openpitstop 1.0.0

package/dist/analyzers/integrity/exceptionSwallow.js

@@ -0,0 +1,198 @@
+import { execaSync } from "execa";
+import { parse } from "@babel/parser";
+/**
+ * exceptionSwallow — AST-scan added try/catch (JS/TS) or try/except (Python) blocks.
+ *
+ * SUSPICIOUS ONLY (never CONFIRMED — legitimate error handling is common):
+ *   - the try/catch body is empty
+ *   - the catch only logs (no re-raise / no real handling)
+ *   - the catch unconditionally returns a default/success value
+ */
+const PY_SCRIPT = `
+import ast, json, sys
+
+code = sys.stdin.read()
+try:
+    tree = ast.parse(code)
+except Exception:
+    print(json.dumps([]))
+    sys.exit(0)
+
+LOG_NAMES = {"print", "logging", "logger", "log"}
+
+def is_log(stmt):
+    if isinstance(stmt, ast.Expr) and isinstance(stmt.value, ast.Call):
+        f = stmt.value.func
+        name = f.id if isinstance(f, ast.Name) else (f.attr if isinstance(f, ast.Attribute) else None)
+        if name in LOG_NAMES or (isinstance(name, str) and name.startswith("log")):
+            return True
+    return False
+
+def reason_for(body):
+    if not body:
+        return "empty catch swallows the error"
+    if all(is_log(s) for s in body):
+        return "catch only logs the error and does not re-raise or handle it"
+    if len(body) == 1 and isinstance(body[0], ast.Return) and isinstance(body[0].value, ast.Constant):
+        return "catch unconditionally returns a default/success value"
+    return None
+
+out = []
+for node in ast.walk(tree):
+    if isinstance(node, ast.Try):
+        for h in node.handlers:
+            r = reason_for(h.body)
+            if r:
+                out.append({"line": h.lineno, "reason": r})
+                break
+        else:
+            if not node.body:
+                out.append({"line": node.lineno, "reason": "empty try block"})
+print(json.dumps(out))
+`;
+function isNewlyAdded(change, line) {
+    if (change.status === "added")
+        return true;
+    return change.added.some((l) => l.line === line);
+}
+function isLogStatement(stmt) {
+    if (!stmt || stmt.type !== "ExpressionStatement")
+        return false;
+    const expr = stmt.expression;
+    if (!expr || expr.type !== "CallExpression")
+        return false;
+    const callee = expr.callee;
+    let name = null;
+    if (callee.type === "Identifier")
+        name = callee.name;
+    else if (callee.type === "MemberExpression" && callee.property.type === "Identifier") {
+        name = callee.property.name;
+    }
+    if (!name)
+        return false;
+    if (/^(log|warn|error|info|debug)/i.test(name))
+        return true;
+    if (["console", "logger", "log", "logging", "print"].includes(name))
+        return true;
+    return false;
+}
+function classifyCatch(body) {
+    if (!body || body.length === 0)
+        return "empty catch swallows the error";
+    if (body.every(isLogStatement)) {
+        return "catch only logs the error and does not re-raise or handle it";
+    }
+    if (body.length === 1 && body[0].type === "ReturnStatement") {
+        const arg = body[0].argument;
+        if (arg &&
+            (arg.type === "Literal" ||
+                arg.type === "ArrayExpression" ||
+                arg.type === "ObjectExpression")) {
+            return "catch unconditionally returns a default/success value";
+        }
+    }
+    return null;
+}
+function walk(node, cb) {
+    if (!node || typeof node !== "object")
+        return;
+    cb(node);
+    for (const key of Object.keys(node)) {
+        const val = node[key];
+        if (Array.isArray(val))
+            val.forEach((v) => walk(v, cb));
+        else if (val && typeof val === "object" && typeof val.type === "string")
+            walk(val, cb);
+    }
+}
+function detectJs(change) {
+    const out = [];
+    if (!change.after)
+        return out;
+    let ast;
+    try {
+        ast = parse(change.after, {
+            sourceType: "module",
+            errorRecovery: true,
+            plugins: change.language === "ts"
+                ? ["typescript", "jsx"]
+                : ["jsx"],
+        });
+    }
+    catch {
+        return out;
+    }
+    walk(ast, (n) => {
+        if (n.type !== "TryStatement")
+            return;
+        const tryLine = n.loc?.start?.line;
+        const handler = n.handler;
+        const handlerLine = handler?.loc?.start?.line ?? tryLine;
+        if (!isNewlyAdded(change, tryLine) && !isNewlyAdded(change, handlerLine))
+            return;
+        let reason = null;
+        if (!n.block || n.block.body.length === 0) {
+            reason = "empty try block";
+        }
+        else if (handler) {
+            reason = classifyCatch(handler.body?.body ?? null);
+        }
+        else {
+            // try/finally with no catch — only suspicious if the try body is empty.
+            reason = null;
+        }
+        if (reason) {
+            out.push({
+                detector: "exceptionSwallow",
+                pattern: "error-swallowed",
+                confidence: "suspicious",
+                file: change.path,
+                line: handlerLine ?? tryLine,
+                evidence: `newly added try/catch: ${reason}`,
+            });
+        }
+    });
+    return out;
+}
+function detectPython(change) {
+    const out = [];
+    if (!change.after)
+        return out;
+    try {
+        const res = execaSync("python", ["-c", PY_SCRIPT], {
+            input: change.after,
+            encoding: "utf8",
+            windowsHide: true,
+            reject: false,
+            timeout: 15000,
+        });
+        const hits = JSON.parse(res.stdout);
+        for (const h of hits) {
+            if (isNewlyAdded(change, h.line)) {
+                out.push({
+                    detector: "exceptionSwallow",
+                    pattern: "error-swallowed",
+                    confidence: "suspicious",
+                    file: change.path,
+                    line: h.line,
+                    evidence: `newly added try/except: ${h.reason}`,
+                });
+            }
+        }
+    }
+    catch {
+        // python unavailable or parse error — skip silently.
+    }
+    return out;
+}
+export function detectExceptionSwallow(changes) {
+    const findings = [];
+    for (const c of changes) {
+        if (c.language === "python")
+            findings.push(...detectPython(c));
+        else if (c.language === "js" || c.language === "ts")
+            findings.push(...detectJs(c));
+    }
+    return findings;
+}
+//# sourceMappingURL=exceptionSwallow.js.map

