canary-test-cli 7.0.0 → 7.2.0

package/agents/skills/claude-code/canary-savant/scripts/rules.mjs

@@ -0,0 +1,168 @@
+// Static suspect-rule catalog for canary-savant Tier-1 (pure data).
+//
+// Tier-1 flags the shared-state smells that *predict* order-dependent tests
+// without executing anything: a module-level mutable that a test writes to, a
+// setup with no matching teardown, a mutated process singleton, an
+// order-coupled name. It is advisory: a smell is a suspect, not a proven leak.
+// The dynamic confirmer (Tier-2, opt-in) is what turns a suspect into a named
+// polluter.
+//
+// The detection logic lives in scanner.mjs; this module holds the metadata
+// (id, severity, one-line rationale) each finding carries and the regexes the
+// scanner tests against. JS has no verbose-regex flag, so patterns are compact
+// literals documented by the comment above them.
+
+export const SEVERITIES = ['high', 'medium', 'low'];
+
+/** @typedef {{ruleId: string, severity: string, why: string}} Rule */
+
+/** @type {Rule[]} */
+export const RULES = [
+  {
+    ruleId: 'SV001-module-mutable-global',
+    severity: 'medium',
+    why:
+      'a module-level mutable is written by a test, so state leaks into ' +
+      'whatever test runs next',
+  },
+  {
+    ruleId: 'SV002-missing-teardown',
+    severity: 'medium',
+    why:
+      'setup acquires state with no matching teardown, so the state outlives ' +
+      'the test that created it',
+  },
+  {
+    ruleId: 'SV003-shared-singleton-mutation',
+    severity: 'low',
+    why:
+      'a process-global singleton is mutated without restore, so the change ' +
+      'persists across tests',
+  },
+  {
+    ruleId: 'SV004-order-coupled-name',
+    severity: 'low',
+    why:
+      'the name or comment encodes an execution order, a self-reported ' +
+      'dependence on another test running first',
+  },
+];
+
+export const WHY = Object.fromEntries(RULES.map((r) => [r.ruleId, r.why]));
+export const SEVERITY = Object.fromEntries(
+  RULES.map((r) => [r.ruleId, r.severity]),
+);
+
+// SV003: singleton / env mutation (assignment, never a read or comparison).
+// A trailing negative lookahead on `=` keeps `==` comparisons out. One entry
+// per process-global family (#493): `assign` detects the mutation (and, in a
+// teardown region, the restore); `deletes` and `restoreAll` are restore-only
+// idioms. Group 1/2 of `assign` and `deletes` capture the key (dot-property
+// or bracket expression) so restoration.mjs can match restores per key.
+//   os.environ['X'] = ... | sys.modules['m'] = ... | process.env.X = ...
+//   | process.env['X'] = ...
+export const SINGLETON_FAMILIES = [
+  {
+    id: 'process.env',
+    token: 'process\\.env',
+    assign: /\bprocess\.env\s*(?:\.(\w+)|\[([^\]]+)\])\s*=(?!=)/,
+    deletes: [/\bdelete\s+process\.env\s*(?:\.(\w+)|\[([^\]]+)\])/],
+    restoreAll: [/\bObject\.assign\s*\(\s*process\.env\s*,/],
+  },
+  {
+    id: 'os.environ',
+    token: 'os\\.environ',
+    assign: /\bos\.environ\s*\[([^\]]+)\]\s*=(?!=)/,
+    deletes: [
+      /\bdel\s+os\.environ\s*\[([^\]]+)\]/,
+      /\bos\.environ\.pop\s*\(\s*([^,)]+)/,
+    ],
+    restoreAll: [/\bos\.environ\.(?:update|clear)\s*\(/],
+  },
+  {
+    id: 'sys.modules',
+    token: 'sys\\.modules',
+    assign: /\bsys\.modules\s*\[([^\]]+)\]\s*=(?!=)/,
+    deletes: [
+      /\bdel\s+sys\.modules\s*\[([^\]]+)\]/,
+      /\bsys\.modules\.pop\s*\(\s*([^,)]+)/,
+    ],
+    restoreAll: [/\bsys\.modules\.update\s*\(/],
+  },
+];
+
+// SV004: order-coupled name or comment (fires on code and comment lines).
