tamperward 2.23.10 → 2.23.11

package/dist/cli/index.js

@@ -4890,13 +4890,7 @@ var init_hook_wiring = __esm({
   }
 });
 
-// src/detectors/ci-tampering.ts
-function isActiveWorkflow(path) {
-  return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
-}
-function commandCore(line) {
-  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
-}
+// src/detectors/gh-expression.ts
 function foldExpressions(s) {
   return s.replace(/\$\{\{([^}]*)\}\}/g, (_m, e) => {
     const v = foldConst(e.trim());
@@ -4904,90 +4898,6 @@ function foldExpressions(s) {
     return /\b(?:matrix|strategy|inputs)\./.test(e) ? MATRIX_TOKEN : EXPR_TOKEN;
   });
 }
-function canonical(core) {
-  let s = foldExpressions(core.replace(/^(['"])(.*)\1$/, "$2").trim()).replace(MATRIX_FLAG, " ").replace(/\s+/g, " ").trim();
-  s = s.replace(/^(?:cd|pushd)\s+\S+\s*&&\s*/, "");
-  s = s.replace(/^(?:npx|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx)|bunx|bun\s+x)\s+/, "exec ");
-  s = s.replace(/^(?:npm|pnpm|yarn|bun)\s+(?:run(?:-script)?\s+)?/, "exec ");
-  s = s.replace(/^exec\s+(?:t|tst)(?=\s|$)/, "exec test");
-  s = s.replace(/^exec\s+/, "");
-  return s.replace(/\s+--\s*$/, "").trim();
-}
-function runnerNarrowed(cmd, args) {
-  const t = RUNNER_NARROWINGS.find((x) => x.runner.test(cmd));
-  return t !== void 0 && t.flags.test(" " + args.trim());
-}
-function coverageFloorLowered(removed, added) {
-  const was = removed.match(COVERAGE_FLOOR);
-  const now = added.match(COVERAGE_FLOOR);
-  return was !== null && now !== null && Number(now[1]) < Number(was[1]);
-}
-function inCommandPosition(core) {
-  return canonical(core).split(/\s*(?:&&|\|\||;|\|)\s*/).some((seg) => CHECK_HEAD.test(canonical(seg.replace(COMMAND_PREFIX, ""))));
-}
-function narrowedByPositional(args) {
-  const toks = args.trim().split(/\s+/).filter(Boolean);
-  for (let i = 0; i < toks.length; i++) {
-    const t = toks[i];
-    if (t === "--" || t.startsWith("-")) continue;
-    const prev = toks[i - 1];
-    if (prev && (prev.startsWith("-") && prev !== "--" && !prev.includes("=") || /[<>]/.test(prev))) continue;
-    if (/[<>|;&]/.test(t)) continue;
-    if (PATH_SHAPED.test(t)) return true;
-  }
-  return false;
-}
-function checkKind(core) {
-  if (!invokesCheck(core)) return null;
-  const s = canonical(core);
-  if (/\btamperward\b/.test(s)) return "gate";
-  if (/\b(?:lint|eslint|biome|oxlint|golangci-lint|ruff)\b/i.test(s)) return "lint";
-  if (/\b(?:typecheck|type-check|tsc|tsgo|mypy)\b|\bdeno\s+check\b/i.test(s)) return "types";
-  return "test";
-}
-function survives(removedCore, isUses, afterCores, addedCores) {
-  if (isUses) {
-    const ref = usesRef(removedCore);
-    return afterCores.some((a) => usesRef(a) === ref) ? { state: "kept" } : { state: "gone" };
-  }
-  const r = canonical(removedCore);
-  const kind = checkKind(removedCore);
-  const narrowed = (args) => kind === "test" && narrowedByPositional(args);
-  let neutralised;
-  for (const raw of afterCores) {
-    const a = canonical(raw);
-    if (a === r) return { state: "kept" };
-    if (a.startsWith(r + " ")) {
-      const rest = a.slice(r.length);
-      if (NEUTRALISING_SUFFIX.test(rest) || narrowed(rest) || runnerNarrowed(a, rest)) neutralised ??= raw;
-      else return { state: "kept" };
-    } else if (r.startsWith(a + " ") && invokesCheck(a)) {
-      return { state: "kept" };
-    } else {
-      const w = a.match(TIMEOUT_WRAP);
-      if (w && (canonical(w[1]) === r || canonical(w[1]).startsWith(r + " "))) neutralised ??= raw;
-    }
-  }
-  let respelled = false;
-  for (const raw of addedCores) {
-    if (!kind || checkKind(raw) !== kind) continue;
-    const a = canonical(raw);
-    if (a.match(TIMEOUT_WRAP)) {
-      neutralised ??= raw;
-      continue;
-    }
-    if (!inCommandPosition(raw)) continue;
-    if (coverageFloorLowered(r, a)) {
-      neutralised ??= raw;
-      continue;
-    }
-    const args = a.slice(a.indexOf(" ") + 1 || a.length);
-    if (a.includes(" ") && (NEUTRALISING_SUFFIX.test(" " + args) || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
-    else respelled = true;
-  }
-  if (respelled) return { state: "kept" };
-  return neutralised ? { state: "neutralised", by: neutralised } : { state: "gone" };
-}
 function lex(src) {
   const out3 = [];
   let i = 0;
@@ -5177,6 +5087,329 @@ function callConst(name, args) {
       return void 0;
   }
 }
+var EXPR_TOKEN, MATRIX_TOKEN, TRUTHY, truthy;
+var init_gh_expression = __esm({