package/dist/analyzers/integrity/exceptionSwallow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exceptionSwallow.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/exceptionSwallow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC;;;;;;;GAOG;AAEH,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCjB,CAAC;AAEF,SAAS,YAAY,CAAC,MAAkB,EAAE,IAAY;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,IAAS;IAC/B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;SAChD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrF,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAkB;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gCAAgC,CAAC;IACxE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/B,OAAO,8DAA8D,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7B,IACE,GAAG;YACH,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS;gBACrB,GAAG,CAAC,IAAI,KAAK,iBAAiB;gBAC9B,GAAG,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAClC,CAAC;YACD,OAAO,uDAAuD,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,IAAS,EAAE,EAAoB;IAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,EAAE,CAAC,IAAI,CAAC,CAAC;IACT,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,GAAI,IAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aACnD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAAkB;IAClC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE;YACxB,UAAU,EAAE,QAAQ;YACpB,aAAa,EAAE,IAAI;YACnB,OAAO,EACL,MAAM,CAAC,QAAQ,KAAK,IAAI;gBACtB,CAAC,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC;gBACvB,CAAC,CAAC,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QACd,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO;QACtC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1B,MAAM,WAAW,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,OAAO,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC;YAAE,OAAO;QAEjF,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,iBAAiB,CAAC;QAC7B,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,kBAAkB;gBAC5B,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,YAAY;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,WAAW,IAAI,OAAO;gBAC5B,QAAQ,EAAE,0BAA0B,MAAM,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB;IACtC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE;YACjD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,MAAM,IAAI,GAAuC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC;oBACP,QAAQ,EAAE,kBAAkB;oBAC5B,OAAO,EAAE,iBAAiB;oBAC1B,UAAU,EAAE,YAAY;oBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,QAAQ,EAAE,2BAA2B,CAAC,CAAC,MAAM,EAAE;iBAChD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAqB;IAC1D,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;aAC1D,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/analyzers/integrity/exitCheat.d.ts

