tamperward 2.23.7 → 2.23.8

package/dist/cli/index.js

@@ -2053,7 +2053,135 @@ var init_lint_suppression = __esm({
   }
 });
 
+// src/detectors/repo.ts
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { readFileSync as readFileSync3 } from "node:fs";
+import { join as join6 } from "node:path";
+function trackedFiles(ctx) {
+  if (!ctx) return null;
+  if (ctx.trackedFiles) return ctx.trackedFiles;
+  if (!ctx.cwd) return null;
+  const hit = cache2.get(ctx.cwd);
+  if (hit !== void 0) return hit;
+  let files = null;
+  try {
+    files = execFileSync5("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+      cwd: ctx.cwd,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"]
+    }).split("\0").filter(Boolean);
+  } catch {
+    files = null;
+  }
+  cache2.set(ctx.cwd, files);
+  return files;
+}
+function trackedContent(path, ctx) {
+  if (!ctx) return null;
+  if (ctx.trackedContents) return ctx.trackedContents[path] ?? null;
+  if (!ctx.cwd) return null;
+  const key2 = ctx.cwd + "\0" + path;
+  const hit = contentCache.get(key2);
+  if (hit !== void 0) return hit;
+  let src = null;
+  try {
+    src = readFileSync3(join6(ctx.cwd, path), "utf8");
+  } catch {
+    src = null;
+  }
+  contentCache.set(key2, src);
+  return src;
+}
+function branchRefs(ctx) {
+  if (!ctx?.cwd) return null;
+  const hit = refsCache.get(ctx.cwd);
+  if (hit !== void 0) return hit;
+  let refs = null;
+  try {
+    const out3 = execFileSync5("git", ["for-each-ref", "--format=%(refname:short)", "refs/heads", "refs/remotes"], {
+      cwd: ctx.cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    refs = new Set(out3.split("\n").map((l) => l.trim()).filter(Boolean));
+  } catch {
+    refs = null;
+  }
+  refsCache.set(ctx.cwd, refs);
+  return refs;
+}
+function branchExists(name, ctx) {
+  const refs = branchRefs(ctx);
+  if (!refs) return null;
+  if (refs.has(name)) return true;
+  for (const r of refs) if (r.endsWith("/" + name)) return true;
+  return false;
+}
+function revIsHead(rev2, ctx) {
+  if (!ctx?.cwd || rev2.startsWith("-")) return null;
+  const parse = (r) => {
+    try {
+      return execFileSync5("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${r}^{commit}`], {
+        cwd: ctx.cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const head = parse("HEAD");
+  const target = parse(rev2);
+  if (!head || !target) return null;
+  return head === target;
+}
+function defaultBranch(ctx) {
+  if (!ctx?.cwd) return null;
+  const hit = branchCache.get(ctx.cwd);
+  if (hit !== void 0) return hit;
+  let name = null;
+  try {
+    const ref = execFileSync5("git", ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"], {
+      cwd: ctx.cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    name = ref.replace(/^origin\//, "") || null;
+  } catch {
+    name = null;
+  }
+  branchCache.set(ctx.cwd, name);
+  return name;
+}
+function containsProtected(token, policy, category, ctx, except) {
+  const dir = dirOf(token);
+  if (!dir || dir === "." || dir === "/" || dir.startsWith("-")) return false;
+  const counts = (p) => isProtected(p, policy, category) && !(except && isProtected(p, policy, except));
+  const files = trackedFiles(ctx);
+  if (files) {
+    const prefix = dir + "/";
+    return files.some((f) => f.startsWith(prefix) && counts(f));
+  }
+  if (counts(dir + "/probe")) return true;
+  const base = dir.split("/").pop() ?? "";
+  return category === "tests" && /^(?:test|tests|__tests__|spec|specs)$/i.test(base);
+}
+var cache2, contentCache, branchCache, refsCache, dirOf;
+var init_repo = __esm({
+  "src/detectors/repo.ts"() {
+    "use strict";
+    init_policy();
+    cache2 = /* @__PURE__ */ new Map();
+    contentCache = /* @__PURE__ */ new Map();
+    branchCache = /* @__PURE__ */ new Map();
+    refsCache = /* @__PURE__ */ new Map();
+    dirOf = (t) => t.replace(/^\.\//, "").replace(/\/+$/, "");
+  }
+});
+
 // src/detectors/test-skip.ts
+import { posix as posix2 } from "node:path";
 function matchesOutsideString(p, content, lang) {
   if (p.comment) return p.re.test(content);
   const re = p.re.global ? p.re : new RegExp(p.re.source, p.re.flags + "g");
@@ -2123,61 +2251,29 @@ function astContext(path, source) {
 function symbolAt(ctx, node) {
   return ctx.checker.getSymbolAtLocation(node) ?? null;
 }
-function importAliases(ctx) {
-  const out3 = /* @__PURE__ */ new Map();
-  const simpleAliases = [];
-  const add = (id, causes = [id]) => {
-    const sym = symbolAt(ctx, id);
-    if (sym) out3.set(sym, { causes });
-  };
-  for (const stmt of ctx.sf.statements) {
-    if (ts.isImportDeclaration(stmt) && ts.isStringLiteralLike(stmt.moduleSpecifier)) {
-      if (!JS_TEST_MODULES.has(stmt.moduleSpecifier.text)) continue;
-      const clause = stmt.importClause;
-      if (!clause) continue;
-      if (clause.name && stmt.moduleSpecifier.text.startsWith("node:test")) add(clause.name);
-      const bindings = clause.namedBindings;
-      if (bindings && ts.isNamedImports(bindings)) {
-        for (const el of bindings.elements) {
-          const imported = el.propertyName?.text ?? el.name.text;