+  "src/detectors/gh-expression.ts"() {
+    "use strict";
+    EXPR_TOKEN = "__expr__";
+    MATRIX_TOKEN = "__matrix__";
+    TRUTHY = Symbol("truthy");
+    truthy = (v) => v === TRUTHY ? true : typeof v === "string" ? v !== "" : typeof v === "number" ? v !== 0 : v === true;
+  }
+});
+
+// src/detectors/invocation.ts
+function canonical(core) {
+  let s = foldExpressions(core.replace(/^(['"])(.*)\1$/, "$2").trim()).replace(MATRIX_FLAG, " ").replace(/\s+/g, " ").trim();
+  s = s.replace(/^(?:cd|pushd)\s+\S+\s*&&\s*/, "");
+  s = s.replace(/^(?:npx|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx)|bunx|bun\s+x)\s+/, "exec ");
+  s = s.replace(/^(?:npm|pnpm|yarn|bun)\s+(?:run(?:-script)?\s+)?/, "exec ");
+  s = s.replace(/^exec\s+(?:t|tst)(?=\s|$)/, "exec test");
+  s = s.replace(/^exec\s+/, "");
+  return s.replace(/\s+--\s*$/, "").trim();
+}
+function runnerNarrowed(cmd, args) {
+  return runnerNarrowing(cmd, args) !== null;
+}
+function runnerNarrowing(cmd, args) {
+  const t = RUNNER_NARROWINGS.find((x) => x.runner.test(cmd));
+  const m = t ? (" " + args.trim()).match(t.flags) : null;
+  return m ? m[0].trim().replace(/[=\s].*$/, "") : null;
+}
+function coverageFloorLowered(removed, added) {
+  const was = removed.match(COVERAGE_FLOOR);
+  const now = added.match(COVERAGE_FLOOR);
+  return was !== null && now !== null && Number(now[1]) < Number(was[1]);
+}
+function inCommandPosition(core) {
+  return canonical(core).split(/\s*(?:&&|\|\||;|\|)\s*/).some((seg) => CHECK_HEAD.test(canonical(seg.replace(COMMAND_PREFIX, ""))));
+}
+function narrowedByPositional(args) {
+  return positionalOf(args) !== null;
+}
+function positionalOf(args) {
+  const toks = args.trim().split(/\s+/).filter(Boolean);
+  for (let i = 0; i < toks.length; i++) {
+    const t = toks[i];
+    if (t === "--" || t.startsWith("-")) continue;
+    const prev = toks[i - 1];
+    if (prev && (prev.startsWith("-") && prev !== "--" && !prev.includes("=") || /[<>]/.test(prev))) continue;
+    if (/[<>|;&]/.test(t)) continue;
+    if (PATH_SHAPED.test(t)) return t;
+  }
+  return null;
+}
+function checkKind(core) {
+  if (!invokesCheck(core)) return null;
+  const s = canonical(core);
+  if (/\btamperward\b/.test(s)) return "gate";
+  if (/\b(?:lint|eslint|biome|oxlint|golangci-lint|ruff)\b/i.test(s)) return "lint";
+  if (/\b(?:typecheck|type-check|tsc|tsgo|mypy)\b|\bdeno\s+check\b/i.test(s)) return "types";
+  return "test";
+}
+function survives(removedCore, isUses, afterCores, addedCores) {
+  if (isUses) {
+    const ref = usesRef(removedCore);
+    return afterCores.some((a) => usesRef(a) === ref) ? { state: "kept" } : { state: "gone" };
+  }
+  const r = canonical(removedCore);
+  const kind = checkKind(removedCore);
+  const narrowed = (args) => kind === "test" && narrowedByPositional(args);
+  let neutralised;
+  for (const raw of afterCores) {
+    const a = canonical(raw);
+    if (a === r) return { state: "kept" };
+    if (a.startsWith(r + " ")) {
+      const rest = a.slice(r.length);
+      if (NEUTRALISING_SUFFIX.test(rest) || narrowed(rest) || runnerNarrowed(a, rest)) neutralised ??= raw;
+      else return { state: "kept" };
+    } else if (r.startsWith(a + " ") && invokesCheck(a)) {
+      return { state: "kept" };
+    } else {
+      const w = a.match(TIMEOUT_WRAP);
+      if (w && (canonical(w[1]) === r || canonical(w[1]).startsWith(r + " "))) neutralised ??= raw;
+    }
+  }
+  let respelled = false;
+  for (const raw of addedCores) {
+    if (!kind || checkKind(raw) !== kind) continue;
+    const a = canonical(raw);
+    if (a.match(TIMEOUT_WRAP)) {
+      neutralised ??= raw;
+      continue;
+    }
+    if (!inCommandPosition(raw)) continue;
+    if (coverageFloorLowered(r, a)) {
+      neutralised ??= raw;
+      continue;
+    }
+    const args = a.slice(a.indexOf(" ") + 1 || a.length);
+    if (a.includes(" ") && (NEUTRALISING_SUFFIX.test(" " + args) || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
+    else respelled = true;
+  }
+  if (respelled) return { state: "kept" };
+  return neutralised ? { state: "neutralised", by: neutralised } : { state: "gone" };
+}
+function unwrap(seg) {
+  const s = seg.trim().replace(PYTHON_M, "").replace(NODE_BIN, "$1").replace(BIN_OF, "$1$2");
+  if (invokesCheck(s) || PRINTER.test(s) || /^["']/.test(s)) return s;
+  const toks = s.split(/\s+/);
+  for (let i = 1; i < toks.length && i <= 16; i++) {
+    const rest = toks.slice(i).join(" ");
+    if (invokesCheck(rest)) return rest;
