) && /==|\bin\b|[<>]=?/.test(oldAssertion);
+  }
   return false;
 }
 var GENERIC_ARGUMENT = /^(?:not\.)?(?:be|have|contain|include|exist|match|eq|equal|length|text|value|attr|class|css|visible|checked|disabled|enabled|selected|focus|empty|true|false|null|undefined|deep)(?:\.\w+)*$/;
@@ -3301,6 +3741,10 @@ function analyzeTestFile(oldPath, newPath, oldText, newText, commit) {
   const addedText = after.filter((test) => !beforeKeys.has(test.key)).map((test) => test.text).join("\n");
   const result = { immediate: [], removedTests: [], addedHashes: [], rewritten: [] };
   for (const test of after) if (!beforeKeys.has(test.key)) result.addedHashes.push(test.bodyHash);
+  const mockedBefore = new Set((oldText === null ? [] : mockedSubjects(oldText, oldPath)).map((item) => item.key));
+  for (const item of newText === null ? [] : mockedSubjects(newText, newPath)) {
+    if (!mockedBefore.has(item.key)) result.immediate.push(finding("trivial-assert", newPath, item.line, item.snippet, item.reason, commit));
+  }
   for (const old of before) {
     const current = afterByKey.get(old.key);
     if (!current) {
@@ -3349,7 +3793,20 @@ ${addedText}`;
       continue;
     }
     if (current.assertions.length === old.assertions.length && old.assertions.length > 0) {
-      const changed = old.assertions.map((assertion, i) => ({ before: assertion, after: current.assertions[i], rawBefore: old.raw[i], rawAfter: current.raw[i] })).filter((pair) => pair.before !== pair.after);
+      const left = (from, against) => {
+        const budget = /* @__PURE__ */ new Map();
+        for (const assertion of against) budget.set(assertion, (budget.get(assertion) ?? 0) + 1);
+        return from.map((assertion, i) => ({ assertion, i })).filter(({ assertion }) => {
+          const available = budget.get(assertion) ?? 0;
+          if (available > 0) {
+            budget.set(assertion, available - 1);
+            return false;
+          }
+          return true;
+        }).map(({ i }) => i);
+      };
+      const goneIndexes = left(old.assertions, current.assertions), freshIndexes = left(current.assertions, old.assertions);
+      const changed = goneIndexes.map((index, k) => ({ before: old.assertions[index], after: current.assertions[freshIndexes[k]], rawBefore: old.raw[index], rawAfter: current.raw[freshIndexes[k]] })).filter((pair) => pair.after !== void 0);
       const weaker = changed.find((pair) => isWeaker(pair.rawBefore, pair.rawAfter, language));
       if (weaker) {
         result.immediate.push(finding(
@@ -3382,7 +3839,58 @@ function resolveTampering(files, productionChanged) {
     ...productionChanged ? files.flatMap((file) => file.rewritten) : []
   ];
 }
-var GUARD_FILE = /(?:^|\/)(?:package\.json|tsconfig[^/]*\.json|jsconfig\.json|(?:jest|vitest|vite)\.config\.[cm]?[jt]s|\.eslintrc(?:\.[a-z]+)?|eslint\.config\.[cm]?[jt]s|pyproject\.toml|setup\.cfg|pytest\.ini|tox\.ini|\.coveragerc|codecov\.ya?ml|\.gitlab-ci\.ya?ml|\.github\/workflows\/[^/]+\.ya?ml)$/i;
+function isKnownFailureMarker(finding2) {