-          if (JS_RUNNERS.has(imported)) add(el.name);
-        }
-      }
-      continue;
-    }
-    if (!ts.isVariableStatement(stmt)) continue;
-    for (const decl of stmt.declarationList.declarations) {
-      if (ts.isObjectBindingPattern(decl.name) && decl.initializer) {
-        const mod = requiredModule(decl.initializer);
-        if (!mod || !JS_TEST_MODULES.has(mod)) continue;
-        for (const el of decl.name.elements) {
-          if (!ts.isIdentifier(el.name)) continue;
-          const imported = el.propertyName && ts.isIdentifier(el.propertyName) ? el.propertyName.text : el.name.text;
-          if (JS_RUNNERS.has(imported)) add(el.name);
-        }
-      } else if (ts.isIdentifier(decl.name) && decl.initializer && ts.isIdentifier(decl.initializer)) {
-        simpleAliases.push({ local: decl.name, source: decl.initializer });
-      }
-    }
-  }
-  for (let pass = 0; pass < simpleAliases.length + 1; pass++) {
-    let changed = false;
-    for (const alias of simpleAliases) {
-      const localSym = symbolAt(ctx, alias.local);
-      if (!localSym || out3.has(localSym)) continue;
-      const sourceSym = symbolAt(ctx, alias.source);
-      const sourceBinding = sourceSym ? out3.get(sourceSym) : void 0;
-      const implicitGlobal = sourceSym == null && JS_RUNNERS.has(alias.source.text);
-      if (!sourceBinding && !implicitGlobal) continue;
-      out3.set(localSym, {
-        causes: [alias.local, ...sourceBinding?.causes ?? []]
-      });
-      changed = true;
-    }
-    if (!changed) break;
+function relativeCandidates(fromPath, spec) {
+  const base = posix2.normalize(posix2.join(posix2.dirname(fromPath), spec));
+  if (base.startsWith("../") || base.startsWith("/")) return [];
+  const bases = [base];
+  const swapped = base.replace(/\.([mc]?)js$/, ".$1ts");
+  if (swapped !== base) bases.push(swapped);
+  const out3 = [];
+  for (const b of bases) {
+    out3.push(b);
+    for (const ext of MODULE_EXTENSIONS) out3.push(b + ext);
+    for (const ext of MODULE_EXTENSIONS) out3.push(b + "/index" + ext);
   }
   return out3;
 }
+function isExported(stmt) {
+  return ts.canHaveModifiers(stmt) && (ts.getModifiers(stmt) ?? []).some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+}
+function cjsExportTarget(expr) {
+  const isModuleExports = (e) => ts.isIdentifier(e) && e.text === "exports" || ts.isPropertyAccessExpression(e) && ts.isIdentifier(e.expression) && e.expression.text === "module" && e.name.text === "exports";
+  if (isModuleExports(expr)) return "";
+  if (ts.isPropertyAccessExpression(expr) && isModuleExports(expr.expression)) return expr.name.text;
+  return null;
+}
 function topLevelStaticStrings(ctx) {
   const pending = /* @__PURE__ */ new Map();
   for (const stmt of ctx.sf.statements) {
@@ -2244,7 +2340,7 @@ function staticPropertyName(expr, ctx, strings) {
   }
   return null;
 }
-function runnerChain(expr, ctx, runners, strings) {
+function runnerChain(expr, ctx, binder, strings) {
   const props = [];
   const causes = [];
   let cur = expr;
@@ -2264,16 +2360,29 @@ function runnerChain(expr, ctx, runners, strings) {
     if (props.length === 1) terminalNode = cur.argumentExpression;
     cur = cur.expression;
   }
-  if (!ts.isIdentifier(cur)) return null;
-  const sym = symbolAt(ctx, cur);
-  if (sym) {
-    const binding = runners.get(sym);
-    if (!binding) return null;
-    causes.push(...binding.causes);
-  } else if (!JS_RUNNERS.has(cur.text)) {
-    return null;
+  let verdict2;
+  let namespace = null;
+  if (ts.isIdentifier(cur)) {
+    const sym = symbolAt(ctx, cur);
+    if (!sym) {
+      verdict2 = JS_RUNNERS.has(cur.text) ? RUNNER : UNKNOWN;
+    } else {
+      verdict2 = binder.classify(sym);
+      if (verdict2.kind !== "runner") namespace = binder.namespaceOf(sym);
+    }
+  } else {
+    namespace = requiredModule(cur);
+    verdict2 = namespace == null ? UNKNOWN : NON_RUNNER;
+  }
+  let root = ts.isIdentifier(cur) ? cur.text : "";
+  if (namespace != null && props.length > 0) {
+    verdict2 = withCause(binder.memberOf(namespace, props[0]), cur);
+    if (verdict2.kind === "runner") root = props.shift() ?? root;
   }
-  return { root: cur.text, props, terminalNode, causes };
+  if (verdict2.kind === "unknown") return "unknown";
+  if (verdict2.kind === "non-runner") return null;
+  causes.push(...verdict2.causes);
+  return { root, props, terminalNode, causes };
 }
 function optionDisables(value) {
   return !(value.kind === ts.SyntaxKind.FalseKeyword || ts.isNumericLiteral(value) && Number(value.text) === 0);
@@ -2292,11 +2401,12 @@ function structuralNodeKey(node, sf) {
   }
   return `${node.kind}(${children.map((child) => structuralNodeKey(child, sf)).join(",")})`;
 }
-function semanticSkipHits(ctx) {
-  const runners = importAliases(ctx);
+function semanticSkipHits(ctx, binder) {
   const strings = topLevelStaticStrings(ctx);
   const hits = [];
+  const unowned = /* @__PURE__ */ new Set();
   const callOrdinals = /* @__PURE__ */ new Map();
+  const lineOf = (pos) => ctx.sf.getLineAndCharacterOfPosition(pos).line + 1;