+// Split in two (#493) because the alternatives anchor differently:
+//
+// CODE-anchored: the token is source code in real usage, so a match starting
+// inside a string literal is fixture data and is rejected.
+//   def test_1_...            -> ordinal-indexed test
+//   def test_first / test_last(_more)  -> ordinal test name (not test_firstname)
+//   it('... run first')       -> ordering inside an it() title (anchor: `it(`)
+export const SV004_CODE_PATTERN =
+  /\bdef\s+test_\d+_|\bdef\s+test_(?:first|second|third|fourth|fifth|sixth|seventh|last|initial|final)\s*[(:]|\bit\s*\(\s*['"][^'"]*\b(?:run|runs|running)\s+(?:first|last|before|after)\b/i;
+//
+// TEXT-anchored: the directive legitimately lives inside strings (test
+// titles, docstrings) and comments, so it is NOT string-literal filtered.
+//   "must run before ..."     -> self-reported ordering note
+//   "runs before ..."
+export const SV004_TEXT_PATTERN =
+  /\bmust\s+run\s+(?:before|after|first|last)\b|\bruns?\s+(?:before|after)\b/i;
+
+// SV002: framework-conditioned setup/teardown pairs. Only CLASS/ALL-scoped
+// setup is included: it manages state shared across a class's tests, so a
+// missing teardown genuinely leaks. Per-test setup (setUp / setup_method /
+// beforeEach) rebuilds state for each test, so a missing teardown there is not a
+// leak - and firing on it was the dominant false positive when dogfooding on
+// canary's own suite (Phase 5). A setup present without its teardown fires.
+export const PYTHON_SETUP_TEARDOWN = [
+  ['setup_class', 'teardown_class'],
+  ['setUpClass', 'tearDownClass'],
+];
+export const JS_SETUP_TEARDOWN = [['beforeAll', 'afterAll']];
+
+// SV001: mutable-literal declarations and the mutations that indict them.
+//   Python:  NAME = {} | [] | set() | dict() | list()   (optional trailing #comment)
+export const PY_MODULE_MUTABLE =
+  /^(\w+)\s*=\s*(?:\{[^}]*\}|\[[^\]]*\]|set\(\)|dict\(\)|list\(\))\s*(?:#.*)?$/;
+//   JS: (let|var|const) NAME = {} | []
+export const JS_MODULE_MUTABLE =
+  /^(?:let|var|const)\s+(\w+)\s*=\s*(?:\{[^}]*\}|\[[^\]]*\])/;
+
+// Method calls that mutate a container in place (Python + JS array/object).
+const MUTATING_METHODS = [
+  'append',
+  'add',
+  'update',
+  'extend',
+  'insert',
+  'pop',
+  'clear',
+  'setdefault',
+  'remove',
+  'discard',
+  'push',
+  'unshift',
+  'splice',
+];
+
+const RE_META = /[.*+?^${}()|[\]\\]/g;
+const escapeRe = (s) => s.replace(RE_META, '\\$&');
+
+/**
+ * A pattern matching an in-place mutation of `name`
+ * (index assign, mutating method, +=, or attribute/property set).
+ * @param {string} name
+ * @returns {RegExp}
+ */
+export function mutationPattern(name) {
+  const n = escapeRe(name);
+  const methods = MUTATING_METHODS.join('|');
+  // \bNAME[...] = ... | \bNAME.method( | \bNAME += | \bNAME.attr = ...
+  return new RegExp(
+    `\\b${n}\\s*\\[[^\\]]*\\]\\s*=(?!=)` +
+      `|\\b${n}\\s*\\.\\s*(?:${methods})\\s*\\(` +
+      `|\\b${n}\\s*\\+=` +
+      `|\\b${n}\\s*\\.\\w+\\s*=(?!=)`,
+  );
+}