tamperward 2.2.0 → 2.3.0

package/dist/cli/index.js

@@ -356,31 +356,59 @@ function tokens(seg) {
 function unquote(t) {
   return t.replace(/^['"]+|['"]+$/g, "");
 }
+function words(seg) {
+  return tokens(seg).map(unquote);
+}
+var GIT_OPT_WITH_ARG = /* @__PURE__ */ new Set(["-c", "-C", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env"]);
+function gitSubcommand(toks) {
+  const i = toks.findIndex((t) => t === "git" || t.endsWith("/git"));
+  if (i < 0) return null;
+  for (let j = i + 1; j < toks.length; j++) {
+    const t = toks[j];
+    if (GIT_OPT_WITH_ARG.has(t)) {
+      j++;
+      continue;
+    }
+    if (t.startsWith("-")) continue;
+    return t;
+  }
+  return null;
+}
 
 // src/detectors/no-verify.ts
 var RULE = "no-verify";
-var LITERAL = [
-  { re: /(?:^|\s)--no-verify(?:\s|$)/, why: "--no-verify skips the pre-commit/pre-push hooks" },
-  { re: /(?:^|\s)--no-hooks(?:\s|$)/, why: "--no-hooks disables hook execution" },
-  { re: /(?:^|[\s;&|=])HUSKY=0(?:\s|$)/, why: "HUSKY=0 disables all Husky hooks" },
-  { re: /\bHUSKY_SKIP_HOOKS=1\b/, why: "HUSKY_SKIP_HOOKS=1 skips Husky hooks" },
-  // git-native hook disabling. core.hooksPath is strictly MORE general than the
-  // flags above: it turns off husky, lefthook, plain .git/hooks and pre-commit
-  // alike, and it was reachable in three spellings the literal list missed
-  // (-c, `git config`, and GIT_CONFIG_* env injection). (P1-9, external review.)
+var RAW = [
   { re: /\bcore\.hooksPath\b/i, why: "core.hooksPath redirects git away from the installed hooks" },
-  { re: /\bGIT_CONFIG_KEY_\d+\s*=\s*["']?core\.hooksPath/i, why: "GIT_CONFIG_* injection sets core.hooksPath" },
-  { re: /(?:^|[\s;&|=])LEFTHOOK=0(?:\s|$)/, why: "LEFTHOOK=0 disables Lefthook hooks" },
-  { re: /\bSKIP_SIMPLE_GIT_HOOKS=1\b/, why: "SKIP_SIMPLE_GIT_HOOKS=1 skips simple-git-hooks" },
-  { re: /\bPRE_COMMIT_ALLOW_NO_CONFIG=1\b/, why: "PRE_COMMIT_ALLOW_NO_CONFIG=1 lets pre-commit no-op" },
-  // The pre-commit framework's own escape hatch: SKIP=<hook-id>[,…] skips those
-  // hooks for that one invocation. `.pre-commit-config.yaml` is a protected hook,
-  // so its documented bypass has to be one too. `SKIP=` is a plausible variable
-  // name elsewhere, so it counts only in a segment that runs git or pre-commit.
-  { re: /(?:^|[\s;&|])SKIP=\S+/, why: "SKIP=<hook-id> tells the pre-commit framework to skip that hook", when: /\b(?:git|pre-commit)\b/ },
-  { re: /(?:^|[\s;&|])LEFTHOOK_EXCLUDE=\S+/, why: "LEFTHOOK_EXCLUDE=<name> skips the named Lefthook commands" }
+  { re: /\bGIT_CONFIG_KEY_\d+\s*=\s*["']?core\.hooksPath/i, why: "GIT_CONFIG_* injection sets core.hooksPath" }
+];
+var ENV = [
+  { re: /^HUSKY=0$/, why: "HUSKY=0 disables all Husky hooks" },
+  { re: /^HUSKY_SKIP_HOOKS=1$/, why: "HUSKY_SKIP_HOOKS=1 skips Husky hooks" },
+  { re: /^LEFTHOOK=0$/, why: "LEFTHOOK=0 disables Lefthook hooks" },
+  { re: /^SKIP_SIMPLE_GIT_HOOKS=1$/, why: "SKIP_SIMPLE_GIT_HOOKS=1 skips simple-git-hooks" },
+  { re: /^PRE_COMMIT_ALLOW_NO_CONFIG=1$/, why: "PRE_COMMIT_ALLOW_NO_CONFIG=1 lets pre-commit no-op" },
+  { re: /^LEFTHOOK_EXCLUDE=./, why: "LEFTHOOK_EXCLUDE=<name> skips the named Lefthook commands" }
 ];
+var SKIP = /^SKIP=./;
+var SKIP_WHY = "SKIP=<hook-id> tells the pre-commit framework to skip that hook";