   const visit = (node) => {
     if (ts.isCallExpression(node)) {
       const callText = node.getText(ctx.sf).trim();
@@ -2304,8 +2414,13 @@ function semanticSkipHits(ctx) {
       const ordinal = (callOrdinals.get(callIdentity) ?? 0) + 1;
       callOrdinals.set(callIdentity, ordinal);
       const callKey = `${callIdentity}\0${ordinal}`;
-      const chain = runnerChain(node.expression, ctx, runners, strings);
-      if (chain) {
+      const chain = runnerChain(node.expression, ctx, binder, strings);
+      if (chain === "unknown") {
+        const callee = node.expression;
+        const first = lineOf(callee.getStart(ctx.sf));
+        const last = lineOf(callee.getEnd());
+        for (let line = first; line <= last; line++) unowned.add(line);
+      } else if (chain) {
         const { props, terminalNode, causes } = chain;
         const terminal = props.at(-1);
         const push = (target, extraCauses, why) => {
@@ -2317,7 +2432,7 @@ function semanticSkipHits(ctx) {
             evidence: callText
           });
         };
-        if (terminal && (terminal === "skip" || terminal === "only" || terminal === "todo") && props.slice(0, -1).every((p) => JS_CHAIN_MODIFIERS.has(p))) {
+        if (terminal && (terminal === "skip" || terminal === "only" || terminal === "todo") && props.slice(0, -1).every((p) => JS_CHAIN_MODIFIERS.has(p) || JS_RUNNERS.has(p))) {
           push(terminalNode, [], "a .skip/.only/.todo marker");
         } else if (terminal && ["skipIf", "runIf"].includes(terminal) && props.length === 1) {
           push(terminalNode, [], "a .skipIf()/.runIf() condition (the test runs only when the condition allows)");
@@ -2356,20 +2471,32 @@ function semanticSkipHits(ctx) {
     ts.forEachChild(node, visit);
   };
   visit(ctx.sf);
-  return hits;
+  return { hits, unowned };
+}
+function moduleSource(changes, side, ctx) {
+  const touched = /* @__PURE__ */ new Map();
+  for (const c of changes) {
+    if (c.kind !== "file") continue;
+    touched.set(c.path, c[side]);
+    if (side === "before" && c.oldPath != null) touched.set(c.oldPath, c.before);
+  }
+  return (path) => touched.has(path) ? touched.get(path) ?? null : trackedContent(path, ctx);
 }
-function astSkipHits(c) {
-  if (c.after == null) return { hits: [], authoritative: false };
+function astSkipHits(c, resolvers) {
+  if (c.after == null) return NO_AST;
   const added = addedLineNumbers(c);
-  if (added.size === 0) return { hits: [], authoritative: false };
+  if (added.size === 0) return NO_AST;
   const afterCtx = astContext(c.path, c.after);
-  if (!afterCtx) return { hits: [], authoritative: false };
+  if (!afterCtx) return NO_AST;
   const beforeCtx = c.before == null ? null : astContext(c.path, c.before);
-  const beforeKeys = beforeCtx == null ? null : new Set(semanticSkipHits(beforeCtx).map((hit) => hit.semanticKey));
+  const beforeKeys = beforeCtx == null ? null : new Set(
+    semanticSkipHits(beforeCtx, resolvers.before.binderFor(c.oldPath ?? c.path, beforeCtx)).hits.map((hit) => hit.semanticKey)
+  );
   const lineOf = (node) => afterCtx.sf.getLineAndCharacterOfPosition(node.getStart(afterCtx.sf)).line + 1;
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const hit of semanticSkipHits(afterCtx)) {
+  const analysis = semanticSkipHits(afterCtx, resolvers.after.binderFor(c.path, afterCtx));
+  for (const hit of analysis.hits) {
     const directLine = lineOf(hit.terminalNode);
     let findingLine = added.has(directLine) ? directLine : null;
     if (findingLine == null) {
@@ -2389,21 +2516,22 @@ function astSkipHits(c) {
     seen.add(dedupe);
     hits.push({ line: findingLine, why: hit.why, evidence: hit.evidence });
   }
-  return { hits, authoritative: true };
+  return { hits, authoritative: true, unowned: analysis.unowned };
 }
-var RULE4, acc, JS_RUNNER, JS_MOD, PATTERNS2, JS_RUNNERS, JS_CHAIN_MODIFIERS, JS_TEST_MODULES, testSkip;
+var RULE4, acc, JS_RUNNER, JS_MOD, PATTERNS2, JS_RUNNERS, JS_CHAIN_MODIFIERS, JS_DEFAULT_RUNNER_MODULES, JS_TEST_MODULES, RUNNER, NON_RUNNER, UNKNOWN, withCause, MODULE_EXTENSIONS, RunnerResolver, ModuleBinder, NO_AST, testSkip;
 var init_test_skip = __esm({
   "src/detectors/test-skip.ts"() {
     "use strict";
     init_ts_lazy();
     init_select();
     init_policy();
+    init_repo();
     init_files();
     init_finding();
     RULE4 = "test-skip";
     acc = (names) => `(?:\\s*\\.\\s*(?:${names})(?![\\w$])|\\s*\\[\\s*['"\`](?:${names})['"\`]\\s*\\])`;
     JS_RUNNER = "\\b(?:it|test|describe|suite)";
-    JS_MOD = "concurrent|sequential|shuffle";
+    JS_MOD = "concurrent|sequential|shuffle|serial|parallel";
     PATTERNS2 = {
       js: [
         // The skip/only/todo family on a runner, by dot-or-bracket access, with one optional
@@ -2482,7 +2610,8 @@ var init_test_skip = __esm({
       ]
     };
     JS_RUNNERS = /* @__PURE__ */ new Set(["it", "test", "describe", "suite"]);
-    JS_CHAIN_MODIFIERS = /* @__PURE__ */ new Set(["concurrent", "sequential", "shuffle"]);
+    JS_CHAIN_MODIFIERS = /* @__PURE__ */ new Set(["concurrent", "sequential", "shuffle", "serial", "parallel"]);