+  return finding2.type === "test-skip" && /\bxfail\b|\bexpectedFailure\b|\bfixme\b|expected to fail/i.test(finding2.reason);
+}
+function markedTest(finding2, lines) {
+  const snippet = finding2.lineSnippet ?? "";
+  const index = (finding2.lineNumber ?? 1) - 1;
+  if (/\.py$/i.test(finding2.file ?? "")) {
+    if (/^\s*pytestmark\b/.test(snippet)) return null;
+    if (/imperative/.test(finding2.reason)) {
+      const indent = (lines[index] ?? "").search(/\S/);
+      for (let i = index - 1; i >= 0 && i > index - 200; i--) {
+        const def = /^(\s*)(?:async\s+)?def\s+(\w+)\s*\(/.exec(lines[i]);
+        if (def && def[1].length < indent) return { key: `py:${def[2]}`, title: def[2] };
+      }
+      return null;
+    }
+    for (let i = index; i < lines.length && i < index + 80; i++) {
+      const def = /^\s*(?:async\s+)?def\s+(\w+)\s*\(/.exec(lines[i]);
+      if (def) return { key: `py:${def[1]}`, title: def[1] };
+    }
+    return null;
+  }
+  if (/\.each\b/.test(snippet)) return null;
+  const title = /(['"`])((?:\\.|(?!\1)[^\\\n])+)\1/.exec(snippet);
+  return title ? { key: `js:${title[0]}`, title: title[0] } : null;
+}
+function newKnownFailureMarkers(before, after, oldText, newText) {
+  const markers = after.filter(isKnownFailureMarker);
+  if (!markers.length || oldText === null) return [];
+  const oldLines = oldText.split(/\r?\n/), newLines = (newText ?? "").split(/\r?\n/);
+  const existed = (test) => test.key.startsWith("py:") ? new RegExp(`^\\s*(?:async\\s+)?def\\s+${test.title}\\s*\\(`, "m").test(oldText) : oldText.includes(test.title);
+  const markedBefore = /* @__PURE__ */ new Set();
+  let unnamedBefore = 0;
+  for (const finding2 of before.filter(isKnownFailureMarker)) {
+    const test = markedTest(finding2, oldLines);
+    if (test) markedBefore.add(test.key);
+    else unnamedBefore++;
+  }
+  const found = [], unnamed = [], seen = /* @__PURE__ */ new Set();
+  for (const finding2 of markers) {
+    const test = markedTest(finding2, newLines);
+    if (!test) {
+      unnamed.push(finding2);
+      continue;
+    }
+    if (markedBefore.has(test.key) || seen.has(test.key) || !existed(test)) continue;
+    seen.add(test.key);
+    found.push(finding2);
+  }
+  return [...found, ...unnamed.slice(unnamedBefore)];
+}
+var GUARD_FILE = /(?:^|\/)(?:package\.json|tsconfig[^/]*\.json|jsconfig\.json|(?:jest|vitest|vite)\.config\.[cm]?[jt]s|\.eslintrc(?:\.[a-z]+)?|eslint\.config\.[cm]?[jt]s|pyproject\.toml|setup\.cfg|pytest\.ini|tox\.ini|\.?ruff\.toml|\.flake8|\.?mypy\.ini|\.?pylintrc|\.coveragerc|codecov\.ya?ml|\.gitlab-ci\.ya?ml|\.github\/workflows\/[^/]+\.ya?ml)$/i;
 function isGuardFile(file) {
   return GUARD_FILE.test(file);
 }
@@ -3403,9 +3911,13 @@ function numbers(text, pattern) {
 var THRESHOLD_PATTERNS = [
   /\b(lines|branches|functions|statements)\b["']?\s*[:=]\s*(\d+(?:\.\d+)?)/g,
   /\b(fail_under)\s*[:=]\s*(\d+(?:\.\d+)?)/g,
-  /(--cov-fail-under)[= ](\d+(?:\.\d+)?)/g
+  /(--cov-fail-under)[= ](\d+(?:\.\d+)?)/g,
+  // `coverage report --fail-under=90` on a command line, and pylint's `fail-under=9.5` in its own config (a lint score).
