tamperward 2.24.0 → 2.24.2

package/dist/cli/index.js

@@ -3715,6 +3715,22 @@ var init_lint_suppression = __esm({
 
 // src/detectors/test-skip.ts
 import { posix as posix2 } from "node:path";
+function pyMarkAliases(source) {
+  const out3 = /* @__PURE__ */ new Set();
+  for (const m of source.matchAll(PY_MARK_ALIAS)) out3.add(m[1]);
+  return out3;
+}
+function pyAliasDecoratorHits(c) {
+  const added = addedLines(c);
+  const aliases = pyMarkAliases(c.after ?? added.map((l) => l.content).join("\n"));
+  if (aliases.size === 0) return [];
+  const hits = [];
+  for (const l of added) {
+    const m = PY_DECORATOR.exec(l.content);
+    if (m && aliases.has(m[1])) hits.push({ line: l.newLine ?? void 0, evidence: l.content.trim() });
+  }
+  return hits;
+}
 function matchesOutsideString(p, content, lang) {
   if (p.comment) return p.re.test(content);
   const re = p.re.global ? p.re : new RegExp(p.re.source, p.re.flags + "g");
@@ -4046,7 +4062,7 @@ function astSkipHits(c, resolvers) {
   }
   return { hits, authoritative: true, unowned: analysis.unowned };
 }
-var RULE4, acc, JS_RUNNER, JS_MOD, PATTERNS2, JS_RUNNERS, JS_CHAIN_MODIFIERS, JS_DEFAULT_RUNNER_MODULES, JS_TEST_MODULES, RUNNER2, NON_RUNNER, UNKNOWN, withCause, MODULE_EXTENSIONS, RunnerResolver, ModuleBinder, NO_AST, testSkip;
+var RULE4, acc, JS_RUNNER, JS_MOD, GO_SKIP_PATTERNS, PY_MARK, PY_CONFTEST_PATTERNS, PY_MARK_ALIAS, PY_DECORATOR, PATTERNS2, JS_RUNNERS, JS_CHAIN_MODIFIERS, JS_DEFAULT_RUNNER_MODULES, JS_TEST_MODULES, RUNNER2, NON_RUNNER, UNKNOWN, withCause, MODULE_EXTENSIONS, RunnerResolver, ModuleBinder, NO_AST, testSkip;
 var init_test_skip = __esm({
   "src/detectors/test-skip.ts"() {
     "use strict";
@@ -4060,6 +4076,21 @@ var init_test_skip = __esm({
     acc = (names) => `(?:\\s*\\.\\s*(?:${names})(?![\\w$])|\\s*\\[\\s*['"\`](?:${names})['"\`]\\s*\\])`;
     JS_RUNNER = "\\b(?:it|test|describe|suite)";
     JS_MOD = "concurrent|sequential|shuffle|serial|parallel";
+    GO_SKIP_PATTERNS = [
+      { re: /\b\w+\.Skip(?:f|Now)?\(/, why: "a runtime t.Skip()/Skipf()/SkipNow() call" },
+      { re: /\bT\(\)\.Skip(?:f|Now)?\(/, why: "a runtime T().Skip()/Skipf()/SkipNow() call (testify suite)" }
+    ];
+    PY_MARK = "(?:\\w+\\.)?mark\\.(?:skip|skipif|xfail)\\b";
+    PY_CONFTEST_PATTERNS = [
+      { re: /\bdef\s+pytest_collection_modifyitems\s*\(/, why: "a pytest_collection_modifyitems hook (collected tests are filtered or marked before they run)" },
+      { re: /\bdef\s+pytest_pycollect_makeitem\s*\(/, why: "a pytest_pycollect_makeitem hook (what counts as a test is decided here)" },
+      { re: /\bdef\s+pytest_runtest_makereport\s*\(/, why: "a pytest_runtest_makereport hook (the test report can be rewritten)" },
+      { re: new RegExp("\\.add_marker\\(\\s*" + PY_MARK), why: "an add_marker(mark.skip/skipif/xfail) call (the test is skipped programmatically)" },
+      { re: new RegExp("^\\s*\\w+\\s*=\\s*" + PY_MARK), why: "a skip/skipif/xfail marker bound to a name (an aliased decorator)" },
+      { re: /\b\w+\.outcome\s*=\s*['"](?:passed|skipped)['"]/, why: "a report outcome rewritten to passed/skipped" }
+    ];
+    PY_MARK_ALIAS = new RegExp("^\\s*(\\w+)\\s*=\\s*" + PY_MARK, "gm");
+    PY_DECORATOR = /^\s*@(\w+)\s*(?:\(|$)/;
     PATTERNS2 = {
       js: [
         // The skip/only/todo family on a runner, by dot-or-bracket access, with one optional
@@ -4103,10 +4134,13 @@ var init_test_skip = __esm({
         { re: /@(?:unittest\.)?(?:skip|skipIf|skipUnless|expectedFailure)\b/, why: "a unittest skip/expectedFailure decorator" },