+    JS_DEFAULT_RUNNER_MODULES = /* @__PURE__ */ new Set(["node:test", "node:test/promises", "@playwright/test"]);
     JS_TEST_MODULES = /* @__PURE__ */ new Set([
       "vitest",
       "@jest/globals",
@@ -2492,12 +2621,272 @@ var init_test_skip = __esm({
       "bun:test",
       "@playwright/test"
     ]);
+    RUNNER = { kind: "runner", causes: [] };
+    NON_RUNNER = { kind: "non-runner" };
+    UNKNOWN = { kind: "unknown" };
+    withCause = (v, cause) => v.kind === "runner" ? { kind: "runner", causes: [cause, ...v.causes] } : v;
+    MODULE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+    RunnerResolver = class _RunnerResolver {
+      constructor(source) {
+        this.source = source;
+      }
+      binders = /* @__PURE__ */ new Map();
+      static MAX_DEPTH = 4;
+      binderFor(path, ctx) {
+        const hit = this.binders.get(path);
+        if (hit && hit.ctx === ctx) return hit;
+        const binder = new ModuleBinder(ctx, path, this, 0);
+        this.binders.set(path, binder);
+        return binder;
+      }
+      /** The verdict for `name` exported by `spec` as imported from `fromPath`. */
+      exportOf(fromPath, spec, name, depth) {
+        if (JS_TEST_MODULES.has(spec)) {
+          if (name === "default") return JS_DEFAULT_RUNNER_MODULES.has(spec) ? RUNNER : UNKNOWN;
+          return JS_RUNNERS.has(name) ? RUNNER : NON_RUNNER;
+        }
+        if (!spec.startsWith("./") && !spec.startsWith("../")) return UNKNOWN;
+        if (depth >= _RunnerResolver.MAX_DEPTH) return UNKNOWN;
+        for (const candidate of relativeCandidates(fromPath, spec)) {
+          if (this.binders.has(candidate)) {
+            const cached = this.binders.get(candidate);
+            return cached ? cached.exported(name) : UNKNOWN;
+          }
+          const src = this.source(candidate);
+          if (src == null) continue;
+          const ctx = astContext(candidate, src);
+          const binder = ctx ? new ModuleBinder(ctx, candidate, this, depth + 1) : null;
+          this.binders.set(candidate, binder);
+          return binder ? binder.exported(name) : UNKNOWN;
+        }
+        return UNKNOWN;
+      }
+    };
+    ModuleBinder = class {
+      constructor(ctx, path, resolver, depth) {
+        this.ctx = ctx;
+        this.path = path;
+        this.resolver = resolver;
+        this.depth = depth;
+      }
+      memo = /* @__PURE__ */ new Map();
+      resolving = /* @__PURE__ */ new Set();
+      exports = null;
+      starExports = [];
+      opaqueCjs = false;
+      moduleExport(spec, name) {
+        return this.resolver.exportOf(this.path, spec, name, this.depth);
+      }
+      /** The verdict for member `name` of the module object `spec` denotes. */
+      memberOf(spec, name) {
+        return this.moduleExport(spec, name);
+      }
+      /** The module specifier a symbol stands for as a namespace object
+       *  (`import * as v from 'vitest'`, `const v = require('vitest')`), else null. */
+      namespaceOf(sym) {
+        const decl = sym.valueDeclaration ?? sym.declarations?.[0];
+        if (!decl) return null;
+        if (ts.isNamespaceImport(decl)) {
+          const imp = decl.parent.parent;
+          return ts.isImportDeclaration(imp) ? moduleName(imp.moduleSpecifier) : null;
+        }
+        if (ts.isVariableDeclaration(decl) && ts.isIdentifier(decl.name) && decl.initializer) {
+          return requiredModule(decl.initializer);
+        }
+        return null;
+      }
+      /** The verdict for a root identifier's symbol. */
+      classify(sym) {
+        const cached = this.memo.get(sym);
+        if (cached) return cached;
+        if (this.resolving.has(sym)) return UNKNOWN;
+        this.resolving.add(sym);
+        const verdict2 = this.classifyDeclaration(sym);
+        this.resolving.delete(sym);
+        this.memo.set(sym, verdict2);
+        return verdict2;
+      }
+      classifyDeclaration(sym) {
+        const decl = sym.valueDeclaration ?? sym.declarations?.[0];
+        if (!decl) return UNKNOWN;
+        if (ts.isImportSpecifier(decl)) {
+          const imp = decl.parent.parent.parent;
+          const spec = ts.isImportDeclaration(imp) ? moduleName(imp.moduleSpecifier) : null;
+          if (spec == null) return UNKNOWN;
+          return withCause(this.moduleExport(spec, (decl.propertyName ?? decl.name).text), decl.name);
+        }
+        if (ts.isImportClause(decl)) {
+          const spec = ts.isImportDeclaration(decl.parent) ? moduleName(decl.parent.moduleSpecifier) : null;
+          if (spec == null || !decl.name) return UNKNOWN;
+          return withCause(this.moduleExport(spec, "default"), decl.name);
+        }
+        if (ts.isNamespaceImport(decl) || ts.isParameter(decl) || ts.isFunctionDeclaration(decl) || ts.isClassDeclaration(decl) || ts.isEnumDeclaration(decl) || ts.isModuleDeclaration(decl)) return NON_RUNNER;
+        if (ts.isBindingElement(decl)) return this.classifyBindingElement(decl);
+        if (ts.isVariableDeclaration(decl) && ts.isIdentifier(decl.name)) {
+          if (!decl.initializer) return UNKNOWN;