+var ENV_PREFIX = /^(?:export|env|sudo)$/;
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+var HOOK_SUBCOMMANDS = /* @__PURE__ */ new Set(["commit", "push", "merge"]);
+var NO_VERIFY = /^--no-veri(?:f|fy)?$/;
+var NO_HOOKS = "--no-hooks";
 var SHORT_N = /^-[a-z]*n[a-z]*$/i;
+var TAKES_VALUE = /* @__PURE__ */ new Set(["-m", "--message", "-F", "--file", "--author", "--date", "--trailer", "-c", "-C", "--reuse-message", "--reedit-message"]);
+function gitArgs(toks, sub) {
+  const out2 = [];
+  for (let j = toks.indexOf(sub) + 1; j < toks.length; j++) {
+    if (TAKES_VALUE.has(toks[j])) {
+      j++;
+      continue;
+    }
+    out2.push(toks[j]);
+  }
+  return out2;
+}
 var noVerify = {
   id: RULE,
   surface: ["command"],
@@ -389,24 +417,53 @@ var noVerify = {
     const out2 = [];
     for (const c of changes) {
       if (c.kind !== "command") continue;
+      let carriedSkip = null;
       for (const seg of segments(c.raw)) {
         let why = null;
-        for (const p of LITERAL) {
-          if (p.re.test(seg) && (!p.when || p.when.test(seg))) {
+        let evidence = seg;
+        for (const p of RAW) {
+          if (p.re.test(seg)) {
             why = p.why;
             break;
           }
         }
-        if (!why && /\bgit\b/.test(seg) && /\bcommit\b/.test(seg)) {
-          if (tokens(seg).some((t) => SHORT_N.test(t))) {
-            why = "git commit -n skips the pre-commit hook";
+        const toks = words(seg);
+        let k = 0;
+        while (k < toks.length && ENV_PREFIX.test(toks[k])) k++;
+        const exported = k > 0 && toks[0] === "export";
+        const assigns = [];
+        while (k < toks.length && ASSIGNMENT.test(toks[k])) assigns.push(toks[k++]);
+        const bareAssignment = k === toks.length && assigns.length > 0;
+        const sub = gitSubcommand(toks);
+        const runsHookTool = sub !== null || toks.includes("pre-commit");
+        if (!why) {
+          for (const a of assigns) {
+            const hit = ENV.find((p) => p.re.test(a));
+            if (hit) {
+              why = hit.why;
+              break;
+            }
+            if (SKIP.test(a)) {
+              if (runsHookTool) why = SKIP_WHY;
+              else if (exported || bareAssignment) carriedSkip = seg;
+            }
           }
         }
+        if (!why && carriedSkip && runsHookTool) {
+          why = `${SKIP_WHY} (set earlier in the same command)`;
+          evidence = `${carriedSkip}; ${seg}`;
+        }
+        if (!why && sub && HOOK_SUBCOMMANDS.has(sub)) {
+          const args = gitArgs(toks, sub);
+          if (args.some((t) => NO_VERIFY.test(t))) why = "--no-verify skips the pre-commit/pre-push hooks";
+          else if (sub === "commit" && args.some((t) => SHORT_N.test(t))) why = "git commit -n skips the pre-commit hook";
+        }
+        if (!why && toks.includes(NO_HOOKS)) why = "--no-hooks disables hook execution";
         if (why) {
           out2.push(
             makeFinding(RULE, policy, {
               message: `Command bypasses git hooks: ${why}.`,
-              evidence: seg,
+              evidence,
               remediation: "Let the hooks run and fix what they catch. Skipping verification is exactly the move this gate blocks \u2014 editing the hook and --no-hooks are blocked too."