+  }
+  return s;
+}
+function scriptKind3(inner) {
+  const kind = checkKind(inner);
+  if (!kind) return null;
+  const head = canonical(inner).match(/^(tests?|lint|type-?check|coverage)(?=[\s:]|$)/i)?.[1];
+  if (!head) return kind;
+  return /^type/i.test(head) ? "types" : /^lint/i.test(head) ? "lint" : "test";
+}
+function runnerOfSegment(canon) {
+  const m = canon.match(RUNNER_NAME);
+  if (!m) return null;
+  const n = m[1];
+  return n === "jest" || n === "vitest" || n === "mocha" || n === "pytest" || n === "go" || n === "cargo" ? n : "node";
+}
+function statements(raw) {
+  const out3 = [];
+  let single = false;
+  let double = false;
+  let last = 0;
+  for (let i = 0; i < raw.length; i++) {
+    const ch = raw[i];
+    if (ch === "\\" && !single) {
+      i++;
+      continue;
+    }
+    if (ch === "'" && !double) {
+      single = !single;
+      continue;
+    }
+    if (ch === '"' && !single) {
+      double = !double;
+      continue;
+    }
+    if (single || double) continue;
+    const prev = raw[i - 1];
+    const next = raw[i + 1];
+    let op = null;
+    if (ch === "&" && next === "&") op = "&&";
+    else if (ch === "|" && next === "|") op = "||";
+    else if (ch === "|" && next === "&") op = "|&";
+    else if (ch === ";" || ch === "\n") op = ";";
+    else if (ch === "|" && prev !== ">") op = "|";
+    else if (ch === "&" && prev !== ">" && next !== ">") op = "&";
+    if (!op) continue;
+    out3.push({ seg: raw.slice(last, i).trim(), op });
+    i += op.length - 1;
+    last = i + 1;
+  }
+  out3.push({ seg: raw.slice(last).trim(), op: null });
+  return out3.filter((s) => s.seg !== "");
+}
+function descriptors(cmd, runner, opts) {
+  const out3 = [];
+  const stmts = statements(cmd);
+  for (let i = 0; i < stmts.length; i++) {
+    const { seg, op } = stmts[i];
+    const wrapped = seg.match(TIMEOUT_WRAP);
+    const inner = unwrap(wrapped ? wrapped[1] : seg);
+    if (!invokesCheck(inner)) continue;
+    const kind = scriptKind3(inner);
+    const canon = canonical(inner);
+    const rn = runner ?? runnerOfSegment(canon);
+    const args = canon.includes(" ") ? " " + canon.slice(canon.indexOf(" ") + 1) : " ";
+    if (wrapped) out3.push({ key: "timeout", what: "a timeout wrapper", direction: "added" });
+    const following = stmts[i + 1]?.seg ?? "";
+    if (op === "||" || op === "|" || op === "&" || op === ";" && !invokesCheck(unwrap(following))) {
+      out3.push({ key: `op:${op}`, what: `${op} ${following.split(/\s+/).slice(0, 2).join(" ")}`.trim(), direction: "added" });
+    }
+    for (const re of MASKING_FLAGS) {
+      const f = spelled(re, args);
+      if (f) out3.push({ key: `flag:${f}`, what: f, direction: "added" });
+    }
+    for (const re of GATE_FLAGS) {
+      const f = spelled(re, " " + seg);
+      if (f) out3.push({ key: `gate:${f}`, what: f, direction: "removed" });
+    }
+    if (kind !== "test" || opts.sliceByDesign || opts.extended?.has(kind)) continue;
+    const flags = [SUITE_NARROWING_FLAGS, ...NARROWING_BY_RUNNER["*"], ...rn ? NARROWING_BY_RUNNER[rn] : []];
+    for (const re of flags) {
+      const f = spelled(re, args);
+      if (f && !opts.excuseFlag?.(f, canon)) out3.push({ key: `flag:${f}`, what: f, direction: "added" });
+    }
+    if (rn === "cargo" && CARGO_SKIP.test(args)) out3.push({ key: "flag:-- --skip", what: "-- --skip", direction: "added" });
+    const shared = runnerNarrowing(canon, args);
+    if (shared && !opts.excuseFlag?.(shared, canon)) out3.push({ key: `flag:${shared}`, what: shared, direction: "added" });
+    if (opts.fresh) continue;
+    const cfg = args.match(CONFIG_FLAG);
+    if (cfg && !opts.configReviewed?.(cfg[3])) out3.push({ key: `config:${cfg[3]}`, what: `${cfg[1]} ${cfg[3]}`, direction: "added" });
+    const pos = positionalOf(args);
+    if (pos) out3.push({ key: "positional", what: `a path positional (${pos})`, direction: "added" });
+  }
+  return out3;
+}
+function checkStatements(cmd) {
+  const out3 = [];
+  for (const seg of segments(cmd)) {
+    const w = seg.match(TIMEOUT_WRAP);
+    const inner = unwrap(w ? w[1] : seg);
+    const kind = scriptKind3(inner);
+    if (kind) out3.push({ kind, canon: canonical(inner) });
+  }
+  return out3;
+}
+function checkKinds(cmd) {
+  return new Set(checkStatements(cmd).map((s) => s.kind));
+}
+function failsLoudly(cmd) {
+  const last = segments(cmd).pop();
+  return last !== void 0 && FAILS_LOUDLY.test(last.trim());
+}