@@ -0,0 +1,2 @@
+import type { FileChange, IntegrityFinding } from "./types.js";
+export declare function detectExitCheat(changes: FileChange[]): IntegrityFinding[];

package/dist/analyzers/integrity/exitCheat.js

@@ -0,0 +1,31 @@
+import { isAppCode } from "./helpers.js";
+/**
+ * exitCheat — a `process.exit(0)` / `sys.exit(0)` / `os._exit(0)` added inside
+ * application code is the one unambiguous cheat: it can force a "success" exit
+ * to hide a failing run. CLI entrypoints and test-runner configs are excluded
+ * because `process.exit(0)` is legitimate there.
+ *
+ * CONFIRMED (unambiguous, auto-block) — but only for exit(0) with no context.
+ */
+const EXIT_CHEAT_RE = /\b(?:process\.exit|sys\.exit|os\._exit)\s*\(\s*0\s*\)/;
+export function detectExitCheat(changes) {
+    const findings = [];
+    for (const c of changes) {
+        if (!isAppCode(c.path))
+            continue;
+        for (const a of c.added) {
+            if (EXIT_CHEAT_RE.test(a.text)) {
+                findings.push({
+                    detector: "exitCheat",
+                    pattern: "process-exit-0-in-app-code",
+                    confidence: "confirmed",
+                    file: c.path,
+                    line: a.line,
+                    evidence: `added ${a.text.trim().split(/\s+/)[0].split("(")[0]}(0) in application code — forces a success exit to hide failure`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=exitCheat.js.map

package/dist/analyzers/integrity/exitCheat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exitCheat.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/exitCheat.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,uDAAuD,CAAC;AAE9E,MAAM,UAAU,eAAe,CAAC,OAAqB;IACnD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,WAAW;oBACrB,OAAO,EAAE,4BAA4B;oBACrC,UAAU,EAAE,WAAW;oBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iEAAiE;iBAChI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/analyzers/integrity/git.d.ts

@@ -0,0 +1,10 @@
+import { languageOf } from "./helpers.js";
+import type { FileChange } from "./types.js";
+/** Get all changed files for the given ref range. */
+export declare function getDiff(repo: string, from: string, to?: string): FileChange[];
+/** Resolve default refs. `from` defaults to HEAD~1 (or HEAD if that's invalid). */
+export declare function resolveRefs(repo: string, from?: string, to?: string): {
+    from: string;
+    to?: string;
+};
+export { languageOf };