+          return withCause(this.classifyExpression(decl.initializer), decl.name);
+        }
+        return UNKNOWN;
+      }
+      /** `const { it } = require('vitest')`, `const { test } = fixtures`: the element
+       *  is what the module (or namespace) exports under its property name. */
+      classifyBindingElement(decl) {
+        const pattern = decl.parent;
+        const owner = pattern.parent;
+        if (ts.isParameter(owner) || !ts.isObjectBindingPattern(pattern) || !ts.isIdentifier(decl.name)) {
+          return NON_RUNNER;
+        }
+        if (!ts.isVariableDeclaration(owner) || !owner.initializer) return UNKNOWN;
+        const key2 = decl.propertyName ? ts.isIdentifier(decl.propertyName) || ts.isStringLiteralLike(decl.propertyName) ? decl.propertyName.text : null : decl.name.text;
+        if (key2 == null) return UNKNOWN;
+        const spec = this.namespaceSpec(owner.initializer);
+        if (spec != null) return withCause(this.moduleExport(spec, key2), decl.name);
+        if (ts.isIdentifier(owner.initializer)) {
+          const inner = symbolAt(this.ctx, owner.initializer);
+          const verdict2 = inner ? this.classify(inner) : UNKNOWN;
+          return verdict2.kind === "unknown" ? UNKNOWN : NON_RUNNER;
+        }
+        return NON_RUNNER;
+      }
+      /** The module specifier `expr` denotes as a namespace object, else null. */
+      namespaceSpec(expr) {
+        const direct = requiredModule(expr);
+        if (direct != null) return direct;
+        if (!ts.isIdentifier(expr)) return null;
+        const sym = symbolAt(this.ctx, expr);
+        return sym ? this.namespaceOf(sym) : null;
+      }
+      /** The verdict for an expression used as a runner: an initialiser or a
+       *  re-exported value. */
+      classifyExpression(expr) {
+        if (ts.isParenthesizedExpression(expr) || ts.isAsExpression(expr) || ts.isSatisfiesExpression(expr) || ts.isTypeAssertionExpression(expr) || ts.isNonNullExpression(expr)) return this.classifyExpression(expr.expression);
+        if (ts.isIdentifier(expr)) {
+          const sym = symbolAt(this.ctx, expr);
+          if (sym) return this.classify(sym);
+          return JS_RUNNERS.has(expr.text) ? RUNNER : UNKNOWN;
+        }
+        if (ts.isCallExpression(expr)) {
+          const spec = requiredModule(expr);
+          if (spec != null) return this.moduleExport(spec, "default");
+          const callee = expr.expression;
+          if (ts.isPropertyAccessExpression(callee) && callee.name.text === "extend") {
+            return this.classifyExpression(callee.expression);
+          }
+          return NON_RUNNER;
+        }
+        if (ts.isPropertyAccessExpression(expr)) {
+          const spec = this.namespaceSpec(expr.expression);
+          return spec != null ? this.moduleExport(spec, expr.name.text) : UNKNOWN;
+        }
+        if (ts.isElementAccessExpression(expr)) {
+          const spec = this.namespaceSpec(expr.expression);
+          const name = ts.isStringLiteralLike(expr.argumentExpression) ? expr.argumentExpression.text : null;
+          return spec != null && name != null ? this.moduleExport(spec, name) : UNKNOWN;
+        }
+        if (ts.isLiteralExpression(expr) || ts.isTemplateExpression(expr) || ts.isObjectLiteralExpression(expr) || ts.isArrayLiteralExpression(expr) || ts.isFunctionExpression(expr) || ts.isArrowFunction(expr) || ts.isClassExpression(expr) || ts.isNewExpression(expr) || ts.isBinaryExpression(expr) || ts.isPrefixUnaryExpression(expr) || ts.isPostfixUnaryExpression(expr) || ts.isJsxElement(expr) || ts.isJsxSelfClosingElement(expr) || expr.kind === ts.SyntaxKind.TrueKeyword || expr.kind === ts.SyntaxKind.FalseKeyword || expr.kind === ts.SyntaxKind.NullKeyword) return NON_RUNNER;
+        return UNKNOWN;
+      }
+      /** The verdict for what this module exports under `name` (`default` for the
+       *  default export or a whole-module `module.exports = …`). */
+      exported(name) {
+        if (!this.exports) this.collectExports();
+        const local = this.exports?.get(name);
+        if (local) return local();
+        for (const spec of this.starExports) {
+          const v = this.moduleExport(spec, name);
+          if (v.kind !== "non-runner") return v;
+        }
+        return this.opaqueCjs ? UNKNOWN : NON_RUNNER;
+      }
+      collectExports() {
+        const exports = /* @__PURE__ */ new Map();
+        this.exports = exports;
+        const ctx = this.ctx;
+        const bySymbol = (id) => () => {
+          const sym = symbolAt(ctx, id);
+          return sym ? this.classify(sym) : UNKNOWN;
+        };
+        for (const stmt of ctx.sf.statements) {
+          if (ts.isExportDeclaration(stmt)) {
+            const spec = stmt.moduleSpecifier ? moduleName(stmt.moduleSpecifier) : null;
+            if (!stmt.exportClause) {
+              if (spec != null) this.starExports.push(spec);
+              else this.opaqueCjs = true;
+              continue;
+            }
+            if (!ts.isNamedExports(stmt.exportClause)) continue;