+function invocationWeakening(before, after, runner, opts = {}) {
+  const was = checkKinds(before);
+  const now = checkKinds(after);
+  if (now.size === 0 && failsLoudly(after)) return { state: "kept" };
+  for (const k of was) {
+    if (now.has(k) || opts.relocated?.(k)) continue;
+    const instead = [...now].filter((x) => !was.has(x));
+    return { state: "removed", kind: k, what: instead.length ? `runs a ${instead.join("/")} check instead` : now.size ? "the check is gone" : "no check is run" };
+  }
+  const survived = new Set(checkStatements(before).map((s) => s.canon));
+  const extended = new Set(checkStatements(after).filter((s) => survived.has(s.canon)).map((s) => s.kind));
+  const read = { ...opts, fresh: was.size === 0, extended };
+  const beforeDs = descriptors(before, runner, read);
+  const afterDs = descriptors(after, runner, read);
+  const seenBefore = new Set(beforeDs.map((d) => d.key));
+  const added = afterDs.find((d) => d.direction === "added" && !seenBefore.has(d.key));
+  if (added) return { state: "neutralised", what: added.what, direction: "added" };
+  if (coverageFloorLowered(before, after)) return { state: "neutralised", what: "a lowered --cov-fail-under", direction: "added" };
+  const seenAfter = new Set(afterDs.map((d) => d.key));
+  const dropped = beforeDs.find((d) => d.direction === "removed" && !seenAfter.has(d.key));
+  if (dropped) return { state: "neutralised", what: dropped.what, direction: "removed" };
+  return { state: "kept" };
+}
+var INVOKES_TOOL, INVOKES_SCRIPT, invokesCheck, MATRIX_FLAG, usesRef, SUITE_NARROWING_FLAGS, NEUTRALISING_SUFFIX, TIMEOUT_WRAP, RUNNER_NARROWINGS, COVERAGE_FLOOR, COMMAND_PREFIX, CHECK_HEAD, PATH_SHAPED, NARROWING_BY_RUNNER, CARGO_SKIP, MASKING_FLAGS, GATE_FLAGS, CONFIG_FLAG, PRINTER, PYTHON_M, NODE_BIN, BIN_OF, RUNNER_NAME, spelled, FAILS_LOUDLY;
+var init_invocation = __esm({
+  "src/detectors/invocation.ts"() {
+    "use strict";
+    init_gh_expression();
+    init_command();
+    INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint|node\s+--test|biome\s+(?:ci|check|lint)|deno\s+(?:test|lint|check)|ruff\s+check)\b/;
+    INVOKES_SCRIPT = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|tests|lint|typecheck|type-check|coverage)\b|\b(?:make|cargo|go)\s+test\b|\bgradle\w*\s+(?:test|check)\b/;
+    invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line);
+    MATRIX_FLAG = new RegExp(`(?:^|\\s)-{1,2}[\\w-]+(?:=|\\s+)${MATRIX_TOKEN}(?:/\\S*)?(?=\\s|$)`, "g");
+    usesRef = (core) => core.replace(/@.*$/, "");
+    SUITE_NARROWING_FLAGS = /--testPathIgnorePatterns\b|--testPathPattern\b|--testNamePattern\b|(?:^|\s)-t\s|--onlyChanged\b|--changed\b|--findRelatedTests\b|--exclude\b|--dir\b|--project\b/;
+    NEUTRALISING_SUFFIX = new RegExp(
+      `\\|\\||;|(?<!&)&(?!&)|\\|(?!\\|)|--passWithNoTests\\b|--coverage=false\\b|--coverageThreshold\\b|${SUITE_NARROWING_FLAGS.source}`
+    );
+    TIMEOUT_WRAP = /^timeout\s+(?:-{1,2}\S+\s+)*\d\S*\s+(.+)$/;
+    RUNNER_NARROWINGS = [
+      {
+        // a package-manager script: `test --prefix dir`, `-w pkg`, `--workspace=pkg`,
+        // `--if-present` (no script, no failure), pnpm's `--filter` / `-F`, npm's `-C`
+        runner: /^(?:test|tests|coverage)(?::\S+)?(?=\s|$)/,
+        flags: /\s--if-present(?=\s|$)|\s--prefix(?:=|\s)|\s-C(?:=|\s)|\s-w(?:=|\s)|\s--workspace(?:=|\s)|\s--filter(?:=|\s)|\s-F(?:=|\s)/
+      },
+      {
+        runner: /^(?:jest|vitest)\b/,
+        flags: /\s--shard(?:=|\s)|\s--root(?:Dir)?(?:=|\s)|\s--testMatch(?:=|\s)|\s--testRegex(?:=|\s)|\s--modulePathIgnorePatterns(?:=|\s)|\s--selectProjects(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)/
+      },
+      { runner: /^playwright\b/, flags: /\s--shard(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--grep-invert(?:=|\s)/ },
+      { runner: /^mocha\b/, flags: /\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--fgrep(?:=|\s)|\s-f(?:=|\s)/ },
+      { runner: /^ava\b/, flags: /\s--match(?:=|\s)|\s-m(?:=|\s)/ },
+      { runner: /^node --test\b/, flags: /\s--test-name-pattern(?:=|\s)|\s--test-skip-pattern(?:=|\s)|\s--test-only(?=\s|$)/ },
+      {
+        // `-p no:<plugin>` disables collection when the plugin is the collector
+        // (`python`, `doctest`, `cov`); the cache, warning and output plugins select nothing
+        runner: /^pytest\b/,
+        flags: /\s-k(?:=|\s)|\s-m(?:=|\s)|\s--deselect(?:=|\s)|\s--ignore(?:-glob)?(?:=|\s)|\s-p\s*no:(?!(?:cacheprovider|warnings|faulthandler|randomly|logging|legacypath|pastebin|stepwise|tmpdir|junitxml|terminal|terminalreporter)(?=\s|$))|\s--collect-only(?=\s|$)|\s--co(?=\s|$)/