             })
           );
@@ -645,12 +702,38 @@ function isSignificantLine(trimmed, lang) {
   if (HASH_COMMENT.has(l) && trimmed.startsWith("#")) return false;
   return true;
 }
+var SLASH_COMMENT = /^(?:\/\/|\/\*|\*(?:\s|\/|$))/;
+var HASH_COMMENT_LANGS = /* @__PURE__ */ new Set(["py", "rb", "php"]);
+function isCommentLine(trimmed, lang) {
+  const l = lang ?? "js";
+  if (HASH_COMMENT_LANGS.has(l) && trimmed.startsWith("#") && !trimmed.startsWith("#[")) return true;
+  if (l === "py" || l === "rb") return false;
+  return SLASH_COMMENT.test(trimmed);
+}
+function insideStringLiteral(line, idx, lang) {
+  const hash = HASH_COMMENT_LANGS.has(lang ?? "js");
+  let quote = null;
+  for (let j = 0; j < idx; j++) {
+    const ch = line[j];
+    if (quote) {
+      if (ch === "\\") j++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (ch === "/" && (line[j + 1] === "/" || line[j + 1] === "*")) return false;
+    else if (hash && ch === "#") return false;
+  }
+  return quote !== null;
+}
 
 // src/detectors/ts-any-cast.ts
 var BLOCK_RULE = "ts-any-cast";
 var WARN_RULE = "ts-any-launder";
 var DOUBLE_CAST = /\bas\s+unknown\s+as\b/g;
 var SUPPRESS = /@ts-(?:ignore|expect-error|nocheck)\b/g;
+var JSDOC_ANY_CAST = /\/\*\*\s*@type\s*\{\s*any\s*\}\s*\*\/\s*\(/g;
+var JS_FILE = /\.(?:js|jsx|mjs|cjs)$/;
 var countMatches = (s, re) => (s.match(re) || []).length;
 function countAny(src) {
   const r = { cast: 0, broad: 0 };
@@ -658,8 +741,13 @@ function countAny(src) {
     const sf = ts.createSourceFile("f.ts", src, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
     const visit = (node) => {
       if (node.kind === ts.SyntaxKind.AnyKeyword) {
-        const p = node.parent;
-        const isCast = p && ts.isAsExpression(p) && p.type === node || p && ts.isTypeAssertionExpression(p) && p.type === node;
+        let target = node;
+        let p = target.parent;
+        while (p && ts.isParenthesizedTypeNode(p)) {
+          target = p;
+          p = p.parent;
+        }
+        const isCast = p && ts.isAsExpression(p) && p.type === target || p && ts.isTypeAssertionExpression(p) && p.type === target;
         if (isCast) r.cast++;
         else r.broad++;
       }
@@ -670,7 +758,7 @@ function countAny(src) {
   }
   return r;
 }
-var NARROW_LINE = /\bas\s+any\b|<\s*any\s*>|\bas\s+unknown\s+as\b|@ts-(?:ignore|expect-error|nocheck)\b/;
+var NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>|\bas\s+unknown\s+as\b|@ts-(?:ignore|expect-error|nocheck)\b/;
 var BROAD_LINE = /:\s*any\b|<[^<>]*\bany\b[^<>]*>/;
 var BLOCK_REMEDIATION = "Fix the underlying type instead of silencing the checker; do not cast to `any`.";
 var WARN_REMEDIATION = "Prefer a precise type or `unknown` + a guard over `any` here \u2014 flagged for review.";
@@ -691,10 +779,12 @@ var tsAnyCast = {
         const dBroad = a.broad - b.broad;
         const dDouble = countMatches(c.after, DOUBLE_CAST) - countMatches(before, DOUBLE_CAST);
         const dSuppr = countMatches(c.after, SUPPRESS) - countMatches(before, SUPPRESS);
+        const dJsdoc = JS_FILE.test(c.path) ? countMatches(c.after, JSDOC_ANY_CAST) - countMatches(before, JSDOC_ANY_CAST) : 0;
         const blockReasons = [];
         if (dCast > 0) blockReasons.push("`as any` cast");
         if (dDouble > 0) blockReasons.push("`as unknown as` double cast");
         if (dSuppr > 0) blockReasons.push("@ts-ignore/@ts-expect-error/@ts-nocheck suppression");
+        if (dJsdoc > 0) blockReasons.push("JSDoc `@type {any}` cast");
         if (blockReasons.length) {
           out2.push(
             makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
@@ -719,8 +809,9 @@ var tsAnyCast = {
         }
         continue;
       }
+      const jsdocCast = JS_FILE.test(c.path) ? new RegExp(JSDOC_ANY_CAST.source) : null;
       for (const l of addedLines(c)) {
-        if (NARROW_LINE.test(l.content)) {
+        if (NARROW_LINE.test(l.content) || jsdocCast && jsdocCast.test(l.content)) {
           out2.push(
             makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
               file: c.path,
@@ -754,30 +845,47 @@ var RULE2 = "lint-suppression";
 var PATTERNS = {
   js: [
     { re: /eslint-disable(?:-next-line|-line)?\b/, why: "eslint-disable suppresses lint rules" },
+    // Inline config is the other spelling of the same directive: `/* eslint rule: off */`,
+    // `: "off"`, `: 0`, `: [0, …]`. `/* eslint-env */` and `/* eslint rule: "error" */` are not.
