tamperward 2.24.3 → 2.24.5

package/dist/cli/index.js

@@ -1536,11 +1536,86 @@ function gitSubcommand(toks) {
   }
   return null;
 }
-var GIT_OPT_WITH_ARG;
+function shellWord(t) {
+  let out3 = "";
+  let single = false;
+  let double = false;
+  for (let i = 0; i < t.length; i++) {
+    const ch = t[i];
+    if (single) {
+      if (ch === "'") single = false;
+      else out3 += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < t.length && (!double || /["\\$`]/.test(t[i + 1]))) {
+      out3 += t[++i];
+      continue;
+    }
+    if (ch === "'" && !double) {
+      single = true;
+      continue;
+    }
+    if (ch === '"') {
+      double = !double;
+      continue;
+    }
+    out3 += ch;
+  }
+  return out3;
+}
+function expandBraces(t) {
+  const m = t.match(/^([^{]*)\{([^{}]*)\}(.*)$/);
+  if (!m) return [t];
+  return m[2].split(",").flatMap((alt) => expandBraces(`${m[1]}${alt}${m[3]}`));
+}
+function globToRegExp(pattern) {
+  const classes = [];
+  const src = pattern.replace(/^\.\//, "").replace(/\[([^\][]*)\]/g, (_, body) => {
+    classes.push(`[${body.replace(/^!/, "^").replace(/\\/g, "\\\\")}]`);
+    return "
";
+  }).replace(/[.+^${}()|\\[\]]/g, "\\$&").replace(/\*\*\/?/g, "\0").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replace(/\0/g, "(?:.*/)?").replace(/
/g, () => classes.shift() ?? "");
+  return new RegExp(`^(?:\\./)?${src}/?$`);
+}
+function expandGlob(t, listing) {
+  const alts = expandBraces(t);
+  if (!alts.some((a) => GLOB_CHARS.test(a))) return alts;
+  const out3 = /* @__PURE__ */ new Set();
+  for (const alt of alts) {
+    if (!GLOB_CHARS.test(alt)) {
+      out3.add(alt);
+      continue;
+    }
+    let re;
+    try {
+      re = globToRegExp(alt);
+    } catch {
+      out3.add(alt);
+      continue;
+    }
+    const depth = alt.replace(/^\.\//, "").replace(/\/+$/, "").split("/").length;
+    for (const f of listing) {
+      if (re.test(f)) {
+        out3.add(f);
+        continue;
+      }
+      const parts = f.split("/");
+      if (parts.length > depth && !alt.includes("**")) {
+        const dir = parts.slice(0, depth).join("/");
+        if (re.test(dir)) out3.add(dir);
+      }
+    }
+  }
+  return [...out3];
+}
+function isGlob(t) {
+  return GLOB_CHARS.test(t) || /\{[^{}]*\}/.test(t);
+}
+var GIT_OPT_WITH_ARG, GLOB_CHARS;
 var init_command = __esm({
   "src/detectors/command.ts"() {
     "use strict";
     GIT_OPT_WITH_ARG = /* @__PURE__ */ new Set(["-c", "-C", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env"]);
+    GLOB_CHARS = /[*?[]/;
   }
 });
 
