canary-test-cli 7.2.0 → 8.0.0

package/dist/engine/core/vacuity-scanner.js

@@ -375,13 +375,31 @@ function braceDepths(code) {
 function declEnd(code, matches, i, depth) {
     if (depth === null)
         return matches[i + 1]?.index ?? code.length;
-    const own = depth[matches[i].index] ?? 0;
+    const m = matches[i];
+    const own = depth[m.index] ?? 0;
+    let sibling = code.length;
     for (let j = i + 1; j < matches.length; j += 1) {
         const at = matches[j].index;
-        if ((depth[at] ?? 0) <= own)
-            return at;
+        if ((depth[at] ?? 0) <= own) {
+            sibling = at;
+            break;
+        }
+    }
+    // A `function` owns the text up to its next sibling. A `const`/`let`/`var`
+    // owns only its initializer (#871): inside a test body there is usually no
+    // later sibling, so bounding a bystander at one let it absorb the target
+    // call below it and read as reaching the target, silencing VAC-003. The
+    // statement ends at the first `;` or line break at the declaration's own
+    // brace depth, so an arrow helper's braced body still belongs to it.
+    if (m[1])
+        return sibling;
+    const from = m.index + m[0].length;
+    for (let k = from; k < sibling; k += 1) {
+        const ch = code[k];
+        if ((ch === ';' || ch === '\n') && (depth[k] ?? 0) <= own)
+            return k;
     }
-    return code.length;
+    return sibling;
 }
 /**
  * Grow `targets` with local declarations that themselves reach a target, to a
@@ -513,6 +531,7 @@ function scanBlock(code, block, file, python, reaching, annotated, skipped, outO
         ...tautologies(lines, block, file, python),
         ...targetNeverInvoked(block, file, reaching, annotated, outOfBand),
         ...absenceOnly(lines, block, file, python, targets, skipped),
+        ...presenceOnBystander(lines, block, file, python, targets),
     ];
 }
 /**
@@ -580,6 +599,20 @@ function targetNeverInvoked(block, file, reaching, annotated, outOfBand) {
  * the write. Reported at the first absence assertion, the line an author adds a
  * precondition next to.
  */
+/**
+ * A test title safe to put in a skip label: its first line, capped at 80.
+ *
+ * The title parser can mis-read a declaration and hand back the source after
+ * it (#860 -- whole `describe` bodies reached the summary line). Bounding the
+ * label here means a parser slip degrades to a truncated name, never a flood.
+ */
+export function boundedTitle(name) {
+    const first = name.split('\n', 1)[0].trim();
+    return first.length > 80 ? `${first.slice(0, 80)}…` : first;
+}
+function skipLabel(rules, file, block) {
+    return `${file}:${block.line} ${rules} (${boundedTitle(block.name)})`;
+}
 function absenceOnly(lines, block, file, python, targets, skipped) {
     if (targets === null)
         return [];
@@ -592,7 +625,7 @@ function absenceOnly(lines, block, file, python, targets, skipped) {
         // assertion style is one the vocabulary does not know. Both are "cannot
         // verify", so both are recorded rather than passed over in silence.
         skipped.push({
-            name: `VAC-003 (${block.name})`,
+            name: skipLabel('VAC-003', file, block),
             reason: 'no recognised assertion, so absence-only could not be judged -- the test may assert nothing (LINT-006) or use an unrecognised assertion style',
         });
         return [];
@@ -605,6 +638,118 @@ function absenceOnly(lines, block, file, python, targets, skipped) {
         mk(file, assertions[0].line, 'VAC-003', 'warning', block.name, 'Every assertion in this test asserts an absence, and none of them observes the target.', 'Add one assertion proving the operation actually ran (exit code, returned value, a positive existence) -- otherwise the test passes identically when the code crashed before doing anything.'),
     ];
 }
+/**
+ * Presence matchers that a value the test built for itself satisfies before the
+ * target ever runs. The negated-null forms belong here too, but on their own they
+ * also match `ABSENCE_ASSERTION` (via `.not.to*`), so an all-negated test stays
+ * VAC-003's -- see {@link presenceOnBystander}.