+    { re: /\/\*\s*eslint\s+(?!-)(?:[^*]*?[\s,])?[\w@/.-]+\s*:\s*\[?\s*(?:["']off["']|off\b|0\b)/, why: "an inline eslint config turns a rule off" },
     { re: /\bprettier-ignore\b/, why: "prettier-ignore suppresses formatting checks" },
     { re: /\bbiome-ignore\b/, why: "biome-ignore suppresses Biome diagnostics" }
   ],
   py: [
     { re: /#\s*noqa\b/, why: "# noqa suppresses flake8/ruff findings" },
+    { re: /#\s*(?:ruff|flake8):\s*noqa\b/, why: "# ruff: noqa / # flake8: noqa suppresses every finding in the file" },
     { re: /#\s*type:\s*ignore\b/, why: "# type: ignore suppresses the type checker" },
+    { re: /#\s*mypy:\s*ignore-errors\b/, why: "# mypy: ignore-errors suppresses the type checker for the file" },
     { re: /#\s*pyright:\s*ignore\b/, why: "# pyright: ignore suppresses the type checker" },
     { re: /#\s*pylint:\s*disable\b/, why: "# pylint: disable suppresses lint rules" },
+    { re: /#\s*pylint:\s*skip-file\b/, why: "# pylint: skip-file suppresses lint for the file" },
     { re: /#\s*nosec\b/, why: "# nosec suppresses bandit security findings" },
     { re: /#\s*fmt:\s*(?:off|skip)\b/, why: "# fmt: off/skip suppresses formatting checks" }
   ],
-  go: [{ re: /\/\/\s*nolint\b/, why: "//nolint suppresses golangci-lint findings" }],
+  go: [
+    { re: /\/\/\s*nolint\b/, why: "//nolint suppresses golangci-lint findings" },
+    { re: /\/\/\s*lint:ignore\b/, why: "//lint:ignore suppresses staticcheck findings" }
+  ],
   rs: [],
   rb: [{ re: /#\s*rubocop:\s*(?:disable|todo)\b/, why: "# rubocop:disable suppresses lint rules" }],
-  java: [{ re: /@SuppressWarnings\s*\(/, why: "@SuppressWarnings suppresses compiler and lint warnings" }],
-  kt: [{ re: /@Suppress(?:Warnings)?\s*\(/, why: "@Suppress suppresses compiler and lint warnings" }],
+  java: [
+    { re: /@SuppressWarnings\s*\(/, why: "@SuppressWarnings suppresses compiler and lint warnings" },
+    { re: /\/\/\s*NOSONAR\b/, why: "// NOSONAR suppresses SonarQube findings" }
+  ],
+  kt: [
+    { re: /@(?:file:)?Suppress(?:Warnings)?\s*\(/, why: "@Suppress suppresses compiler and lint warnings" },
+    { re: /\/\/\s*NOSONAR\b/, why: "// NOSONAR suppresses SonarQube findings" }
+  ],
   php: [
     { re: /\bphpcs:(?:ignore|disable)\b/, why: "phpcs:ignore/disable suppresses coding-standard checks" },
+    { re: /@codingStandardsIgnore(?:Line|Start|File)\b/, why: "@codingStandardsIgnore* suppresses coding-standard checks" },
     { re: /@phpstan-ignore\b/, why: "@phpstan-ignore suppresses static-analysis findings" },
     { re: /@psalm-suppress\b/, why: "@psalm-suppress suppresses static-analysis findings" }
   ],
   cs: [
     { re: /#pragma\s+warning\s+disable\b/, why: "#pragma warning disable suppresses compiler warnings" },
-    { re: /\[SuppressMessage\s*\(/, why: "[SuppressMessage] suppresses analyzer findings" }
+    { re: /\[SuppressMessage\s*\(/, why: "[SuppressMessage] suppresses analyzer findings" },
+    { re: /\/\/\s*ReSharper\s+disable\b/, why: "// ReSharper disable suppresses inspections" }
   ]
 };
 var lintSuppression = {
@@ -794,18 +902,18 @@ var lintSuppression = {
       if (patterns.length === 0) continue;
       for (const l of addedLines(c)) {
         for (const p of patterns) {
-          if (p.re.test(l.content)) {
-            out2.push(
-              makeFinding(RULE2, policy, {
-                file: c.path,
-                line: l.newLine ?? void 0,
-                message: `Lint suppression added: ${p.why}.`,
-                evidence: l.content.trim(),
-                remediation: "Resolve the finding rather than suppressing the rule."
-              })
-            );
-            break;
-          }
+          const m = p.re.exec(l.content);
+          if (!m || insideStringLiteral(l.content, m.index, lang)) continue;
+          out2.push(
+            makeFinding(RULE2, policy, {
+              file: c.path,
+              line: l.newLine ?? void 0,
+              message: `Lint suppression added: ${p.why}.`,
+              evidence: l.content.trim(),
+              remediation: "Resolve the finding rather than suppressing the rule."
+            })
+          );
+          break;
         }
       }
     }
@@ -817,40 +925,66 @@ var lintSuppression = {
 var RULE3 = "test-skip";
 var PATTERNS2 = {
   js: [
-    { re: /\b(?:it|test|describe)\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
-    { re: /\b(?:xit|xtest|xdescribe)\b/, why: "an x-prefixed disabled test" },
-    { re: /\b(?:fit|ftest|fdescribe)\b/, why: "an f-prefixed focused test (narrows the suite)" },
+    // vitest chains a concurrency modifier before the marker: it.concurrent.skip.