package/dist/analyzers/integrity/git.js

@@ -0,0 +1,181 @@
+import fs from "node:fs";
+import path from "node:path";
+import { safeExec } from "../util.js";
+import { languageOf, makeChange, linesToDiff } from "./helpers.js";
+function gitOk(repo, args) {
+    return safeExec("git", args, repo).code === 0;
+}
+function normalizeEol(text) {
+    return text.replace(/\r\n/g, "\n");
+}
+function showAtRef(repo, ref, file) {
+    const r = safeExec("git", ["show", `${ref}:${file}`], repo);
+    if (r.code !== 0)
+        return undefined;
+    return normalizeEol(r.stdout);
+}
+function readWorking(repo, file) {
+    try {
+        return normalizeEol(fs.readFileSync(path.join(repo, file), "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+function stripPrefix(p) {
+    // git diff prints "a/foo" / "b/foo" (or "/dev/null").
+    if (p === "/dev/null")
+        return "/dev/null";
+    return p.replace(/^(a\/|b\/)/, "");
+}
+/** Parse a unified diff (-U0) into per-file added/removed lines + status. */
+function parseUnified(text) {
+    const files = [];
+    let cur = null;
+    let oldLine = 0;
+    let newLine = 0;
+    const flush = () => {
+        if (cur)
+            files.push(cur);
+        cur = null;
+    };
+    for (const raw of text.split(/\r?\n/)) {
+        if (raw.startsWith("diff --git")) {
+            flush();
+            cur = { oldPath: "", newPath: "", status: "modified", added: [], removed: [] };
+            const m = raw.match(/diff --git a\/(.*) b\/(.*)$/);
+            if (m) {
+                cur.oldPath = stripPrefix("a/" + m[1]);
+                cur.newPath = stripPrefix("b/" + m[2]);
+            }
+            continue;
+        }
+        if (!cur)
+            continue;
+        if (raw.startsWith("new file")) {
+            cur.status = "added";
+            continue;
+        }
+        if (raw.startsWith("deleted file")) {
+            cur.status = "deleted";
+            continue;
+        }
+        if (raw.startsWith("rename from")) {
+            cur.oldPath = stripPrefix(raw.slice("rename from ".length).trim());
+            cur.status = "renamed";
+            continue;
+        }
+        if (raw.startsWith("rename to")) {
+            cur.newPath = stripPrefix(raw.slice("rename to ".length).trim());
+            continue;
+        }
+        if (raw.startsWith("--- ")) {
+            cur.oldPath = stripPrefix(raw.slice(4).trim());
+            continue;
+        }
+        if (raw.startsWith("+++ ")) {
+            cur.newPath = stripPrefix(raw.slice(4).trim());
+            continue;
+        }
+        if (raw.startsWith("@@")) {
+            const m = raw.match(/@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+            if (m) {
+                oldLine = parseInt(m[1], 10);
+                newLine = parseInt(m[2], 10);
+            }
+            continue;
+        }
+        if (raw.startsWith("+") && !raw.startsWith("+++")) {
+            cur.added.push({ line: newLine++, text: raw.slice(1) });
+        }
+        else if (raw.startsWith("-") && !raw.startsWith("---")) {
+            cur.removed.push({ line: oldLine++, text: raw.slice(1) });
+        }
+        else if (raw.startsWith(" ")) {
+            oldLine++;
+            newLine++;
+        }
+    }
+    flush();
+    return files;
+}
+function mergeByNewPath(a, b) {
+    const byPath = new Map();
+    for (const f of [...a, ...b]) {
+        const key = f.newPath && f.newPath !== "/dev/null" ? f.newPath : f.oldPath;
+        const existing = byPath.get(key);
+        if (existing) {
+            existing.added.push(...f.added);
+            existing.removed.push(...f.removed);
+            if (f.status === "added" || f.status === "deleted")
+                existing.status = f.status;
+        }
+        else {
+            byPath.set(key, { ...f });
+        }
+    }
+    return [...byPath.values()];
+}
+/** Get all changed files for the given ref range. */
+export function getDiff(repo, from, to) {
+    let parsed;
+    if (to) {
+        const r = safeExec("git", ["diff", "-U0", from, to], repo);
+        parsed = parseUnified(r.stdout);
+    }
+    else {
+        const unstaged = safeExec("git", ["diff", "-U0", from], repo).stdout;
+        const staged = safeExec("git", ["diff", "--cached", "-U0", from], repo).stdout;
+        parsed = mergeByNewPath(parseUnified(unstaged), parseUnified(staged));
+        // Untracked files count as additions against the working tree.
+        const others = safeExec("git", ["ls-files", "--others", "--exclude-standard"], repo).stdout;
+        for (const f of others.split(/\r?\n/).map((s) => s.trim()).filter(Boolean)) {
+            if (f.startsWith("node_modules/") || f.startsWith(".pitstop/") || f.startsWith("dist/")) {
+                continue;
+            }
+            const content = readWorking(repo, f);
+            if (content == null)
+                continue;
+            parsed.push({
+                oldPath: "/dev/null",
+                newPath: f,
+                status: "added",
+                added: linesToDiff(content),
+                removed: [],
+            });
+        }
+    }
+    const out = [];
+    for (const p of parsed) {
+        const newPath = p.newPath !== "/dev/null" ? p.newPath : p.oldPath;
+        const oldPath = p.oldPath !== "/dev/null" ? p.oldPath : p.newPath;
+        let before;
+        let after;
+        if (p.status === "added") {
+            before = undefined;
+            after = to ? showAtRef(repo, to, newPath) : readWorking(repo, newPath);
+        }
+        else if (p.status === "deleted") {
+            before = showAtRef(repo, from, oldPath);
+            after = undefined;
+        }
+        else {
+            before = showAtRef(repo, from, oldPath);
+            after = to ? showAtRef(repo, to, newPath) : readWorking(repo, newPath);
+        }
+        if (before == null && after == null)
+            continue;
+        out.push(makeChange(newPath, p.status, before, after, p.added, p.removed));
+    }
+    return out;
+}
+/** Resolve default refs. `from` defaults to HEAD~1 (or HEAD if that's invalid). */
+export function resolveRefs(repo, from, to) {
+    let resolvedFrom = from ?? "";
+    if (!resolvedFrom) {
+        resolvedFrom = gitOk(repo, ["rev-parse", "--verify", "HEAD~1"]) ? "HEAD~1" : "HEAD";
+    }
+    return { from: resolvedFrom, to };
+}
+export { languageOf };
+//# sourceMappingURL=git.js.map