+  /(?<![\w-])(--fail-under)[= ](\d+(?:\.\d+)?)/g,
+  /(?<![\w-])(fail-under)\s*[:=]\s*(\d+(?:\.\d+)?)/g
 ];
 var SWITCHES = ["strict", "noImplicitAny", "strictNullChecks", "noImplicitReturns", "useUnknownInCatchVariables"];
+var GATE_SCRIPT = /^(?:pre|post)?(?:test|lint|typecheck|type-check|check|ci|verify|validate)(?::[\w:.-]+)?$/;
 var CI_RUNNER = new RegExp(
   String.raw`(?<![\w./-])(?:pytest|vitest|jest|mocha|tox|nox)(?![\w/-])` + String.raw`|(?<![\w./-])(?:npm|yarn|pnpm|bun|go|cargo|mvn|gradle|make|dotnet|flutter)\s+(?:run\s+)?(?:-\S+\s+)*test(?![\w/])` + String.raw`|\brun:.*(?<=\s)(?:tests?|unit|e2e)(?![\w/.-])`
 );
@@ -3430,7 +3942,8 @@ function resolveCiTestSteps(counts, commit) {
   if (after >= before) return [];
   return counts.filter((item) => item.before > 0 && item.after === 0 && item.reusableAfter === 0).map((item) => item.ungatedAfter > 0 ? finding("guard-weakened", item.file, 1, "tests no longer run on push or pull_request", "Workflow keeps its tests but no longer runs on pushes or pull requests", commit) : finding("guard-weakened", item.file, 1, "test command no longer runs in CI", "Test step removed from CI", commit));
 }
-var LENIENT = /continue-on-error:\s*true|allow_failure:\s*true/;
+var LENIENT = /continue-on-error:\s*true|allow_failure:\s*true|^\s*(?:-\s+)?if:\s*(?:\$\{\{\s*)?false\s*(?:\}\})?\s*(?:#.*)?$/;
+var SHELL_SWALLOW = /\|\|\s*(?:true|exit\s+0|:|echo\b)|;\s*(?:true|exit\s+0)\b/;
 function lenientSteps(text) {
   const lines = text.split(/\r?\n/);
   const indentOf = (line) => line.length - line.trimStart().length;
@@ -3438,8 +3951,15 @@ function lenientSteps(text) {
   lines.forEach((line, i) => {
     if (line.trim().startsWith("#") || !LENIENT.test(line)) return;
     let j = i - 1;
-    while (j >= 0 && (!lines[j].trim() || lines[j].trim().startsWith("#") || indentOf(lines[j]) >= indentOf(line))) j--;
-    const identity = j >= 0 ? lines[j].trim() : "";
+    let identity;
+    if (/^\s*-\s+if:/.test(line)) {
+      j = i + 1;
+      while (j < lines.length && (!lines[j].trim() || lines[j].trim().startsWith("#"))) j++;
+      identity = j < lines.length ? lines[j].trim() : "";
+    } else {
+      while (j >= 0 && (!lines[j].trim() || lines[j].trim().startsWith("#") || indentOf(lines[j]) >= indentOf(line))) j--;
+      identity = j >= 0 ? lines[j].trim() : "";
+    }
     const entry = found.get(identity);
     if (entry) entry.count++;
     else found.set(identity, { count: 1, line: i + 1 });
@@ -3453,22 +3973,25 @@ function analyzeGuardFile(file, oldText, newText, commit) {
   if (oldText === null || newText === null) return [];
   const out = [];
   const add = (index, snippet, reason) => out.push(finding("guard-weakened", file, lineOf(newText, index), snippet, reason, commit));
-  if (/threshold|fail_under|cov-fail-under|coverage/i.test(newText)) {
+  if (/threshold|fail[_-]under|coverage/i.test(newText)) {
     for (const pattern of THRESHOLD_PATTERNS) {
       const old = new Map(numbers(oldText, pattern).map((item) => [item.key, item.value]));
       for (const item of numbers(newText, pattern)) {
         const previous = old.get(item.key);
         if (previous !== void 0 && item.value < previous) {
-          add(item.index, `${item.key.split("#")[0]}: ${previous} \u2192 ${item.value}`, "Coverage threshold lowered");
+          add(item.index, `${item.key.split("#")[0]}: ${previous} \u2192 ${item.value}`, item.key.startsWith("fail-under#") ? "Lint score threshold lowered" : "Coverage threshold lowered");