+            for (const el of stmt.exportClause.elements) {
+              const exportedName = el.name.text;
+              const localName = (el.propertyName ?? el.name).text;
+              if (spec != null) {
+                exports.set(exportedName, () => this.moduleExport(spec, localName));
+              } else {
+                exports.set(exportedName, () => {
+                  const sym = ctx.checker.getExportSpecifierLocalTargetSymbol(el);
+                  return sym ? this.classify(sym) : UNKNOWN;
+                });
+              }
+            }
+            continue;
+          }
+          if (ts.isExportAssignment(stmt)) {
+            exports.set("default", () => this.classifyExpression(stmt.expression));
+            continue;
+          }
+          if (isExported(stmt)) {
+            if (ts.isVariableStatement(stmt)) {
+              for (const decl of stmt.declarationList.declarations) {
+                if (ts.isIdentifier(decl.name)) exports.set(decl.name.text, bySymbol(decl.name));
+                else if (ts.isObjectBindingPattern(decl.name)) {
+                  for (const el of decl.name.elements) {
+                    if (ts.isIdentifier(el.name)) exports.set(el.name.text, bySymbol(el.name));
+                  }
+                }
+              }
+            } else if ((ts.isFunctionDeclaration(stmt) || ts.isClassDeclaration(stmt)) && stmt.name) {
+              exports.set(stmt.name.text, () => NON_RUNNER);
+            }
+            continue;
+          }
+          if (ts.isExpressionStatement(stmt) && ts.isBinaryExpression(stmt.expression) && stmt.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+            const target = cjsExportTarget(stmt.expression.left);
+            if (target == null) continue;
+            const value = stmt.expression.right;
+            if (target !== "") {
+              exports.set(target, () => this.classifyExpression(value));
+            } else if (ts.isObjectLiteralExpression(value)) {
+              for (const prop of value.properties) {
+                if (ts.isPropertyAssignment(prop) && (ts.isIdentifier(prop.name) || ts.isStringLiteralLike(prop.name))) {
+                  const init = prop.initializer;
+                  exports.set(prop.name.text, () => this.classifyExpression(init));
+                } else if (ts.isShorthandPropertyAssignment(prop)) {
+                  exports.set(prop.name.text, () => {
+                    const sym = ctx.checker.getShorthandAssignmentValueSymbol(prop);
+                    return sym ? this.classify(sym) : UNKNOWN;
+                  });
+                } else {
+                  this.opaqueCjs = true;
+                }
+              }
+            } else {
+              exports.set("default", () => this.classifyExpression(value));
+              this.opaqueCjs = true;
+            }
+          }
+        }
+      }
+    };
+    NO_AST = { hits: [], authoritative: false, unowned: /* @__PURE__ */ new Set() };
     testSkip = {
       id: RULE4,
       surface: ["file"],
       certainty: "mechanical",
-      run(changes, policy) {
+      run(changes, policy, _view, ctx) {
         const out3 = [];
+        const resolvers = {
+          before: new RunnerResolver(moduleSource(changes, "before", ctx)),
+          after: new RunnerResolver(moduleSource(changes, "after", ctx))
+        };
         for (const c of changes) {
           if (c.kind !== "file") continue;
           if (!isProtected(c.path, policy, "tests")) continue;
@@ -2505,9 +2894,11 @@ var init_test_skip = __esm({
           const patterns = PATTERNS2[lang ?? "js"];
           const astHitLines = /* @__PURE__ */ new Set();
           let astAuthoritative = false;
+          let unowned = /* @__PURE__ */ new Set();
           if (lang === "js" && c.after != null) {
-            const analysis = astSkipHits(c);
+            const analysis = astSkipHits(c, resolvers);
             astAuthoritative = analysis.authoritative;
+            unowned = analysis.unowned;
             for (const hit of analysis.hits) {
               astHitLines.add(hit.line);
               out3.push(
@@ -2525,7 +2916,7 @@ var init_test_skip = __esm({
             if (l.newLine != null && astHitLines.has(l.newLine)) continue;
             const comment = isCommentLine(l.content.trim(), lang);
             for (const p of patterns) {
-              if (astAuthoritative && p.astOwned) continue;
+              if (astAuthoritative && p.astOwned && !(l.newLine != null && unowned.has(l.newLine))) continue;
               if (comment && !p.comment) continue;
               if (matchesOutsideString(p, l.content, lang)) {
                 out3.push(
@@ -2548,133 +2939,6 @@ var init_test_skip = __esm({
   }
 });
 
-// src/detectors/repo.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { readFileSync as readFileSync3 } from "node:fs";
-import { join as join6 } from "node:path";
-function trackedFiles(ctx) {
-  if (!ctx) return null;
-  if (ctx.trackedFiles) return ctx.trackedFiles;
-  if (!ctx.cwd) return null;
-  const hit = cache2.get(ctx.cwd);
-  if (hit !== void 0) return hit;