+      },
+      { runner: /^cargo test\b/, flags: /\s--\s(?:\S+\s+)*--skip(?:=|\s)|\s--exclude(?:=|\s)/ },
+      { runner: /^go test\b/, flags: /\s-run(?:=|\s)|\s-skip(?:=|\s)/ }
+    ];
+    COVERAGE_FLOOR = /--cov-fail-under(?:=|\s+)(\d+(?:\.\d+)?)/;
+    COMMAND_PREFIX = /^(?:(?:[A-Za-z_]\w*=(?:"[^"]*"|'[^']*'|\S*)|sudo|env|nice|time|exec|command|nohup|xvfb-run|dbus-launch|cross-env|dotenv|poetry\s+run|pipenv\s+run|uv\s+run|hatch\s+run|pdm\s+run|bundle\s+exec)\s+(?:-{1,2}\S+\s+)*)*/;
+    CHECK_HEAD = /^(?:(?:test|tests|lint|typecheck|type-check|coverage)(?::\S+)?(?=\s|$)|(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint)\b|node --test\b|biome (?:ci|check|lint)\b|deno (?:test|lint|check)\b|ruff check\b|(?:make|cargo|go) test\b|gradle\w* (?:test|check)\b)/;
+    PATH_SHAPED = /\/|\.(?:test|spec)\./;
+    NARROWING_BY_RUNNER = {
+      "*": [/--shard\b/],
+      jest: [/--root\b/, /--rootDir\b/, /--testMatch\b/, /--testRegex\b/, /--modulePathIgnorePatterns\b/, /--selectProjects\b/, /--ignoreProjects\b/, /--filter\b/],
+      vitest: [/--grep\b/],
+      mocha: [/--grep\b/, /(?:^|\s)-g(?:\s|=)/, /--ignore\b/, /(?:^|\s)-f(?:\s|=)/, /--fgrep\b/],
+      pytest: [/(?:^|\s)-k(?:\s|=)/, /(?:^|\s)-m(?:\s|=)/, /--deselect\b/, /--ignore\b/, /--ignore-glob\b/, /--last-failed\b/, /(?:^|\s)--lf(?:\s|$)/, /--collect-only\b/, /(?:^|\s)--co(?:\s|$)/],
+      go: [/(?:^|\s)-run(?:\s|=)/, /(?:^|\s)-skip(?:\s|=)/],
+      cargo: [],
+      node: [/--test-name-pattern\b/, /--test-skip-pattern\b/]
+    };
+    CARGO_SKIP = /\s--\s+(?:\S+\s+)*--skip\b/;
+    MASKING_FLAGS = [/--passWithNoTests\b/, /--coverage=false\b/, /--coverageThreshold\b/, /--if-present\b/];
+    GATE_FLAGS = [/--check-coverage\b/];
+    CONFIG_FLAG = /(?:^|\s)(--config|-c)(?:=|\s+)(['"]?)([^\s'"]+)\2(?=\s|$)/;
+    PRINTER = /^(?:echo|printf|true|false|:|cat|exit|return|sleep|test|\[|node|git|curl|wget)(?=\s|$)/;
+    PYTHON_M = /^python\d?(?:\.\d+)?\s+-m\s+(?=pytest\b)/;
+    NODE_BIN = /^node(?:\s+-\S+)*\s+\S*node_modules\/(?:\.bin\/)?(jest|vitest|mocha|ava)\b\S*/;
+    BIN_OF = /\$\((?:yarn|npm|pnpm)\s+bin\s+(\w+)\)|\$\((?:yarn|npm|pnpm)\s+bin\)\/(\w+)/g;
+    RUNNER_NAME = /^(jest|vitest|mocha|pytest|go|cargo|node)\b/;
+    spelled = (re, s) => {
+      const m = s.match(re);
+      return m ? m[0].trim().replace(/[=\s].*$/, "") : null;
+    };
+    FAILS_LOUDLY = /^(?:exit\s+(?:[1-9]\d*)|false)\s*$/;
+  }
+});
+
+// src/detectors/ci-tampering.ts
+function isActiveWorkflow(path) {
+  return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
+}
+function commandCore(line) {
+  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
+}
 function expressionOf(raw) {
   const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
   const m = v.match(/^\$\{\{\s*(.+?)\s*\}\}$/);
@@ -5425,7 +5658,7 @@ function ancestorOf(lines, i) {
   while (h >= 0 && (lines[h].trim() === "" || /^\s*#/.test(lines[h]) || indentOf(lines[h]) >= ind)) h--;
   return h >= 0 ? h : null;
 }
-var RULE6, USES, CHECK, YAML_KEY, INVOKES_TOOL, INVOKES_SCRIPT, invokesCheck, EXPR_TOKEN, MATRIX_TOKEN, MATRIX_FLAG, usesRef, SUITE_NARROWING_FLAGS, NEUTRALISING_SUFFIX, TIMEOUT_WRAP, RUNNER_NARROWINGS, COVERAGE_FLOOR, COMMAND_PREFIX, CHECK_HEAD, PATH_SHAPED, uncommented, TRUTHY, truthy, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
+var RULE6, USES, CHECK, YAML_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
 var init_ci_tampering = __esm({
   "src/detectors/ci-tampering.ts"() {
     "use strict";
@@ -5435,60 +5668,22 @@ var init_ci_tampering = __esm({
     init_files();
     init_hook_wiring();
     init_repo();
+    init_gh_expression();
+    init_invocation();
+    init_invocation();
     RULE6 = "ci-tampering";
     USES = /^\s*-\s*uses:/;
     CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|playwright|coverage|tamperward)\b/i;
     YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
-    INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint|node\s+--test|biome\s+(?:ci|check|lint)|deno\s+(?:test|lint|check)|ruff\s+check)\b/;
-    INVOKES_SCRIPT = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|tests|lint|typecheck|type-check|coverage)\b|\b(?:make|cargo|go)\s+test\b|\bgradle\w*\s+(?:test|check)\b/;
-    invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line) || INVOKES_TOOL.test(commandCore(line));
-    EXPR_TOKEN = "__expr__";