         { re: /\bself\.skipTest\(/, why: "a runtime self.skipTest() call" },
         { re: /\braise\s+(?:unittest\.)?SkipTest\b/, why: "a raised SkipTest" },
-        { re: /\b__test__\s*=\s*False\b/, why: "__test__ = False hides the test from collection" }
+        { re: /\b__test__\s*=\s*False\b/, why: "__test__ = False hides the test from collection" },
+        ...PY_CONFTEST_PATTERNS
+        // #441
       ],
       go: [
-        { re: /\b[tb]\.Skip(?:f|Now)?\(/, why: "a runtime t.Skip()/Skipf()/SkipNow() call" },
+        ...GO_SKIP_PATTERNS,
+        // #441: any receiver, and testify's T()
         { re: /\bif\s+testing\.Short\(\)/, why: "a testing.Short() guard (the body is skipped under -short)" },
         { re: /^\s*\/\/\s*(?:go:build|\+build)\s+ignore\b/, why: "a build-ignore constraint (the file is excluded from the test run)", comment: true }
       ],
@@ -4440,6 +4474,20 @@ var init_test_skip = __esm({
               );
             }
           }
+          if (lang === "py") {
+            for (const hit of pyAliasDecoratorHits(c)) {
+              if (hit.line != null) astHitLines.add(hit.line);
+              out3.push(
+                makeFinding(RULE4, policy, {
+                  file: c.path,
+                  line: hit.line,
+                  message: "Test skipped or narrowed: a decorator aliasing a pytest skip/skipif/xfail marker.",
+                  evidence: hit.evidence,
+                  remediation: "Make the test pass rather than skipping it. If it is genuinely obsolete, a human must sign off."
+                })
+              );
+            }
+          }
           for (const l of addedLines(c)) {
             if (l.newLine != null && astHitLines.has(l.newLine)) continue;
             const comment = isCommentLine(l.content.trim(), lang);
@@ -7365,6 +7413,50 @@ function syntheticBase(over) {
   }
   return base;
 }
+function freshLefthookBase(after) {
+  const base = {};
+  for (const [section, v] of Object.entries(after)) {
+    if (!isObj(v)) continue;
+    for (const group of ["commands", "scripts"]) {
+      const g = v[group];
+      if (!isObj(g)) continue;
+      for (const [name, cfg] of Object.entries(g)) {
+        if (!isObj(cfg)) continue;
+        const run = cfg.run ?? cfg.runner;
+        if (!namesGate(name) && !namesGate(run)) continue;
+        const sec = base[section] ??= {};
+        const grp = sec[group] ??= {};
+        grp[name] = { run: typeof run === "string" ? liveOrCanonical(run) : CANONICAL_GATE };
+      }
+    }
+  }
+  return base;
+}
+function freshPreCommitBase(after) {
+  const stagesOf = (v) => Array.isArray(v) && v.map(String).some((s) => COMMIT_STAGES.has(s)) ? v.map(String) : null;
+  const defaults = stagesOf(after.default_stages);
+  const repos = [];
+  for (const repo of Array.isArray(after.repos) ? after.repos : []) {
+    if (!isObj(repo)) continue;
+    const hooks = [];
+    for (const h of Array.isArray(repo.hooks) ? repo.hooks : []) {
+      if (!isObj(h)) continue;
+      if (![repo.repo, h.id, h.entry, h.name].some(namesGate)) continue;
+      const fresh = { id: h.id, name: h.name };
+      if (h.entry !== void 0) {
+        const args = Array.isArray(h.args) ? h.args.map(String).join(" ") : "";
+        fresh.entry = liveOrCanonical(`${typeof h.entry === "string" ? h.entry : ""} ${args}`.trim());
+      }
+      const stages = stagesOf(h.stages);
+      if (stages) fresh.stages = stages;
+      hooks.push(fresh);
+    }
+    repos.push({ repo: repo.repo, hooks });
+  }
+  const base = { repos };
+  if (defaults) base.default_stages = defaults;