+    { re: /\b(?:it|test|describe|suite)(?:\.(?:concurrent|sequential|shuffle))?\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
+    { re: /\b(?:it|test|describe|suite)\.(?:skipIf|runIf)\s*\(/, why: "a .skipIf()/.runIf() condition (the test runs only when the condition allows)" },
+    { re: /\b(?:it|test)\.(?:fails|failing)\s*\(/, why: "a .fails/.failing marker (the test now passes by failing)" },
+    { re: /\b(?:it|test|describe)\.each\s*\(\s*\[\s*\]\s*\)/, why: "an empty .each table (no case ever runs)" },
+    { re: /\b(?:xit|xtest|xdescribe)\s*\(/, why: "an x-prefixed disabled test" },
+    { re: /\b(?:fit|ftest|fdescribe)\s*\(/, why: "an f-prefixed focused test (narrows the suite)" },
     { re: /\bpending\(\s*\)/, why: "a pending() marker" },
     // node:test spells the same class as options — `test('x', { skip: true }, ...)` — and as
     // a runtime call. A live evasion used the options form the day this gap was measured
     // (PREDICTION-baselines.md): denied the rm, the agent skipped by option instead.
-    { re: /\bskip:\s*(?:true|1|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
+    // In options position (right after the title) ANY value but false/0 skips — a
+    // non-literal `{ skip: process.env.CI }` included. Elsewhere on a line only the
+    // literal forms count: `list({ skip: 1, take: 5 })` is pagination.
+    { re: /\b(?:it|test|describe|suite)\s*\(\s*(['"`])(?:(?!\1).)*\1\s*,\s*\{[^}]*?\bskip:(?!\s*(?:false|0)\b)/, why: "a { skip: ... } option disabling the test (node:test options form)" },
+    { re: /\bskip:\s*(?:true|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
     { re: /\btodo:\s*(?:true|['"`])/, why: "a { todo: ... } option (the test no longer fails the run)" },
-    { re: /\b(?:t|ctx|context)\.skip\(/, why: "a runtime t.skip() call" }
+    { re: /\b(?:t|ctx|context|this)\.skip\(/, why: "a runtime t.skip()/this.skip() call" }
   ],
   py: [
-    { re: /@pytest\.mark\.(?:skip|skipif|xfail)\b/, why: "a pytest skip/skipif/xfail marker" },
+    // `import pytest as pt` makes the decorator `@pt.mark.skip`; the module alias is free.
+    { re: /@\w+\.mark\.(?:skip|skipif|xfail)\b/, why: "a pytest skip/skipif/xfail marker" },
+    { re: /\bpytestmark\s*=.*\.mark\.(?:skip|skipif|xfail)\b/, why: "a module-level pytestmark skip (every test in the file is skipped)" },
     { re: /\bpytest\.(?:skip|xfail|importorskip)\(/, why: "a runtime pytest.skip()/xfail() call" },
-    { re: /@unittest\.(?:skip|skipIf|skipUnless|expectedFailure)\b/, why: "a unittest skip/expectedFailure decorator" },
+    // `from unittest import skip` makes the decorator bare `@skip`.