+ */
+const TRIVIAL_PRESENCE_JS = /\.toBeDefined\s*\(\s*\)|\.toBeTruthy\s*\(\s*\)|\.not\s*\.\s*(?:toBeNull|toBeUndefined|toBeFalsy)\s*\(\s*\)/;
+const TRIVIAL_PRESENCE_PY = /^assert\s+([A-Za-z_][\w.]*?)(?:\s+is\s+not\s+None)?\s*(?:,|$)/;
+const SUBJECT_ROOT = /^([A-Za-z_$][\w$]*)(?:\.[A-Za-z_$][\w$]*)*$/;
+function subjectRoot(expr) {
+    return expr ? (SUBJECT_ROOT.exec(normalize(expr))?.[1] ?? null) : null;
+}
+/** The root identifier a trivial presence assertion observes, or null. */
+function presenceSubject(text, python) {
+    const t = text.trim();
+    if (python)
+        return subjectRoot(TRIVIAL_PRESENCE_PY.exec(t)?.[1]);
+    return TRIVIAL_PRESENCE_JS.test(t) ? subjectRoot(expectArgument(t)) : null;
+}
+/**
+ * Every binding of a name inside the body: `const x = rhs` / `x = rhs` (JS) or
+ * `x = rhs` (pytest), with the RHS bounded to its own line.
+ *
+ * Deliberately NOT `closeOverLocals`: that bounds a declaration at its next
+ * sibling, so a `const subs = [...]` inside a test absorbs the rest of the test
+ * -- including the target call -- and `subs` reads as reaching the target. That
+ * is exactly the bystander this rule exists to see.
+ */
+function bodyBindings(lines, python) {
+    const re = python
+        ? /^\s*([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/
+        : /^\s*(const\s+|let\s+|var\s+)?([A-Za-z_$][\w$]*)\s*=(?!=)\s*(.*)$/;
+    const out = [];
+    for (const { text } of lines) {
+        const m = re.exec(text);
+        if (!m)
+            continue;
+        if (python)
+            out.push({ name: m[1], rhs: m[2], declared: true });
+        else
+            out.push({ name: m[2], rhs: m[3], declared: m[1] !== undefined });
+    }
+    return out;
+}
+/** Is `rhs` a whole statement on its line? A dangling bracket means it is not. */
+function balanced(rhs) {
+    let d = 0;
+    for (const c of rhs) {
+        if (c === '(' || c === '[' || c === '{')
+            d += 1;
+        else if (c === ')' || c === ']' || c === '}')
+            d -= 1;
+    }
+    return d === 0;
+}
+/**
+ * VAC-005 -- every assertion is a trivially true presence check, and its subject
+ * is a BYSTANDER: a name the test itself bound, never from anything reaching the
+ * target (#870). The mirror image of VAC-003:
+ *
+ * ```js
+ * const subs = [{ id: 's1' }];
+ * matchSubmissions([], subs);
+ * expect(subs).toBeDefined();   // true before the call, true after it
+ * ```
+ *
+ * The bystander clause is the rule, for the same reason VAC-003's is:
+ * `const r = target(); expect(r).toBeDefined()` DOES observe the target, and a
+ * throw from it would fail the test. Anything the rule cannot prove is a
+ * bystander -- a name bound in a hook or at module scope, a multi-line RHS --
+ * yields no finding, so the error direction is always a miss, never a false
+ * accusation.
+ */
+function presenceOnBystander(lines, block, file, python, targets) {
+    if (targets === null)
+        return [];
+    const anyAssertion = python ? PY_ASSERTION : JS_ASSERTION;
+    const absence = python ? PY_ABSENCE_ASSERTION : ABSENCE_ASSERTION;
+    const assertions = lines.filter((l) => anyAssertion.test(l.text));
+    if (assertions.length === 0)
+        return [];
+    // All-absence (the negated-null forms included) is VAC-003's to report.