package/dist/analyzers/integrity/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAwBnE,SAAS,KAAK,CAAC,IAAY,EAAE,IAAc;IACzC,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IACxD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,sDAAsD;IACtD,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IAC1C,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,GAAG,GAAsB,IAAI,CAAC;IAClC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,GAAG,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,KAAK,EAAE,CAAC;YACR,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC/E,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACnD,IAAI,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvC,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC9D,IAAI,CAAC,EAAE,CAAC;gBACN,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,CAAe,EAAE,CAAe;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAChC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,EAAW;IAC7D,IAAI,MAAoB,CAAC;IACzB,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;QAC/E,MAAM,GAAG,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;QAC5F,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxF,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrC,IAAI,OAAO,IAAI,IAAI;gBAAE,SAAS;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC3B,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAClE,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAClE,IAAI,MAA0B,CAAC;QAC/B,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,GAAG,SAAS,CAAC;YACnB,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACxC,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACxC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,MAAM,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI;YAAE,SAAS;QAC9C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAa,EAAE,EAAW;IAClE,IAAI,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/analyzers/integrity/hardcodedMatch.d.ts

@@ -0,0 +1,2 @@
+import type { FileChange, IntegrityFinding } from "./types.js";
+export declare function detectHardcodedMatch(changes: FileChange[]): IntegrityFinding[];

