candor-ts 0.7.6 → 0.7.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.5)",
   "type": "module",
   "dependencies": {

package/policy.mjs

@@ -56,10 +56,12 @@ export function parsePolicy(text) {
   return { deny, allow, forbid };
 }
 
-/** §6.2 scope match: by NAME SEGMENT over ".", last segment a prefix. */
+/** §6.2 scope match: by NAME SEGMENT, last segment a prefix.
+ * Segments split on BOTH "." and "::" — Rust/Java qualify with "::" while TS uses ".", and a shared
+ * policy must match across engines (a `Foo::bar` scope authored against Rust was inert in TS before). */
 export function scopeMatches(name, scope) {
-  const segs = name.split(".");
-  const parts = scope.split(".");
+  const segs = name.split(/[.:]+/).filter(Boolean);
+  const parts = scope.split(/[.:]+/).filter(Boolean);
   if (parts.length === 0 || parts.length > segs.length) return false;
   const last = parts[parts.length - 1], init = parts.slice(0, -1);
   outer: for (let i = 0; i + parts.length <= segs.length; i++) {

package/query.mjs

@@ -95,7 +95,15 @@ switch (cmd) {
     printAgents(); // shared with scan.mjs — one implementation, can't diverge within an install
     break;
   case "parsepolicy": {
-    emit(parsePolicy(fs.readFileSync(args[0], "utf8")));
+    // An unreadable/missing file is a clean exit-2 error, not an uncaught readFileSync stack trace.
+    let text;
+    try {
+      text = fs.readFileSync(args[0], "utf8");
+    } catch {
+      console.error(`candor: policy ${args[0] ?? "(no file given)"} could not be read`);
+      process.exit(2);
+    }
+    emit(parsePolicy(text));
     break;
   }
   case "show": {
@@ -234,8 +242,18 @@ switch (cmd) {
       for (const c of rev.get(n) ?? []) if (!affected.has(c)) { affected.add(c); queue.push(c); }
     }
     const violations = [];
-    if (maybePolicy && maybePolicy !== "0" && maybePolicy !== "1" && fs.existsSync(maybePolicy)) {
-      const pol = parsePolicy(fs.readFileSync(maybePolicy, "utf8"));
+    // A present policy arg (anything but the 0/1 verbosity sentinels) MUST exist and be readable —
+    // a typo'd path must be LOUD, not silently "no policy → ok:true, exit 0" (mirrors scan's --policy,
+    // which exits 2 on an unreadable file: a gate that can't read its policy can't certify anything).
+    if (maybePolicy && maybePolicy !== "0" && maybePolicy !== "1") {
+      let text;
+      try {
+        text = fs.readFileSync(maybePolicy, "utf8");
+      } catch {
+        console.error(`candor: policy ${maybePolicy} could not be read; whatif NOT evaluated against it`);
+        process.exit(2);
+      }
+      const pol = parsePolicy(text);
       for (const r of pol.deny) {
         if (r.effects.length && !r.effects.includes(eff)) continue; // pure ([]) forbids ANY effect
         for (const fn of affected)

package/scan.mjs

@@ -87,7 +87,11 @@ for (let i = 0; i < argv.length; i++) {
     if (a === "--out") outPrefix = v; else policyPath = v;
     i++;
   }
-  else if (a.startsWith("--")) { console.error(`candor-ts: unknown flag ${a} (${usage})`); process.exit(2); }
+  // Any leading-dash token that isn't a recognized flag is an unknown flag — NOT a positional target
+  // (SPEC §6.2/§7). `-h`/`-V`/`--help`/`--version` are print-and-exit modes consumed above, so by here
+  // a single-dash token (`-x`, the typo `-policy`) can only be a mistake; treating it as the scan
+  // target would silently scan the wrong thing.
+  else if (a.startsWith("-")) { console.error(`candor-ts: unknown flag ${a} (${usage})`); process.exit(2); }
   else if (target === null) target = a;
   else if (outPrefix === null) outPrefix = a; // legacy positional prefix
   else { console.error(`candor-ts: unexpected extra argument ${a} (${usage})`); process.exit(2); }
@@ -193,8 +197,8 @@ if (!wantJson) fs.mkdirSync(path.dirname(path.resolve(outPrefix)), { recursive:
       const deps = JSON.parse(fs.readFileSync(pkg, "utf8")).dependencies ?? {};
       if (Object.keys(deps).length > 0)
         console.error("candor-ts: WARNING — the target declares dependencies but has no node_modules; " +
-                      "imports will not resolve and most functions will read Unknown. " +
-                      "Run `npm install` in the target first.");
+                      "imports won't resolve, so calls into those packages read pure/invisible (not Unknown) " +
+                      "and effects through them are silently dropped. Run `npm install` in the target first.");
     } catch {}
   }
   // Prisma's client types are GENERATED — a project with the prisma dependency but no generated
@@ -2084,7 +2088,10 @@ if (policyPath) {
   const incompleteMap = new Map();
   for (const [name, rec] of fns) if (rec.incomplete.size) incompleteMap.set(name, rec.incomplete);
   const v = evaluatePolicy(parsePolicy(text), functions, cg, incompleteMap);
-  for (const line of v) console.log(line);
+  // In --json mode stdout is the §2 envelope and must stay pure JSON — route the gate's
+  // [AS-EFF-…] violation lines to stderr so a `candor-ts --json --policy … | jq` pipe never breaks.
+  const emitViolation = wantJson ? (l) => console.error(l) : (l) => console.log(l);
+  for (const line of v) emitViolation(line);
   if (v.length) {
     console.error(`candor-ts: ${v.length} policy violation(s)`);
     process.exit(1);