+    if (assertions.every((l) => absence.test(l.text)))
+        return [];
+    const subjects = assertions.map((l) => presenceSubject(l.text, python));
+    if (subjects.some((s) => s === null))
+        return [];
+    const bindings = bodyBindings(lines, python);
+    if (bindings.some((b) => !balanced(b.rhs)))
+        return [];
+    // The body's own names are removed first -- `closeOverLocals` over-attributes
+    // them (see `bodyBindings`) -- then re-derived here from their real RHS, to a
+    // fixpoint so `const r = save(); const s = r;` still reaches.
+    const bound = new Set(bindings.map((b) => b.name));
+    const reaching = new Set([...targets].filter((t) => !bound.has(t)));
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const b of bindings) {
+            if (reaching.has(b.name) || !mentionsAny(b.rhs, reaching))
+                continue;
+            reaching.add(b.name);
+            grew = true;
+        }
+    }
+    const bystander = (name) => !reaching.has(name) && bindings.some((b) => b.name === name && b.declared);
+    if (!subjects.every((s) => bystander(s)))
+        return [];
+    return [
+        mk(file, assertions[0].line, 'VAC-005', 'warning', block.name, `Every assertion is a presence check on \`${subjects[0]}\`, a value the test built itself; it holds whether or not the target ran.`, 'Assert on what the target returns or changes -- e.g. `expect(target(input)).toEqual(expected)` -- so the test fails when the target is wrong.'),
+    ];
+}
 /** A zero-denominator result that names why it could not measure. */
 function unreadable(path, reason) {
     return { checked: 0, findings: [], skipped: [{ name: path, reason }] };
@@ -713,7 +858,7 @@ function scanAllBlocks(ctx, blocks, skipped) {
             // real one, and #705 is explicit that a suppressed inference and a passing
             // check must not look alike.
             skipped.push({
-                name: `${outOfBand ? 'VAC-003' : 'VAC-002/VAC-003'} (${block.name})`,
+                name: skipLabel(outOfBand ? 'VAC-003' : 'VAC-002/VAC-003', ctx.path, block),
                 reason: outOfBand
                     ? 'target reached out of band (subprocess or bare dynamic import), so VAC-002 is answered but no symbol exists for absence-only to observe'
                     : 'target unresolvable: no @covers annotation and no first-party relative import to infer from',

package/dist/engine/core/workflow-discovery.js

@@ -305,6 +305,45 @@ export class WorkflowMapping {
 export class WorkflowDiscoveryError extends Error {
 }
 // ---------------------------------------------------------------------------
+// Jira request helpers
+// ---------------------------------------------------------------------------
+// Split out of `WorkflowDiscovery.fetchJira` to pay down its complexity. Kept
+// at module level so the class keeps the Python port's method set, and each
+// stays at or under the perf-ratchet warning threshold (10).
+/** Read the ATLASSIAN_* env vars, refusing when any is unset or empty. */
+function jiraCredentials() {
+    const baseUrl = rstripChar(process.env['ATLASSIAN_URL'] ?? '', '/');
+    const user = process.env['ATLASSIAN_USER'] ?? '';
+    const token = process.env['ATLASSIAN_TOKEN'] ?? '';
+    if (!pyTruthy(baseUrl) || !pyTruthy(user) || !pyTruthy(token)) {
+        throw new WorkflowDiscoveryError('Jira credentials not configured.  Set ATLASSIAN_URL, ' +
+            'ATLASSIAN_USER, and ATLASSIAN_TOKEN environment variables.\n' +
+            'Tip: add them to .canary/company.local.json or your shell profile.');
+    }
+    const auth = Buffer.from(`${user}:${token}`).toString('base64');
+    return {
+        baseUrl,
+        headers: { Authorization: `Basic ${auth}`, Accept: 'application/json' },
+    };
+}
+/**
+ * The issue-type list from the `issuetypes` response. An error object (Jira
+ * answers a missing project with `errorMessages` in a 200) is refused; any
+ * other non-list shape yields no issue types.