package/dist/analyzers/integrity/hardcodedMatch.js

@@ -0,0 +1,93 @@
+import { isTestFile } from "./helpers.js";
+/**
+ * hardcodedMatch — cross-reference literals introduced in non-test (app) files
+ * against expected values asserted in the test files' diff.
+ *
+ * SUSPICIOUS ONLY (never CONFIRMED): matching a test's expected value is strong
+ * evidence the implementation was hardcoded to pass rather than correctly
+ * computed, but a human must confirm (e.g. a shared constant is a legit fixture).
+ */
+const ASSERT_SINGLE_RE = /(?:toBe|toEqual|toStrictEqual|toMatch|toMatchObject)\s*\(\s*("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|-?\d+\.?\d*)\s*\)/g;
+const ASSERT_TWO_RE = /(?:assertEqual|assertEquals|assert\.equal|assert\.strictEqual|assertDeepEqual|assert deepEqual|assertAlmostEqual|self\.assertEqual)\s*\([^,]*,\s*("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|-?\d+\.?\d*)\s*\)/g;
+const ASSERT_PY_RE = /\bassert\s+[^=]*==\s*("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|-?\d+\.?\d*)/g;
+const STR_RE = /'[^']*'|"[^"]*"/g;
+const NUM_RE = /(?<!\w)(?:-?\d+\.\d+|-?\d+)(?!\w|\.)/g;
+function normalize(raw) {
+    const t = raw.trim();
+    if ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))) {
+        return { kind: "str", value: t.slice(1, -1) };
+    }
+    const n = Number(t);
+    if (!Number.isNaN(n))
+        return { kind: "num", value: n };
+    return null;
+}
+function trivial(n) {
+    if (n.kind === "num" && (n.value === 0 || n.value === 1))
+        return true;
+    if (n.kind === "str" && n.value === "")
+        return true;
+    return false;
+}
+export function detectHardcodedMatch(changes) {
+    const findings = [];
+    // App literals introduced in this change.
+    const appLiterals = [];
+    for (const c of changes) {
+        if (isTestFile(c.path))
+            continue;
+        for (const a of c.added) {
+            for (const m of a.text.matchAll(STR_RE)) {
+                const n = normalize(m[0]);
+                if (n && !trivial(n))
+                    appLiterals.push({ norm: n, file: c.path, line: a.line });
+            }
+            for (const m of a.text.matchAll(NUM_RE)) {
+                const n = normalize(m[0]);
+                if (n && !trivial(n))
+                    appLiterals.push({ norm: n, file: c.path, line: a.line });
+            }
+        }
+    }
+    // Expected values asserted in test files' diff.
+    const testExpected = [];
+    for (const c of changes) {
+        if (!isTestFile(c.path))
+            continue;
+        for (const a of c.added) {
+            for (const m of a.text.matchAll(ASSERT_SINGLE_RE)) {
+                const n = normalize(m[1]);
+                if (n)
+                    testExpected.push({ norm: n, file: c.path, line: a.line });
+            }
+            for (const m of a.text.matchAll(ASSERT_TWO_RE)) {
+                const n = normalize(m[1]);
+                if (n)
+                    testExpected.push({ norm: n, file: c.path, line: a.line });
+            }
+            for (const m of a.text.matchAll(ASSERT_PY_RE)) {
+                const n = normalize(m[1]);
+                if (n)
+                    testExpected.push({ norm: n, file: c.path, line: a.line });
+            }
+        }
+    }
+    for (const app of appLiterals) {
+        for (const t of testExpected) {
+            if (app.norm.kind === t.norm.kind && app.norm.value === t.norm.value) {
+                findings.push({
+                    detector: "hardcodedMatch",
+                    pattern: "hardcoded-matches-test-expectation",
+                    confidence: "suspicious",
+                    file: app.file,
+                    line: app.line,
+                    evidence: `literal ${JSON.stringify(app.norm.value)} introduced in app code matches an expected value asserted in the test "${t.file}:${t.line}"`,
+                    file2: t.file,
+                    line2: t.line,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=hardcodedMatch.js.map

package/dist/analyzers/integrity/hardcodedMatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcodedMatch.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/hardcodedMatch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;GAOG;AAEH,MAAM,gBAAgB,GACpB,qHAAqH,CAAC;AACxH,MAAM,aAAa,GACjB,0MAA0M,CAAC;AAC7M,MAAM,YAAY,GAChB,yEAAyE,CAAC;AAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAClC,MAAM,MAAM,GAAG,uCAAuC,CAAC;AAIvD,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,CAAO;IACtB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAqB;IACxD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,0CAA0C;IAC1C,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,MAAM,YAAY,GAAiD,EAAE,CAAC;IACtE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrE,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,gBAAgB;oBAC1B,OAAO,EAAE,oCAAoC;oBAC7C,UAAU,EAAE,YAAY;oBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,QAAQ,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG;oBACjJ,KAAK,EAAE,CAAC,CAAC,IAAI;oBACb,KAAK,EAAE,CAAC,CAAC,IAAI;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/analyzers/integrity/helpers.d.ts