         }
       }
     }
   }
   if (/(?:^|\/)(?:tsconfig|jsconfig)[^/]*\.json$/i.test(file)) {
+    const setting = (text, name) => new RegExp(`"${name}"\\s*:\\s*(true|false)`).exec(text);
+    const strictBefore = setting(oldText, "strict")?.[1] === "true";
     for (const name of SWITCHES) {
-      const pattern = new RegExp(`"${name}"\\s*:\\s*(true|false)`);
-      const before = pattern.exec(oldText), after = pattern.exec(newText);
-      if (before?.[1] === "true" && after?.[1] === "false") add(after.index, `${name}: true \u2192 false`, "Compiler strictness switched off");
+      const before = setting(oldText, name), after = setting(newText, name);
+      if (after?.[1] === "false" && (before?.[1] === "true" || before === null && strictBefore && name !== "strict")) {
+        add(after.index, `${name}: ${before ? "true \u2192 false" : "false (strict stays on)"}`, "Compiler strictness switched off");
+      }
     }
   }
   if (/eslint/i.test(file)) {
@@ -3488,20 +4011,50 @@ function analyzeGuardFile(file, oldText, newText, commit) {
       if (previous && previous.level === 2 && now.level < 2 && !replaced) add(now.index, `${name}: error \u2192 ${now.level ? "warn" : "off"}`, "Lint rule downgraded");
     }
   }
+  if (/(?:^|\/)(?:pytest\.ini|tox\.ini|setup\.cfg|pyproject\.toml)$/i.test(file)) {
+    const strictness = (text) => /^[ \t]*xfail_strict[ \t]*=[ \t]*(true|false|1|0|yes|no|on|off)\b/im.exec(text);
+    const before = strictness(oldText), after = strictness(newText);
+    if (before && after && /^(?:true|1|yes|on)$/i.test(before[1]) && /^(?:false|0|no|off)$/i.test(after[1])) {
+      add(after.index, "xfail_strict: true \u2192 false", "Strict xfail switched off");
+    }
+  }
+  if (/(?:^|\/)(?:pyproject\.toml|setup\.cfg|tox\.ini|\.?ruff\.toml|\.flake8|\.?mypy\.ini|\.?pylintrc)$/i.test(file)) {
+    analyzePythonConfig(file, oldText, newText, (line, snippet, reason) => {
+      out.push(finding("guard-weakened", file, line, snippet, reason, commit));
+    });
+  }
   if (CI_FILE.test(file)) {
-    const before = lenientSteps(oldText), existing = new Set(oldText.split(/\r?\n/).map((line) => line.trim()));
-    for (const [identity, now] of lenientSteps(newText)) {
-      if (identity && existing.has(identity) && now.count > (before.get(identity)?.count ?? 0)) {
-        out.push(finding("guard-weakened", file, now.line, "continue-on-error: true", "CI step is now allowed to fail", commit));
+    const before = lenientSteps(oldText), existing = new Set(oldText.split(/\r?\n/).flatMap((line) => [line.trim(), line.trim().replace(/^-\s+/, "")]));
+    const newLines = newText.split(/\r?\n/);
+    for (const [identity, now2] of lenientSteps(newText)) {
+      if (identity && existing.has(identity) && now2.count > (before.get(identity)?.count ?? 0)) {
+        const marker = (newLines[now2.line - 1] ?? "").trim();
+        out.push(finding("guard-weakened", file, now2.line, marker, /^(?:-\s+)?if:/.test(marker) ? "CI step is now switched off" : "CI step is now allowed to fail", commit));
         break;
       }
     }
+    const swallowing = (text) => text.split(/\r?\n/).map((line, index) => ({ line: line.trim(), index })).filter((item) => !item.line.startsWith("#") && CI_RUNNER.test(item.line) && SHELL_SWALLOW.test(item.line));