+  return base;
+}
 function configFindings(c, changes, policy, ctx) {
   if (c.after == null) return null;
   let reasons;
@@ -7374,8 +7466,11 @@ function configFindings(c, changes, policy, ctx) {
     if (overBefore === null) return null;
     const base = lefthookBase(c, changes, ctx) ?? syntheticBase(overAfter ?? {});
     reasons = overAfter === null ? ["the file no longer parses as YAML \u2014 the tool that reads it runs nothing"] : lefthookWeakening(mergeDocs(base, overBefore), mergeDocs(base, overAfter));
+  } else if (c.before == null) {
+    const after = parseDoc(c.after);
+    if (after === null) return [];
+    reasons = isLefthook(c.path) ? lefthookWeakening(freshLefthookBase(after), after) : preCommitWeakening(freshPreCommitBase(after), after);
   } else {
-    if (c.before == null) return null;
     const before = parseDoc(c.before);
     const after = parseDoc(c.after);
     if (before === null) return null;
@@ -7433,7 +7528,7 @@ function huskyRuntimeWrite(path, content, ctx) {
     (i) => i.identity === "tamperward check --staged" && i.state === "live" && i.pin === TW_VERSION
   );
 }
-var RULE8, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, hookTampering;
+var RULE8, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, CANONICAL_GATE, COMMIT_STAGES, namesGate, liveOrCanonical, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, hookTampering;
 var init_hook_tampering = __esm({
   "src/detectors/hook-tampering.ts"() {
     "use strict";
@@ -7469,6 +7564,10 @@ var init_hook_tampering = __esm({
     envMechanism = (k) => ENV_MECHANISM.find(([re]) => re.test(k))?.[1] ?? null;
     mentionsGate = (v) => /\btamperward\b/.test(JSON.stringify(v) ?? "");
     carriesGate = (s) => EVENTS.some((e) => gateCandidates(s, e).length > 0);
+    CANONICAL_GATE = "npx tamperward check --staged";
+    COMMIT_STAGES = /* @__PURE__ */ new Set(["pre-commit", "pre-push", "commit", "push"]);
+    namesGate = (v) => typeof v === "string" && /\btamperward\b/.test(v);
+    liveOrCanonical = (cmd) => gateOf(cmd) !== null ? cmd : CANONICAL_GATE;
     HUSKY_SHIM = '#!/usr/bin/env sh\n. "$(dirname "$0")/h"';
     HUSKY_SHIM_NAMES = /* @__PURE__ */ new Set(["applypatch-msg", "commit-msg", "post-applypatch", "post-checkout", "post-commit", "post-merge", "post-rewrite", "pre-applypatch", "pre-auto-gc", "pre-commit", "pre-merge-commit", "pre-push", "pre-rebase", "prepare-commit-msg"]);
     HUSKY_H_KNOWN = [
@@ -7508,7 +7607,7 @@ They WILL FAIL in v10.0.0
 "`;
     stripTrailingNl = (s) => s.endsWith("\n") ? s.slice(0, -1) : s;
     isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
-    isHookNote = (path) => /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
+    isHookNote = (path) => !/(?:^|\/)\.husky\/_\//.test(path) && /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
     hookTampering = {
       id: RULE8,
       surface: ["file", "command"],
@@ -7582,6 +7681,7 @@ They WILL FAIL in v10.0.0
               out3.push(...semantic);
             } else if (!c.path.endsWith(POLICY_FILE)) {
               if ((c.op === "add" || c.op === "modify") && huskyRuntimeWrite(c.path, c.after, ctx)) continue;
+              if (isHookNote(c.path)) continue;
               const husky = isHuskyScript(c.path);
               const opts = husky ? { errexit: true } : {};
               const beforePin = c.before != null && c.after != null ? initScriptPin(c.before) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.24.0",
+  "version": "2.24.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",