+ */
+function jiraIssueTypeList(issueTypesRaw, projectKey) {
+    if (Array.isArray(issueTypesRaw)) {
+        return issueTypesRaw;
+    }
+    if (typeof issueTypesRaw === 'object' &&
+        issueTypesRaw !== null &&
+        'errorMessages' in issueTypesRaw) {
+        throw new WorkflowDiscoveryError(`Jira project ${pyRepr(projectKey)} not found or access denied: ` +
+            `${pyRepr(issueTypesRaw['errorMessages'])}`);
+    }
+    return [];
+}
+// ---------------------------------------------------------------------------
 // Main class
 // ---------------------------------------------------------------------------
 /** Discovers and caches per-project issue-workflow mappings. */
@@ -399,34 +438,13 @@ export class WorkflowDiscovery {
     // -- private: Jira ---------------------------------------------------------
     /** Python: `WorkflowDiscovery._fetch_jira`. */
     async fetchJira(projectKey) {
-        const baseUrl = rstripChar(process.env['ATLASSIAN_URL'] ?? '', '/');
-        const user = process.env['ATLASSIAN_USER'] ?? '';
-        const token = process.env['ATLASSIAN_TOKEN'] ?? '';
-        if (!pyTruthy(baseUrl) || !pyTruthy(user) || !pyTruthy(token)) {
-            throw new WorkflowDiscoveryError('Jira credentials not configured.  Set ATLASSIAN_URL, ' +
-                'ATLASSIAN_USER, and ATLASSIAN_TOKEN environment variables.\n' +
-                'Tip: add them to .canary/company.local.json or your shell profile.');
-        }
-        const auth = Buffer.from(`${user}:${token}`).toString('base64');
-        const headers = {
-            Authorization: `Basic ${auth}`,
-            Accept: 'application/json',
-        };
+        const { baseUrl, headers } = jiraCredentials();
         // Capture the URL so ticket_updater can use it without requiring the env var.
         const discoveredBaseUrl = baseUrl;
         // 1. Get issue types for this project.
         const issueTypesRaw = await this.jiraGet(`${baseUrl}/rest/api/3/project/${projectKey}/issuetypes`, headers);
-        if (!Array.isArray(issueTypesRaw) &&
-            typeof issueTypesRaw === 'object' &&
-            issueTypesRaw !== null &&
-            'errorMessages' in issueTypesRaw) {
-            throw new WorkflowDiscoveryError(`Jira project ${pyRepr(projectKey)} not found or access denied: ` +
-                `${pyRepr(issueTypesRaw['errorMessages'])}`);
-        }
+        const list = jiraIssueTypeList(issueTypesRaw, projectKey);
         const issueTypes = [];
-        const list = Array.isArray(issueTypesRaw)
-            ? issueTypesRaw
-            : [];
         for (const itRaw of list) {
             const itId = String(pyGet(itRaw, 'id', ''));
             const itName = String(pyGet(itRaw, 'name', ''));

package/dist/engine/guardian/adjudication-github.js

@@ -0,0 +1,136 @@
+/**
+ * GitHub evidence for derived adjudication (ADR 0025, #938).
+ *
+ * The network seam behind `adjudication.ts`: merged PRs in a window (GraphQL
+ * search), the guardian sticky's edit history (REST comments + GraphQL
+ * `userContentEdits`), and the merged file patches (REST). The sticky is found
+ * with the author-aware {@link findSticky} (#931), never by marker substring.
+ *
+ * Network lives ONLY in {@link GitHubAdjudicationSource}'s default seams;
+ * tests use {@link FakeAdjudicationSource} or inject `read` / `graphql`.
+ */
+import { readAllPages, restPageReader } from './github-paging.js';
+import { findSticky } from './pr-comment.js';
+const API = 'https://api.github.com';
+/** The most merged PRs one report walks (bounds API cost and rate limits). */
+const MERGED_PR_LIMIT = 300;
+/** In-memory {@link AdjudicationSource} for tests. */
+export class FakeAdjudicationSource {
+    init;
+    constructor(init) {
+        this.init = init;
+    }
+    async mergedPrs() {
+        return this.init.merged;
+    }
+    async stickyHistory(pr) {
+        const revisions = this.init.stickies?.[pr];
+        return revisions === undefined ? null : { revisions };
+    }
+    async prFiles(pr) {
+        return this.init.files?.[pr] ?? [];
+    }
+}
+/**
+ * Sticky bodies oldest to newest. GitHub returns edits newest first and each
+ * `diff` holds the whole body at that revision. A truncated or redacted
+ * history is `null` (disclosed as "no edit history"), never a shorter list.