-    MATRIX_TOKEN = "__matrix__";
-    MATRIX_FLAG = new RegExp(`(?:^|\\s)-{1,2}[\\w-]+(?:=|\\s+)${MATRIX_TOKEN}(?:/\\S*)?(?=\\s|$)`, "g");
-    usesRef = (core) => core.replace(/@.*$/, "");
-    SUITE_NARROWING_FLAGS = /--testPathIgnorePatterns\b|--testPathPattern\b|--testNamePattern\b|(?:^|\s)-t\s|--onlyChanged\b|--changed\b|--findRelatedTests\b|--exclude\b|--dir\b|--project\b/;
-    NEUTRALISING_SUFFIX = new RegExp(
-      `\\|\\||;|(?<!&)&(?!&)|\\|(?!\\|)|--passWithNoTests\\b|--coverage=false\\b|--coverageThreshold\\b|${SUITE_NARROWING_FLAGS.source}`
-    );
-    TIMEOUT_WRAP = /^timeout\s+(?:-{1,2}\S+\s+)*\d\S*\s+(.+)$/;
-    RUNNER_NARROWINGS = [
-      {
-        // a package-manager script: `test --prefix dir`, `-w pkg`, `--workspace=pkg`,
-        // `--if-present` (no script, no failure), pnpm's `--filter` / `-F`, npm's `-C`
-        runner: /^(?:test|tests|coverage)(?::\S+)?(?=\s|$)/,
-        flags: /\s--if-present(?=\s|$)|\s--prefix(?:=|\s)|\s-C(?:=|\s)|\s-w(?:=|\s)|\s--workspace(?:=|\s)|\s--filter(?:=|\s)|\s-F(?:=|\s)/
-      },
-      {
-        runner: /^(?:jest|vitest)\b/,
-        flags: /\s--shard(?:=|\s)|\s--root(?:Dir)?(?:=|\s)|\s--testMatch(?:=|\s)|\s--testRegex(?:=|\s)|\s--modulePathIgnorePatterns(?:=|\s)|\s--selectProjects(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)/
-      },
-      { runner: /^playwright\b/, flags: /\s--shard(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--grep-invert(?:=|\s)/ },
-      { runner: /^mocha\b/, flags: /\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--fgrep(?:=|\s)|\s-f(?:=|\s)/ },
-      { runner: /^ava\b/, flags: /\s--match(?:=|\s)|\s-m(?:=|\s)/ },
-      { runner: /^node --test\b/, flags: /\s--test-name-pattern(?:=|\s)|\s--test-skip-pattern(?:=|\s)|\s--test-only(?=\s|$)/ },
-      {
-        // `-p no:<plugin>` disables collection when the plugin is the collector
-        // (`python`, `doctest`, `cov`); the cache, warning and output plugins select nothing
-        runner: /^pytest\b/,
-        flags: /\s-k(?:=|\s)|\s-m(?:=|\s)|\s--deselect(?:=|\s)|\s--ignore(?:-glob)?(?:=|\s)|\s-p\s*no:(?!(?:cacheprovider|warnings|faulthandler|randomly|logging|legacypath|pastebin|stepwise|tmpdir|junitxml|terminal|terminalreporter)(?=\s|$))|\s--collect-only(?=\s|$)|\s--co(?=\s|$)/
-      },
-      { runner: /^cargo test\b/, flags: /\s--\s(?:\S+\s+)*--skip(?:=|\s)|\s--exclude(?:=|\s)/ },
-      { runner: /^go test\b/, flags: /\s-run(?:=|\s)|\s-skip(?:=|\s)/ }
-    ];
-    COVERAGE_FLOOR = /--cov-fail-under(?:=|\s+)(\d+(?:\.\d+)?)/;
-    COMMAND_PREFIX = /^(?:(?:[A-Za-z_]\w*=(?:"[^"]*"|'[^']*'|\S*)|sudo|env|nice|time|exec|command|nohup|xvfb-run|dbus-launch|cross-env|dotenv|poetry\s+run|pipenv\s+run|uv\s+run|hatch\s+run|pdm\s+run|bundle\s+exec)\s+(?:-{1,2}\S+\s+)*)*/;
-    CHECK_HEAD = /^(?:(?:test|tests|lint|typecheck|type-check|coverage)(?::\S+)?(?=\s|$)|(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint)\b|node --test\b|biome (?:ci|check|lint)\b|deno (?:test|lint|check)\b|ruff check\b|(?:make|cargo|go) test\b|gradle\w* (?:test|check)\b)/;
-    PATH_SHAPED = /\/|\.(?:test|spec)\./;
+    invokesCheck2 = (line) => invokesCheck(line) || INVOKES_TOOL.test(commandCore(line));
     uncommented = (v) => v.replace(/\s+#.*$/, "").trim();
-    TRUTHY = Symbol("truthy");
-    truthy = (v) => v === TRUTHY ? true : typeof v === "string" ? v !== "" : typeof v === "number" ? v !== 0 : v === true;
     SHELL_ERREXIT = /(?:^|\s)-[a-zA-Z]*e[a-zA-Z]*(?:\s|$)|-o\s+errexit\b/;
     indentOf = (l) => l.length - l.trimStart().length;
     STEP_START = /^\s*-\s+(?:name|uses|run|if|id|with|env|shell|continue-on-error|working-directory|timeout-minutes):/;
     REPORTER_ACTION = /^\s*-?\s*uses:\s*\S*?(?:[\w-]*-reporter|[\w-]*-results?[\w-]*|upload-[\w-]*|codecov[\w-]*|coveralls[\w-]*)(?:@|\s|$)/i;
     usesCheck = (l) => USES.test(l) && CHECK.test(l) && !REPORTER_ACTION.test(l);
-    stepHasCheck = (lines, range) => range === null || lines.slice(range[0], range[1]).some((l) => invokesCheck(l) || usesCheck(l));
-    jobHasCheck = (lines, range) => lines.slice(range[0], range[1]).some((l) => invokesCheck(l) || usesCheck(l) || /^\s*uses:\s*\S/.test(l));
+    stepHasCheck = (lines, range) => range === null || lines.slice(range[0], range[1]).some((l) => invokesCheck2(l) || usesCheck(l));
+    jobHasCheck = (lines, range) => lines.slice(range[0], range[1]).some((l) => invokesCheck2(l) || usesCheck(l) || /^\s*uses:\s*\S/.test(l));
     NEUTRALISERS = [