+    { re: /@(?:unittest\.)?(?:skip|skipIf|skipUnless|expectedFailure)\b/, why: "a unittest skip/expectedFailure decorator" },
     { re: /\bself\.skipTest\(/, why: "a runtime self.skipTest() call" },
-    { re: /\braise\s+(?:unittest\.)?SkipTest\b/, why: "a raised SkipTest" }
+    { re: /\braise\s+(?:unittest\.)?SkipTest\b/, why: "a raised SkipTest" },
+    { re: /\b__test__\s*=\s*False\b/, why: "__test__ = False hides the test from collection" }
   ],
   go: [
-    { re: /\b[tb]\.Skip(?:f|Now)?\(/, why: "a runtime t.Skip()/Skipf()/SkipNow() call" }
+    { re: /\b[tb]\.Skip(?:f|Now)?\(/, why: "a runtime t.Skip()/Skipf()/SkipNow() call" },
+    { re: /\bif\s+testing\.Short\(\)/, why: "a testing.Short() guard (the body is skipped under -short)" },
+    { re: /^\s*\/\/\s*(?:go:build|\+build)\s+ignore\b/, why: "a build-ignore constraint (the file is excluded from the test run)", comment: true }
+  ],
+  rs: [
+    { re: /#\[ignore\b/, why: "an #[ignore] attribute (the test no longer runs by default)" },
+    { re: /#\[cfg_attr\(.*\bignore\b/, why: "a cfg_attr(\u2026, ignore) attribute (the test is ignored under that configuration)" }
   ],
-  rs: [{ re: /#\[ignore\b/, why: "an #[ignore] attribute (the test no longer runs by default)" }],
   rb: [
-    { re: /(?:^|[\s;{(])(?:skip|pending)(?:\s*\(|\s+['"]|\s+(?:if|unless)\b|\s*$)/, why: "a skip/pending call" },
-    { re: /\bx(?:it|describe|context|specify|example)\b/, why: "an x-prefixed disabled example" },
-    { re: /\b(?:fit|fdescribe|fcontext)\b/, why: "an f-prefixed focused example (narrows the suite)" },
-    { re: /\b(?:skip|pending):\s*(?:true|['"])/, why: "a skip:/pending: metadata flag" }
+    { re: /(?:^|[\s;{(])(?:skip|pending)(?:\s*\(|\s+['"]|\s+(?:if|unless)\b|\s*\}|\s*$)/, why: "a skip/pending call" },
+    { re: /(?:^|[\s;{(])x(?:it|describe|context|specify|example)\s*[('"]/, why: "an x-prefixed disabled example" },
+    { re: /(?:^|[\s;{(])f(?:it|describe|context)\s*[('"]/, why: "an f-prefixed focused example (narrows the suite)" },
+    { re: /\b(?:skip|pending):\s*(?:true|['"])/, why: "a skip/pending metadata flag" },
+    { re: /^\s*(?:it|specify|example)\s+(['"])(?:(?!\1).)*\1\s*$/, why: "an example with no block (RSpec reports it as pending)" }
+  ],
+  java: [
+    { re: /@(?:[\w.]+\.)?(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" },
+    { re: /\bassume(?:True\(\s*false|False\(\s*true)\s*[,)]/, why: "an assumption that never holds (the test aborts as skipped)" }
+  ],
+  kt: [
+    { re: /@(?:[\w.]+\.)?(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" },
+    { re: /\bassume(?:True\(\s*false|False\(\s*true)\s*[,)]/, why: "an assumption that never holds (the test aborts as skipped)" }
   ],
-  java: [{ re: /@(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" }],
-  kt: [{ re: /@(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" }],
   php: [{ re: /\bmarkTest(?:Skipped|Incomplete)\(/, why: "a markTestSkipped()/markTestIncomplete() call" }],
   cs: [
     { re: /\[Ignore\b/, why: "an [Ignore] attribute" },
-    { re: /\bSkip\s*=\s*"/, why: 'a Skip = "..." attribute argument' }
+    { re: /\bSkip\s*=\s*"/, why: 'a Skip = "..." attribute argument' },
+    { re: /(?:\[|,)\s*Explicit\b/, why: "an [Explicit] attribute (the test runs only when selected by name)" },
+    { re: /\bAssert\.Inconclusive\(/, why: "an Assert.Inconclusive() call (the test ends without a verdict)" }
   ]
 };
 var testSkip = {
@@ -862,9 +996,12 @@ var testSkip = {
     for (const c of changes) {
       if (c.kind !== "file") continue;
       if (!isProtected(c.path, policy, "tests")) continue;
-      const patterns = PATTERNS2[langOf(c.path) ?? "js"];
+      const lang = langOf(c.path);
+      const patterns = PATTERNS2[lang ?? "js"];
       for (const l of addedLines(c)) {
+        const comment = isCommentLine(l.content.trim(), lang);
         for (const p of patterns) {
+          if (comment && !p.comment) continue;
           if (p.re.test(l.content)) {
             out2.push(
               makeFinding(RULE3, policy, {
@@ -1654,10 +1791,13 @@ var testContentRemoval = {
 // src/detectors/snapshot-rewrite.ts
 var RULE9 = "snapshot-rewrite";
 var RUNNER = /\b(?:jest|vitest|playwright|ava)\b/;
-var UPDATE_ANY = /--update-?[sS]napshots?\b/;
+var PM_TEST_SCRIPT = /(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:t|tst|test|run(?:-script)?\s+\S*test\S*)(?:\s|$)/;
+var UPDATE_ANY = /--(?:update-?[sS]napshots?|test-update-snapshots|snapshot-update)\b/;