+    const was = swallowing(oldText), now = swallowing(newText);
+    const tolerance = (text) => text.split(/\r?\n/).filter((line) => !line.trim().startsWith("#") && /continue-on-error:\s*true|allow_failure:\s*true/.test(line)).length;
+    const traded = Math.max(0, tolerance(oldText) - tolerance(newText));
+    if (now.length > was.length + traded) {
+      const known = new Set(was.map((item) => item.line));
+      const fresh = now.find((item) => !known.has(item.line)) ?? now[0];
+      out.push(finding("guard-weakened", file, fresh.index + 1, fresh.line.slice(0, 80), "Test command can no longer fail the CI step", commit));
+    }
   }
   if (/(?:^|\/)package\.json$/i.test(file)) {
     try {
-      const before = JSON.parse(oldText)?.scripts?.test, after = JSON.parse(newText)?.scripts?.test;
-      if (typeof before === "string" && typeof after === "string" && before !== after && (/^\s*(?:echo\b|true\b|exit\s+0|:)/.test(after) || /\|\|\s*(?:true|exit\s+0)\b/.test(after) || /--passWithNoTests/.test(after) && !/--passWithNoTests/.test(before))) {
-        add(Math.max(0, newText.indexOf('"test"')), `test: ${after}`, "Test script can no longer fail");
+      const before = JSON.parse(oldText)?.scripts, after = JSON.parse(newText)?.scripts;
+      const noop = (script) => /^\s*(?:echo\b|true\b|exit\s+0|:)/.test(script) || /\|\|\s*(?:true|exit\s+0)\b/.test(script);
+      if (before && after) for (const name of Object.keys(after)) {
+        const was = before[name], now = after[name];
+        if (!GATE_SCRIPT.test(name) || typeof was !== "string" || typeof now !== "string" || was === now) continue;
+        const tests = /^(?:pre|post)?test(?::|$)/.test(name);
+        if (noop(now) && !noop(was) || tests && /--passWithNoTests/.test(now) && !/--passWithNoTests/.test(was)) {
+          add(Math.max(0, newText.indexOf(`"${name}"`)), `${name}: ${now}`, tests ? "Test script can no longer fail" : `The ${name} script can no longer fail`);
+          break;
+        }
       }
     } catch {
     }
@@ -3668,7 +4221,7 @@ async function compareSnapshot(options, cwd, snapshot) {
         const fingerprint = findingFingerprint(finding2);
         existingCounts.set(fingerprint, (existingCounts.get(fingerprint) ?? 0) + 1);
       }
-      result.infractions.push(...compared.introduced);
+      result.infractions.push(...compared.introduced.filter((finding2) => !isKnownFailureMarker(finding2)), ...newKnownFailureMarkers(before, after, oldText, newText));
       result.removedFindings.push(...compared.removed);
       result.unchangedCount += compared.unchanged;
       result.beforeFindings += before.length;

package/dist/cli.js

@@ -38,7 +38,7 @@ import {
   terminalText,
   uninstallHooks,
   writeBaseline
-} from "./chunk-MZBP537U.js";
+} from "./chunk-52FUQ4EP.js";
 
 // src/cli.ts
 import { Command } from "commander";

package/dist/index.js

@@ -91,7 +91,7 @@ import {
   unquoteGitPath,
   validateExceptions,
   writeBaseline
-} from "./chunk-MZBP537U.js";
+} from "./chunk-52FUQ4EP.js";
 export {
   AGENT_LABELS,
   CONFIG_FILENAMES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-roast",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Stops AI coding agents (and rushed humans) from turning a build green by weakening tests, coverage gates or CI. Hook for Claude Code, Codex and Cursor, pre-commit, GitHub Action. Offline.",
   "mcpName": "io.github.Nari-Ab/agent-roast",
   "type": "module",