       { re: /^\s*set\s+\+e\b/, what: "set +e \u2014 a failing check no longer fails the step" },
       { re: /^\s*exit\s+0\s*(?:$|[;#])/, what: "exit 0 \u2014 the step ends green whatever the check did" },
@@ -5574,7 +5769,7 @@ var init_ci_tampering = __esm({
           }
           if (afterLines) {
             for (const b of runBlocks(afterLines)) {
-              if (!b.body.some(invokesCheck)) continue;
+              if (!b.body.some(invokesCheck2)) continue;
               const propagates = b.body.some((l) => /\bexit\s+"?\$/.test(l));
               for (let k = 0; k < b.body.length; k++) {
                 const idx = b.start + 1 + k;
@@ -5621,7 +5816,7 @@ var init_ci_tampering = __esm({
                   const d = defaultsOf(afterLines, i);
                   if (d === null) continue;
                   const job = jobOf(afterLines, d);
-                  if (job ? !jobHasCheck(afterLines, job) : !afterLines.some((x) => invokesCheck(x) || usesCheck(x))) continue;
+                  if (job ? !jobHasCheck(afterLines, job) : !afterLines.some((x) => invokesCheck2(x) || usesCheck(x))) continue;
                 }
                 out3.push(
                   makeFinding(RULE6, policy, {
@@ -5678,7 +5873,7 @@ var init_ci_tampering = __esm({
           for (const l of removedLines(c)) {
             if (/^\s*#/.test(l.content)) continue;
             const isUsesLine = usesCheck(l.content);
-            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck(l.content);
+            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck2(l.content);
             if (!isUsesLine && !isCheckCommand) continue;
             const s = survives(commandCore(l.content), isUsesLine, afterCores, addedCores);
             if (s.state === "kept") continue;
@@ -7324,33 +7519,43 @@ function excludesOtherRunner(flag, cmd) {
   const values = [...cmd.matchAll(/--exclude(?:=|\s+)(['"]?)(\S+?)\1(?=\s|$)/g)].map((m) => m[2]);
   return values.length > 0 && values.every((v) => OTHER_RUNNER_DIR.test(v.replace(/^\.\//, "").replace(/(?:\/\*+)*\/?$/, "") + "/"));
 }
-function scriptNarrowings(before, after, path) {
+function scriptsOf(src) {
+  try {
+    const pkg = JSON.parse(src ?? "{}");
+    const s = isRecord(pkg) && isRecord(pkg.scripts) ? pkg.scripts : {};
+    return Object.fromEntries(Object.entries(s).filter((e) => typeof e[1] === "string"));
+  } catch {
+    return {};
+  }
+}
+function scriptWeakenings(before, after, path, policy, addedPaths) {
   if ((path.split("/").pop() ?? path) !== "package.json") return [];
-  const scriptsOf = (src) => {
-    try {
-      const pkg = JSON.parse(src ?? "{}");
-      const s = isRecord(pkg) && isRecord(pkg.scripts) ? pkg.scripts : {};
-      return Object.fromEntries(Object.entries(s).filter((e) => typeof e[1] === "string"));
-    } catch {
-      return {};
-    }
-  };
   const was = scriptsOf(before);
   const now = scriptsOf(after);
+  const dir = path.includes("/") ? path.slice(0, path.lastIndexOf("/") + 1) : "";
+  const configReviewed = (file) => {
+    const f = dir + file.replace(/^\.\//, "");
+    return isProtected(f, policy, "config") && !addedPaths.has(f);
+  };
+  const relocated = (kind) => Object.keys(now).some((n) => !(n in was) && checkKinds(now[n]).has(kind));
   const out3 = [];
-  for (const [name, cmd] of Object.entries(now)) {
-    if (!WHOLE_SUITE_SCRIPT.test(name) || !/\b(?:jest|vitest)\b/.test(cmd)) continue;
-    const prev = was[name] ?? "";
-    const flags = new RegExp(SUITE_NARROWING_FLAGS.source, "g");
-    for (const m of cmd.matchAll(flags)) {
-      const flag = m[0].trim();
-      if (!flag) continue;
-      const one = new RegExp(SUITE_NARROWING_FLAGS.source);
-      if (one.test(prev) && prev.includes(flag)) continue;
-      if (excludesOtherRunner(flag, cmd)) continue;
-      out3.push({ script: name, flag, before: prev, after: cmd });
-      break;
+  for (const name of /* @__PURE__ */ new Set([...Object.keys(was), ...Object.keys(now)])) {
+    const whole = WHOLE_SUITE_SCRIPT.test(name);
+    if (!whole && !SLICE_SCRIPT.test(name)) continue;
+    const prev = was[name];
+    const cmd = now[name];
+    if (prev === cmd) continue;
+    if (prev === void 0 && !whole) continue;
+    if (cmd === void 0) {
+      if (name !== "pretest" || prev === void 0) continue;
+      const gone = [...checkKinds(prev)].filter((k) => !relocated(k));
+      if (gone.length === 0) continue;