+ */
+export function revisionsFrom(body, edits) {
+    if (!edits)
+        return null;
+    if (edits.totalCount === 0)
+        return [body];
+    const diffs = edits.nodes.map((n) => n.diff);
+    if (diffs.length < edits.totalCount || diffs.includes(null))
+        return null;
+    return [...diffs.reverse(), body];
+}
+const SEARCH_QUERY = `query($q: String!, $after: String) {
+  search(query: $q, type: ISSUE, first: 100, after: $after) {
+    issueCount pageInfo { hasNextPage endCursor }
+    nodes { ... on PullRequest { number } } } }`;
+const EDITS_QUERY = `query($id: ID!) { node(id: $id) { ... on IssueComment {
+  userContentEdits(first: 100) { totalCount nodes { diff } } } } }`;
+function defaultGraphql(token) {
+    return async (query, variables) => {
+        const resp = await fetch(`${API}/graphql`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'User-Agent': 'canary-pr-guardian',
+            },
+            body: JSON.stringify({ query, variables }),
+        });
+        const json = (await resp.json());
+        if (!resp.ok || json.errors || !json.data) {
+            throw new Error(`GitHub GraphQL ${resp.status}: ${JSON.stringify(json)}`);
+        }
+        return json.data;
+    };
+}
+/** The real {@link AdjudicationSource} over GitHub REST + GraphQL. */
+export class GitHubAdjudicationSource {
+    repo;
+    read;
+    graphql;
+    constructor(repo, token, seams = {}) {
+        this.repo = repo;
+        this.read =
+            seams.read ??
+                restPageReader({
+                    Authorization: `Bearer ${token}`,
+                    Accept: 'application/vnd.github+json',
+                    'User-Agent': 'canary-pr-guardian',
+                }, (status, url) => new Error(`GitHub API ${status}: ${url}`));
+        this.graphql = seams.graphql ?? defaultGraphql(token);
+    }
+    /** Pages the search; refuses a window past {@link MERGED_PR_LIMIT} rather than truncating. */
+    async mergedPrs(since) {
+        const q = `repo:${this.repo} is:pr is:merged merged:>=${since}`;
+        const numbers = [];
+        let after = null;
+        do {
+            const data = await this.graphql(SEARCH_QUERY, { q, after });
+            const search = data['search'];
+            if (search.issueCount > MERGED_PR_LIMIT) {
+                throw new Error(`${search.issueCount} merged PRs since ${since} exceeds the ` +
+                    `${MERGED_PR_LIMIT}-PR bound; narrow --days`);
+            }
+            numbers.push(...search.nodes.map((n) => n.number));
+            after = search.pageInfo?.hasNextPage ? search.pageInfo.endCursor : null;
+        } while (after !== null);
+        return numbers;
+    }
+    async stickyHistory(pr) {
+        const url = `${API}/repos/${this.repo}/issues/${pr}/comments`;
+        const comments = (await readAllPages(url, this.read));
+        const sticky = findSticky(comments);
+        if (sticky === null)
+            return null;
+        const data = await this.graphql(EDITS_QUERY, { id: sticky.node_id });
+        const node = data['node'];
+        return { revisions: revisionsFrom(sticky.body, node?.userContentEdits) };
+    }
+    async prFiles(pr) {
+        const url = `${API}/repos/${this.repo}/pulls/${pr}/files`;
+        return (await readAllPages(url, this.read));
+    }
+}
+/** Walk the merged PRs; PRs without a sticky are scanned but carry no evidence. */
+export async function collectEvidence(source, since) {
+    const merged = await source.mergedPrs(since);
+    const evidence = [];
+    for (const number of merged) {
+        const history = await source.stickyHistory(number);
+        if (history === null)
+            continue;
+        evidence.push({
+            number,
+            revisions: history.revisions,
+            files: await source.prFiles(number),
+        });
+    }
+    return { evidence, scanned: merged.length };
+}
+//# sourceMappingURL=adjudication-github.js.map