-  let files = null;
-  try {
-    files = execFileSync5("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
-      cwd: ctx.cwd,
-      encoding: "utf8",
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"]
-    }).split("\0").filter(Boolean);
-  } catch {
-    files = null;
-  }
-  cache2.set(ctx.cwd, files);
-  return files;
-}
-function trackedContent(path, ctx) {
-  if (!ctx) return null;
-  if (ctx.trackedContents) return ctx.trackedContents[path] ?? null;
-  if (!ctx.cwd) return null;
-  const key2 = ctx.cwd + "\0" + path;
-  const hit = contentCache.get(key2);
-  if (hit !== void 0) return hit;
-  let src = null;
-  try {
-    src = readFileSync3(join6(ctx.cwd, path), "utf8");
-  } catch {
-    src = null;
-  }
-  contentCache.set(key2, src);
-  return src;
-}
-function branchRefs(ctx) {
-  if (!ctx?.cwd) return null;
-  const hit = refsCache.get(ctx.cwd);
-  if (hit !== void 0) return hit;
-  let refs = null;
-  try {
-    const out3 = execFileSync5("git", ["for-each-ref", "--format=%(refname:short)", "refs/heads", "refs/remotes"], {
-      cwd: ctx.cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    refs = new Set(out3.split("\n").map((l) => l.trim()).filter(Boolean));
-  } catch {
-    refs = null;
-  }
-  refsCache.set(ctx.cwd, refs);
-  return refs;
-}
-function branchExists(name, ctx) {
-  const refs = branchRefs(ctx);
-  if (!refs) return null;
-  if (refs.has(name)) return true;
-  for (const r of refs) if (r.endsWith("/" + name)) return true;
-  return false;
-}
-function revIsHead(rev2, ctx) {
-  if (!ctx?.cwd || rev2.startsWith("-")) return null;
-  const parse = (r) => {
-    try {
-      return execFileSync5("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${r}^{commit}`], {
-        cwd: ctx.cwd,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"]
-      }).trim();
-    } catch {
-      return null;
-    }
-  };
-  const head = parse("HEAD");
-  const target = parse(rev2);
-  if (!head || !target) return null;
-  return head === target;
-}
-function defaultBranch(ctx) {
-  if (!ctx?.cwd) return null;
-  const hit = branchCache.get(ctx.cwd);
-  if (hit !== void 0) return hit;
-  let name = null;
-  try {
-    const ref = execFileSync5("git", ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"], {
-      cwd: ctx.cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"]
-    }).trim();
-    name = ref.replace(/^origin\//, "") || null;
-  } catch {
-    name = null;
-  }
-  branchCache.set(ctx.cwd, name);
-  return name;
-}
-function containsProtected(token, policy, category, ctx, except) {
-  const dir = dirOf(token);
-  if (!dir || dir === "." || dir === "/" || dir.startsWith("-")) return false;
-  const counts = (p) => isProtected(p, policy, category) && !(except && isProtected(p, policy, except));
-  const files = trackedFiles(ctx);
-  if (files) {
-    const prefix = dir + "/";
-    return files.some((f) => f.startsWith(prefix) && counts(f));
-  }
-  if (counts(dir + "/probe")) return true;
-  const base = dir.split("/").pop() ?? "";
-  return category === "tests" && /^(?:test|tests|__tests__|spec|specs)$/i.test(base);
-}
-var cache2, contentCache, branchCache, refsCache, dirOf;
-var init_repo = __esm({
-  "src/detectors/repo.ts"() {
-    "use strict";
-    init_policy();
-    cache2 = /* @__PURE__ */ new Map();
-    contentCache = /* @__PURE__ */ new Map();
-    branchCache = /* @__PURE__ */ new Map();
-    refsCache = /* @__PURE__ */ new Map();
-    dirOf = (t) => t.replace(/^\.\//, "").replace(/\/+$/, "");
-  }
-});
-
 // src/detectors/coverage-lowering.ts
 function keyName(name) {
   if (ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name)) return name.text;
@@ -4105,8 +4369,8 @@ function stripComment(line) {
 }
 function checkIdentity(segment) {
   const core = segment.trim().replace(PREFIX, "").replace(/\s+/g, " ");
-  const viaRunner = RUNNER.test(core);
-  const rest = core.replace(RUNNER, "");
+  const viaRunner = RUNNER2.test(core);
+  const rest = core.replace(RUNNER2, "");
   const tool = rest.match(TOOL)?.[1] ?? (viaRunner ? rest.match(SCRIPT)?.[1] : void 0);
   if (!tool) return null;
   const toks = rest.replace(/^tamperward@\S+/, "tamperward").split(" ");
@@ -4122,7 +4386,7 @@ function checkIdentity(segment) {
   return tool;
 }
 function pinOfSegment(segment) {
-  const m = segment.trim().replace(PREFIX, "").replace(RUNNER, "").match(/^tamperward(?:@(\S+))?\b/);
+  const m = segment.trim().replace(PREFIX, "").replace(RUNNER2, "").match(/^tamperward(?:@(\S+))?\b/);
   return m ? m[1] ?? "" : null;
 }
 function split(stmt) {
@@ -4985,7 +5249,7 @@ function installerOf(script) {
     const raw = seg.trim();
     if (!raw) continue;
     if (/^(?:HUSKY|LEFTHOOK)=0\b/.test(raw)) continue;
-    const core = raw.replace(PREFIX, "").replace(RUNNER, "").replace(/\s+/g, " ");
+    const core = raw.replace(PREFIX, "").replace(RUNNER2, "").replace(/\s+/g, " ");
     const m = core.match(/^(?:node\s+)?(?:\S*\/)?(husky|lefthook|simple-git-hooks|pre-commit)(?:\.js)?(?:\s+(\S+))?/);
     if (!m) continue;
     const [, tool, sub] = m;