+      out3.push({ script: name, weakening: { state: "removed", kind: gone[0], what: "the script is gone" }, before: prev, after: "" });
+      continue;
     }
+    const w = invocationWeakening(prev ?? "", cmd, void 0, { configReviewed, excuseFlag: excludesOtherRunner, sliceByDesign: !whole, relocated });
+    if (w.state === "kept") continue;
+    out3.push({ script: name, weakening: w, before: prev ?? "", after: cmd });
   }
   return out3;
 }
@@ -7412,7 +7617,7 @@ function pytestPrecedenceFindings(changes, policy, ctx) {
     })
   );
 }
-var RULE8, JVM_TEST, TEST_DEFS, TABLE_METHOD, isEachOf, isDescribeEach, OTHER_RUNNER_DIR, WHOLE_SUITE_SCRIPT, SED_INPLACE, testDeletion;
+var RULE8, JVM_TEST, TEST_DEFS, TABLE_METHOD, isEachOf, isDescribeEach, OTHER_RUNNER_DIR, WHOLE_SUITE_SCRIPT, SLICE_SCRIPT, SED_INPLACE, testDeletion;
 var init_test_deletion = __esm({
   "src/detectors/test-deletion.ts"() {
     "use strict";
@@ -7423,7 +7628,7 @@ var init_test_deletion = __esm({
     init_files();
     init_repo();
     init_suite_config();
-    init_ci_tampering();
+    init_invocation();
     init_narrow();
     RULE8 = "test-deletion";
     JVM_TEST = /^\s*(?:@\w+(?:\([^)]*\))?\s+)*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/;
@@ -7441,7 +7646,8 @@ var init_test_deletion = __esm({
     isEachOf = (expr) => ts.isPropertyAccessExpression(expr) && ts.isIdentifier(expr.expression) && (expr.expression.text === "it" || expr.expression.text === "test") && TABLE_METHOD.test(expr.name.text);
     isDescribeEach = (expr) => ts.isPropertyAccessExpression(expr) && ts.isIdentifier(expr.expression) && expr.expression.text === "describe" && TABLE_METHOD.test(expr.name.text);
     OTHER_RUNNER_DIR = /(?:^|\/)(?:e2e|cypress|playwright|fixtures|__fixtures__|__mocks__)\//;
-    WHOLE_SUITE_SCRIPT = /^test(?::ci)?$/;
+    WHOLE_SUITE_SCRIPT = /^(?:test|test:ci|check|pretest)$/;
+    SLICE_SCRIPT = /^test:(?:unit|integration)$/;
     SED_INPLACE = /(?:^|\s)(?:-i\b|--in-place\b|-[a-zA-Z]*i[a-zA-Z]*\b)/;
     testDeletion = {
       id: RULE8,
@@ -7450,6 +7656,7 @@ var init_test_deletion = __esm({
       run(changes, policy, _view, ctx) {
         const out3 = [];
         const isSpec = (p) => isProtected(p, policy, "tests") && !isProtected(p, policy, "snapshots");
+        const addedPaths = new Set(changes.filter((c) => c.kind === "file" && c.op === "add").map((c) => c.path));
         const addedTestLines = /* @__PURE__ */ new Set();
         let addedTestBlocks = 0;
         for (const c of changes) {
@@ -7529,13 +7736,20 @@ var init_test_deletion = __esm({
                   })
                 );
               }
-              for (const n of scriptNarrowings(c.before, c.after, c.path)) {
+              for (const n of scriptWeakenings(c.before, c.after, c.path, policy, addedPaths)) {
+                const w = n.weakening;
+                const evidence = `"${n.script}": ${JSON.stringify(n.before)} \u2192 ${n.after === "" ? "deleted" : JSON.stringify(n.after)}`;
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  w.state === "removed" ? makeFinding(RULE8, policy, {
                     file: c.path,
-                    message: `The test script now narrows the suite: ${n.flag} added to scripts.${n.script}.`,
-                    evidence: `"${n.script}": ${JSON.stringify(n.before)} \u2192 ${JSON.stringify(n.after)}`,
-                    remediation: "Keep the test script running the whole suite; a runner flag that selects fewer specs removes the rest from every run."
+                    message: `The test script no longer runs the ${w.kind} check: scripts.${n.script} ${w.what}.`,
+                    evidence,
+                    remediation: "Keep the script running its check. Replacing the runner in package.json removes every test from every `npm test` while the workflow line stays untouched."
+                  }) : makeFinding(RULE8, policy, {
+                    file: c.path,
+                    message: `The test script now narrows the suite: ${w.what} ${w.direction} ${w.direction === "added" ? "to" : "from"} scripts.${n.script}.`,
+                    evidence,
+                    remediation: "Keep the test script running the whole suite and letting it decide; a masked status, a cut-short run or a runner flag that selects fewer specs removes the rest from every run."
                   })
                 );
               }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.10",
+  "version": "2.23.11",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",