@@ -0,0 +1,21 @@
+import type { FileChange, FileStatus, DiffLine } from "./types.js";
+/** Map a file path to its language for analyzer selection. */
+export declare function languageOf(path: string): "js" | "ts" | "python" | "unknown";
+/** A test file: foo.test.js, foo.spec.tsx, __tests__/x, or test_*.py / *_test.py. */
+export declare function isTestFile(path: string): boolean;
+/**
+ * A "test runner config" that legitimately contains suppressions / exits and
+ * must not be flagged by suppressionCreep / exitCheat.
+ */
+export declare function isTestRunnerConfig(path: string): boolean;
+/**
+ * A legitimate CLI entrypoint (shebang / bin script) — `process.exit(0)` here is
+ * normal and must NOT be flagged as an exit cheat.
+ */
+export declare function isCliEntrypoint(path: string): boolean;
+/** Application code = not a test, not a test-runner config, not a CLI entrypoint. */
+export declare function isAppCode(path: string): boolean;
+/** Build a FileChange helper with added/removed lines and detected language. */
+export declare function makeChange(path: string, status: FileStatus, before: string | undefined, after: string | undefined, added: DiffLine[], removed: DiffLine[]): FileChange;
+/** Lines of a file version as DiffLine[] (used for fully-added files). */
+export declare function linesToDiff(text: string): DiffLine[];

package/dist/analyzers/integrity/helpers.js

@@ -0,0 +1,66 @@
+/** Map a file path to its language for analyzer selection. */
+export function languageOf(path) {
+    const lower = path.toLowerCase();
+    if (lower.endsWith(".py") || lower.endsWith(".pyw"))
+        return "python";
+    if (lower.endsWith(".ts") ||
+        lower.endsWith(".tsx") ||
+        lower.endsWith(".mts") ||
+        lower.endsWith(".cts")) {
+        return "ts";
+    }
+    if (lower.endsWith(".js") ||
+        lower.endsWith(".jsx") ||
+        lower.endsWith(".mjs") ||
+        lower.endsWith(".cjs")) {
+        return "js";
+    }
+    return "unknown";
+}
+/** A test file: foo.test.js, foo.spec.tsx, __tests__/x, or test_*.py / *_test.py. */
+export function isTestFile(path) {
+    const normalized = path.replace(/\\/g, "/");
+    if (/\.(test|spec)\.[jt]sx?$/.test(normalized))
+        return true;
+    if (/[\\/]__tests?__[\\/]/.test(normalized))
+        return true;
+    const base = normalized.split("/").pop() ?? "";
+    if (/^test_.*\.py$/.test(base) || /_test\.py$/.test(base))
+        return true;
+    return false;
+}
+/**
+ * A "test runner config" that legitimately contains suppressions / exits and
+ * must not be flagged by suppressionCreep / exitCheat.
+ */
+export function isTestRunnerConfig(path) {
+    const normalized = path.replace(/\\/g, "/");
+    return /\.(config|conf)\.[jt]sx?$/.test(normalized) || /(^|\/)conftest\.py$/.test(normalized);
+}
+/**
+ * A legitimate CLI entrypoint (shebang / bin script) — `process.exit(0)` here is
+ * normal and must NOT be flagged as an exit cheat.
+ */
+export function isCliEntrypoint(path) {
+    const normalized = path.replace(/\\/g, "/");
+    const base = (normalized.split("/").pop() ?? "").toLowerCase();
+    if (base === "cli.ts" || base === "cli.js" || base === "cli.mjs" || base === "cli.cjs") {
+        return true;
+    }
+    if (/[\\/]bin[\\/]/.test(normalized))
+        return true;
+    return false;
+}
+/** Application code = not a test, not a test-runner config, not a CLI entrypoint. */
+export function isAppCode(path) {
+    return !isTestFile(path) && !isTestRunnerConfig(path) && !isCliEntrypoint(path);
+}
+/** Build a FileChange helper with added/removed lines and detected language. */
+export function makeChange(path, status, before, after, added, removed) {
+    return { path, status, before, after, added, removed, language: languageOf(path) };
+}
+/** Lines of a file version as DiffLine[] (used for fully-added files). */
+export function linesToDiff(text) {
+    return text.split(/\r?\n/).map((text, i) => ({ line: i + 1, text }));
+}
+//# sourceMappingURL=helpers.js.map

package/dist/analyzers/integrity/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/helpers.ts"],"names":[],"mappings":"AAEA,8DAA8D;AAC9D,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrE,IACE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,MAAkB,EAClB,MAA0B,EAC1B,KAAyB,EACzB,KAAiB,EACjB,OAAmB;IAEnB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC"}