@@ -5283,7 +5547,7 @@ function xargsWritesHook(toks, fed, policy, ctx) {
   if ((cmd === "sed" || cmd === "perl") && args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a))) return `xargs ${cmd} -i rewrites a protected hook named earlier in the line`;
   return null;
 }
-var isComment, RUNNER, TOOL, SCRIPT, SUBCOMMAND_TOOLS, PREFIX, MODE, CWD, unq, alwaysTrue, EXIT_ZERO, EXIT_ANY, FN_DEF, SENSITIVE_ENV, assignedNames, WAIT_PID, TRANSPARENT, strip, baseIdentity, isCodeowners, GATE_CRITICAL, isDoc, isLefthook, isLefthookLocal, isPreCommitConfig, isPackageJson, GATE, str, list, redirectingEnv, off, STAGE_ALIAS, GATE_STAGES, ALL_STAGES, normStage, INSTALL_SCRIPTS, GIT_HOOKS, ownerExec, SYMBOLIC, WRAPPERS, INTERPRETERS, INLINE_FLAG, EDITORS, SCRIPT_WORD, HOOK_BASENAMES, REDIRECT_TARGET;
+var isComment, RUNNER2, TOOL, SCRIPT, SUBCOMMAND_TOOLS, PREFIX, MODE, CWD, unq, alwaysTrue, EXIT_ZERO, EXIT_ANY, FN_DEF, SENSITIVE_ENV, assignedNames, WAIT_PID, TRANSPARENT, strip, baseIdentity, isCodeowners, GATE_CRITICAL, isDoc, isLefthook, isLefthookLocal, isPreCommitConfig, isPackageJson, GATE, str, list, redirectingEnv, off, STAGE_ALIAS, GATE_STAGES, ALL_STAGES, normStage, INSTALL_SCRIPTS, GIT_HOOKS, ownerExec, SYMBOLIC, WRAPPERS, INTERPRETERS, INLINE_FLAG, EDITORS, SCRIPT_WORD, HOOK_BASENAMES, REDIRECT_TARGET;
 var init_hook_wiring = __esm({
   "src/detectors/hook-wiring.ts"() {
     "use strict";
@@ -5292,7 +5556,7 @@ var init_hook_wiring = __esm({
     init_wiring();
     init_repo();
     isComment = (line) => /^\s*#/.test(line);
-    RUNNER = /^(?:npx|pnpm|yarn|bunx|bun|npm)\s+(?:(?:exec|dlx|x|run)\s+)?(?:(?:--yes|-y|--no-install|--silent|-s|--)\s+)*/;
+    RUNNER2 = /^(?:npx|pnpm|yarn|bunx|bun|npm)\s+(?:(?:exec|dlx|x|run)\s+)?(?:(?:--yes|-y|--no-install|--silent|-s|--)\s+)*/;
     TOOL = /^(tamperward|jest|vitest|eslint|tsc|lint-staged|lefthook|husky|pytest|make|cargo|go|pre-commit|mypy|ruff|rubocop|prettier|gradlew?)\b/;
     SCRIPT = /^(test|tests|lint|typecheck|type-check|coverage|check)\b/;
     SUBCOMMAND_TOOLS = /* @__PURE__ */ new Set(["tamperward", "make", "cargo", "go", "lefthook", "husky", "pre-commit"]);
@@ -7206,7 +7470,7 @@ function namesProtectedSnapshot(seg, policy) {
   }
   return null;
 }
-var RULE10, RUNNER2, PM_TEST_SCRIPT, UPDATE_ANY, UPDATE_WITH_RUNNER, INSTA_ACCEPT, UPDATE_EXPECT, REGEN_SCRIPT, MUTATE, snapshotRewrite;
+var RULE10, RUNNER3, PM_TEST_SCRIPT, UPDATE_ANY, UPDATE_WITH_RUNNER, INSTA_ACCEPT, UPDATE_EXPECT, REGEN_SCRIPT, MUTATE, snapshotRewrite;
 var init_snapshot_rewrite = __esm({
   "src/detectors/snapshot-rewrite.ts"() {
     "use strict";
@@ -7214,7 +7478,7 @@ var init_snapshot_rewrite = __esm({
     init_finding();
     init_command();
     RULE10 = "snapshot-rewrite";
-    RUNNER2 = /\b(?:jest|vitest|playwright|ava)\b/;
+    RUNNER3 = /\b(?:jest|vitest|playwright|ava)\b/;
     PM_TEST_SCRIPT = /(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:t|tst|test|run(?:-script)?\s+\S*test\S*)(?:\s|$)/;
     UPDATE_ANY = /--(?:update-?[sS]napshots?|test-update-snapshots|snapshot-update)\b/;
     UPDATE_WITH_RUNNER = /(?:^|\s)(?:-u|--update)(?:\s|$)/;
@@ -7234,7 +7498,7 @@ var init_snapshot_rewrite = __esm({
             for (const seg of segments(c.raw)) {
               let why = null;
               if (UPDATE_ANY.test(seg)) why = "the snapshot-update flag rewrites every failing snapshot to match current output";
-              else if ((RUNNER2.test(seg) || PM_TEST_SCRIPT.test(seg)) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
+              else if ((RUNNER3.test(seg) || PM_TEST_SCRIPT.test(seg)) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
               else if (INSTA_ACCEPT.test(seg)) why = "cargo insta accept rewrites every pending snapshot to match current output";
               else if (UPDATE_EXPECT.test(seg)) why = "UPDATE_EXPECT=1 rewrites every expect-test expectation to match current output";
               else if (REGEN_SCRIPT.test(seg)) why = "a regeneration script rewrites the recorded expected output from current output";
@@ -7642,7 +7906,7 @@ var init_engine = __esm({
 
 // src/policy-load.ts
 import { readFileSync as readFileSync5, existsSync as existsSync5 } from "node:fs";
-import { isAbsolute as isAbsolute7, join as join8, posix as posix2 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join8, posix as posix3 } from "node:path";
 function normalizeVersion(v, where = POLICY_FILE) {
   if (v === void 0 || v === null) return 1;
   if (typeof v !== "number" || !Number.isInteger(v) || v < 1) {
@@ -7652,7 +7916,7 @@ function normalizeVersion(v, where = POLICY_FILE) {
 }
 function ledgerInsideRepo(ledger) {
   if (!ledger.trim() || isAbsolute7(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
-  const norm2 = posix2.normalize(ledger.replace(/\\/g, "/"));
+  const norm2 = posix3.normalize(ledger.replace(/\\/g, "/"));
   return norm2 !== ".." && !norm2.startsWith("../") && !norm2.startsWith("/");
 }
 function validate(r, where) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.7",
+  "version": "2.23.8",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",