 var UPDATE_WITH_RUNNER = /(?:^|\s)(?:-u|--update)(?:\s|$)/;
+var INSTA_ACCEPT = /\bcargo\s+insta\s+(?:accept\b|.*\s--accept\b)/;
+var UPDATE_EXPECT = /(?:^|\s)UPDATE_EXPECT=\S+/;
 var REGEN_SCRIPT = /\b(?:update|regen(?:erate)?|re?bless)[-_.]?(?:golden|snapshots?|baselines?|expected)\b/i;
-var MUTATE = /(?:^|\s)(?:rm|cp|mv|tee|truncate|dd)(?:\s|$)|sed\s+-i|>{1,2}/;
+var MUTATE = /(?:^|\s)(?:rm|cp|mv|tee|truncate|dd)(?:\s|$)|sed\s+-i|>{1,2}|\bfind\b.*\s-(?:delete\b|exec\s+rm\b)|\bgit\s+(?:checkout|restore)\b/;
 function namesProtectedSnapshot(seg, policy) {
   for (const t of tokens(seg)) {
     const path = unquote(t).replace(/^>{1,2}/, "");
@@ -1677,7 +1817,9 @@ var snapshotRewrite = {
         for (const seg of segments(c.raw)) {
           let why = null;
           if (UPDATE_ANY.test(seg)) why = "the snapshot-update flag rewrites every failing snapshot to match current output";
-          else if (RUNNER.test(seg) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
+          else if ((RUNNER.test(seg) || PM_TEST_SCRIPT.test(seg)) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
+          else if (INSTA_ACCEPT.test(seg)) why = "cargo insta accept rewrites every pending snapshot to match current output";
+          else if (UPDATE_EXPECT.test(seg)) why = "UPDATE_EXPECT=1 rewrites every expect-test expectation to match current output";
           else if (REGEN_SCRIPT.test(seg)) why = "a regeneration script rewrites the recorded expected output from current output";
           else {
             const path = MUTATE.test(seg) ? namesProtectedSnapshot(seg, policy) : null;
@@ -2591,7 +2733,7 @@ function savePtree(cwd, sessionId, tree) {
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2, watch } from "node:fs";
 import { join as join7 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
-var SKIP = /(^|\/)(\.git|node_modules)(\/|$)/;
+var SKIP2 = /(^|\/)(\.git|node_modules)(\/|$)/;
 function snap(abs2) {
   try {
     const st = statSync2(abs2);
@@ -2618,7 +2760,7 @@ function watchTree(dir, cb) {
   }
   const watchers = /* @__PURE__ */ new Map();
   const addDir = (rel) => {
-    if (watchers.has(rel) || SKIP.test(rel + "/")) return;
+    if (watchers.has(rel) || SKIP2.test(rel + "/")) return;
     let w;
     try {
       w = watch(rel ? join7(dir, rel) : dir, (kind, fname) => {
@@ -2645,7 +2787,7 @@ function watchTree(dir, cb) {
     }
     for (const name of names) {
       const child = rel ? `${rel}/${name}` : name;
-      if (SKIP.test(child + "/")) continue;
+      if (SKIP2.test(child + "/")) continue;
       try {
         if (statSync2(join7(dir, child)).isDirectory()) walk(child);
       } catch {
@@ -2664,7 +2806,7 @@ function startWatcher(dir, log, policy) {
   }
   const last = /* @__PURE__ */ new Map();
   return watchTree(dir, (kind, rel) => {
-    if (SKIP.test(rel) || !isProtected(rel, policy)) return;
+    if (SKIP2.test(rel) || !isProtected(rel, policy)) return;
     const s = snap(join7(dir, rel));
     const key2 = `${s.hash}:${s.mode}`;
     if (last.get(rel) === key2) return;
@@ -3765,18 +3907,62 @@ var VERIFICATION_SURFACE = [
   "**/setup.cfg",
   "**/tox.ini",
   "**/pyproject.toml",
+  "**/setup.py",
+  // a pytest rootdir marker, and what an editable install executes
+  // Interpreter start-up hooks: imported by site.py before pytest exists,
+  // wherever the tree reaches sys.path (PYTHONPATH=., an editable install).
+  "**/sitecustomize.py",
+  "**/usercustomize.py",
   // JavaScript / TypeScript runners and the transforms they load
   "**/jest.config.*",
   "**/jest.setup.*",
   "**/vitest.config.*",
   "**/vitest.workspace.*",
   "**/.mocharc.*",
+  "**/mocha.opts",
   "**/karma.conf.*",
+  "**/ava.config.*",
+  "**/.taprc",
+  "**/spec/support/jasmine.json",
+  "**/playwright.config.*",
+  "**/cypress.config.*",
+  "**/.nycrc*",
+  "**/.c8rc*",
   "**/babel.config.*",
   "**/.babelrc*",
   "**/vite.config.*",
   "**/.swcrc",
   "**/package.json",
+  // Package-manager configuration: read before the runner starts, and able to
+  // choose what the runner is started under (`node-options`), which shell runs
+  // the script (`script-shell`), or which program is run at all (`yarn-path`).
+  "**/.npmrc",
+  "**/.yarnrc",
+  "**/.yarnrc.yml",
+  // pnpm 10 reads its settings (`nodeOptions` among them) from here as well,
+  // and its environment layer does NOT outrank this file (verified, pnpm
+  // 10.33) — so the file list is the only control for it.
+  "**/pnpm-workspace.yaml",
+  "**/.pnpmfile.cjs",
+  // The runner the package manager executes when the project pins one: yarn's
+  // `yarnPath` release and its plugins, and the PnP loader every spawned node
+  // is made to `--require`.
+  "**/.yarn/releases/*",
+  "**/.yarn/plugins/**",
+  "**/.pnp.cjs",
+  "**/.pnp.js",
+  "**/.pnp.loader.mjs",
+  // dotenv files: `node --env-file`, a jest/vitest setup that loads dotenv,
+  // pytest-dotenv. An .env carries NODE_OPTIONS as easily as an .npmrc does.
+  "**/.env",
+  "**/.env.*",
+  // Version-manager pins: which interpreter the shims select for this cwd.
+  "**/.nvmrc",
+  "**/.node-version",
+  "**/.python-version",
+  // What git does to content on its way into and out of the tree — the base's
+  // decision, never the candidate's.
+  "**/.gitattributes",
   // Ruby / PHP / .NET
   "**/.rspec",
   "**/phpunit.xml",
@@ -3922,6 +4108,31 @@ const timer = setTimeout(() => finish({ timedOut: true }), Number(budgetMs));
 child.on('error', (e) => { clearTimeout(timer); finish({ error: String(e) }); });
 child.on('exit', (code, signal) => { clearTimeout(timer); finish({ exit: code, signal }); });
 `;
+var DROPPED_ENV = /* @__PURE__ */ new Set([
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "NODE_REPL_EXTERNAL_MODULE",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PYTEST_ADDOPTS",
+  "PYTEST_PLUGINS"
+]);
+var PINNED_NPM = /^npm_config_(node_options|userconfig|globalconfig)$/i;
+function suiteEnv(scratch) {
+  const env = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
+    env[k] = v;
+  }
+  const userRc = join11(scratch, "npmrc-user");
+  const globalRc = join11(scratch, "npmrc-global");
+  for (const f of [userRc, globalRc]) writeFileSync6(f, "", { mode: 292 });
+  env.npm_config_userconfig = userRc;
+  env.npm_config_globalconfig = globalRc;
+  env.npm_config_node_options = " ";
+  env.YARN_IGNORE_PATH = "1";
+  return env;
+}
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
   const outDir = mkdtempSync2(join11(tmpdir2(), "tw-verify-run-"));
@@ -3929,6 +4140,7 @@ function runSuite(dir, cmd, budgetSecs) {
   try {
     spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
       cwd: dir,
+      env: suiteEnv(outDir),
       stdio: "ignore",
       timeout: budgetSecs * 1e3 + 3e4,
       // backstop only; the supervisor enforces the budget
@@ -3951,6 +4163,10 @@ function runSuite(dir, cmd, budgetSecs) {
 function runVerify(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const out2 = (s) => void process.stdout.write(s + "\n");
+  if (opts.invalid) {
+    out2(`verify: ${opts.invalid} \u2014 failing closed`);
+    return 2;
+  }
   let policy;
   try {
     if (opts.policyOverride) policy = opts.policyOverride;
@@ -4094,15 +4310,32 @@ function runVerify(opts) {
 }
 function parseVerify(args) {
   const o = {};
+  const value = (i, flag) => {
+    const v = args[i + 1];
+    if (v === void 0 || v.startsWith("--")) {
+      o.invalid ??= `${flag} needs a value` + (v === void 0 ? "" : ` (got the flag "${v}")`);
+      return void 0;
+    }
+    return v;
+  };
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
-    if (a === "--base" && args[i + 1]) o.base = args[++i];
-    else if (a === "--cmd" && args[i + 1]) o.cmd = args[++i];
-    else if (a === "--budget" && args[i + 1]) o.budget = Number(args[++i]);
-    else if (a === "--json") o.json = true;
+    if (a === "--json") o.json = true;
     else if (a === "--keep") o.keep = true;
     else if (a === "--require-ancestor") o.requireAncestor = true;
-    else if (a === "--cwd" && args[i + 1]) o.cwd = args[++i];
+    else if (a === "--base" || a === "--cmd" || a === "--cwd" || a === "--budget") {
+      const v = value(i, a);
+      if (v === void 0) continue;
+      i++;
+      if (a === "--base") o.base = v;
+      else if (a === "--cmd") o.cmd = v;
+      else if (a === "--cwd") o.cwd = v;
+      else {
+        o.budget = Number(v);
+        if (!Number.isFinite(o.budget) || o.budget <= 0)
+          o.invalid ??= `--budget needs a positive number of seconds (got "${v}")`;
+      }
+    }
   }
   return o;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",