@@ -2850,16 +2925,20 @@ function shellWritesHook(seg, toks, policy, ctx) {
       return null;
   }
 }
-function xargsWritesHook(toks, fed, policy, ctx) {
+function xargsCommand(toks) {
   const at = toks.findIndex((t) => t === "xargs" || t.endsWith("/xargs"));
   if (at === -1) return null;
+  let i = at + 1;
+  while (i < toks.length && toks[i].startsWith("-")) i += /^-(?:I|n|L|P|d|a|s)$/.test(toks[i]) ? 2 : 1;
+  return { cmd: (toks[i] ?? "").replace(/^.*\//, ""), args: toks.slice(i + 1), at: i };
+}
+function xargsWritesHook(toks, fed, policy, ctx) {
+  const run = xargsCommand(toks);
+  if (run === null) return null;
   const { hookish } = hookTests(policy, ctx);
   const fedHook = fed.some(hookish);
   if (!fedHook) return null;
-  let i = at + 1;
-  while (i < toks.length && toks[i].startsWith("-")) i += /^-(?:I|n|L|P|d|a|s)$/.test(toks[i]) ? 2 : 1;
-  const cmd = (toks[i] ?? "").replace(/^.*\//, "");
-  const args = toks.slice(i + 1);
+  const { cmd, args, at: i } = run;
   if (["rm", "unlink", "shred", "truncate", "mv", "tee", "sponge"].includes(cmd)) return `xargs ${cmd} rewrites or removes a protected hook named earlier in the line`;
   if (cmd === "chmod" && chmodDropsExec(toks.slice(i))) return "xargs chmod removes execute permission from a hook named earlier in the line";
   if ((cmd === "sed" || cmd === "perl") && args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a))) return `xargs ${cmd} -i rewrites a protected hook named earlier in the line`;
@@ -3819,6 +3898,47 @@ function matchesOutsideString(p, content, lang) {
   }
   return false;
 }
+function afterLinesOf(c) {
+  const out3 = /* @__PURE__ */ new Map();
+  if (c.after != null) {
+    c.after.split("\n").forEach((l, i) => out3.set(i + 1, l));
+    return out3;
+  }
+  for (const h of c.hunks) for (const l of h.lines) if (l.newLine != null && l.type !== "del") out3.set(l.newLine, l.content);
+  return out3;
+}
+function contextSkipHits(c, lang) {
+  if (lang !== "go" && lang !== "rs") return [];
+  const lines = afterLinesOf(c);
+  const hits = [];
+  for (const l of addedLines(c)) {
+    if (l.newLine == null) continue;
+    if (lang === "go") {
+      const m = GO_TEST_MAIN.exec(l.content);
+      if (!m) continue;
+      const runs = new RegExp("\\b" + m[1] + "\\.Run\\(\\)");
+      let ran = false;
+      for (const [, text] of lines) if (runs.test(text) && !isCommentLine(text.trim(), lang)) ran = true;
+      if (!ran) hits.push({ line: l.newLine, why: `a TestMain that never calls ${m[1]}.Run() (no test in the package runs)`, evidence: l.content.trim() });
+      continue;
+    }
+    const cfg = RS_CFG.exec(l.content);
+    if (!cfg || cfg[1].trim() === "test") continue;
+    let first = l.newLine;
+    while (RS_ATTR.test(lines.get(first - 1) ?? "")) first--;
+    let at = l.newLine + 1;
+    while (RS_ATTR.test(lines.get(at) ?? "") || lines.has(at) && !/\S/.test(lines.get(at) ?? "")) at++;
+    const item = lines.get(at) ?? "";
+    let besideTest = false;
+    for (let i = first; i < at; i++) if (RS_TEST_ATTR.test(lines.get(i) ?? "")) besideTest = true;
+    if (RS_MOD.test(item)) {
+      hits.push({ line: l.newLine, why: "a #[cfg(\u2026)] on the test module (the tests are compiled out under every ordinary configuration)", evidence: l.content.trim() });
+    } else if (besideTest && RS_FN.test(item)) {
+      hits.push({ line: l.newLine, why: "a #[cfg(\u2026)] beside #[test] (the test is compiled out under every ordinary configuration)", evidence: l.content.trim() });
+    }
+  }
+  return hits;
+}
 function scriptKind2(path) {
   if (/\.tsx$/i.test(path)) return ts.ScriptKind.TSX;
   if (/\.jsx$/i.test(path)) return ts.ScriptKind.JSX;
@@ -4147,7 +4267,7 @@ function astSkipHits(c, resolvers) {
   }
   return { hits, authoritative: true, unowned: analysis.unowned };
 }
-var RULE4, acc, JS_RUNNER, JS_MOD, GO_SKIP_PATTERNS, PY_MARK, PY_CONFTEST_PATTERNS, PY_MARK_ALIAS, PY_DECORATOR, PATTERNS2, JS_RUNNERS, JS_DEFAULT_RUNNER_MODULES, JS_TEST_MODULES, RUNNER2, NON_RUNNER, UNKNOWN, withCause, MODULE_EXTENSIONS, RunnerResolver, ModuleBinder, NO_AST, testSkip;
+var RULE4, acc, JS_RUNNER, JS_MOD, JVM_CONDITIONAL, GO_SKIP_PATTERNS, PY_MARK, PY_CONFTEST_PATTERNS, PY_MARK_ALIAS, PY_DECORATOR, PATTERNS2, JS_RUNNERS, JS_DEFAULT_RUNNER_MODULES, JS_TEST_MODULES, GO_TEST_MAIN, RS_CFG, RS_ATTR, RS_TEST_ATTR, RS_MOD, RS_FN, RUNNER2, NON_RUNNER, UNKNOWN, withCause, MODULE_EXTENSIONS, RunnerResolver, ModuleBinder, NO_AST, testSkip;
 var init_test_skip = __esm({
   "src/detectors/test-skip.ts"() {
     "use strict";
@@ -4162,6 +4282,7 @@ var init_test_skip = __esm({
     acc = (names) => `(?:\\s*\\.\\s*(?:${names})(?![\\w$])|\\s*\\[\\s*['"\`](?:${names})['"\`]\\s*\\])`;
     JS_RUNNER = "\\b(?:it|test|describe|suite)";
     JS_MOD = "concurrent|sequential|shuffle|serial|parallel";
+    JVM_CONDITIONAL = /@(?:[\w.]+\.)?(?:EnabledIf|DisabledIf)\w*\b/;
     GO_SKIP_PATTERNS = [
       { re: /\b\w+\.Skip(?:f|Now)?\(/, why: "a runtime t.Skip()/Skipf()/SkipNow() call" },
       { re: /\bT\(\)\.Skip(?:f|Now)?\(/, why: "a runtime T().Skip()/Skipf()/SkipNow() call (testify suite)" }
@@ -4228,7 +4349,10 @@ var init_test_skip = __esm({
         ...GO_SKIP_PATTERNS,
         // #441: any receiver, and testify's T()
         { re: /\bif\s+testing\.Short\(\)/, why: "a testing.Short() guard (the body is skipped under -short)" },
-        { re: /^\s*\/\/\s*(?:go:build|\+build)\s+ignore\b/, why: "a build-ignore constraint (the file is excluded from the test run)", comment: true }
+        // Any constraint on a `_test.go` — `ignore`, `integration`, `never`, `!ci` — takes
+        // the file out of the default `go test ./...` run; the tag's name is the agent's
+        // to choose (#431).
+        { re: /^\s*\/\/\s*(?:go:build|\+build)\b/, why: "a build constraint on a test file (the file is excluded from the default test run)", comment: true }
       ],
       rs: [
         { re: /#\[ignore\b/, why: "an #[ignore] attribute (the test no longer runs by default)" },
@@ -4239,14 +4363,19 @@ var init_test_skip = __esm({
         { re: /(?:^|[\s;{(])x(?:it|describe|context|specify|example)\s*[('"]/, why: "an x-prefixed disabled example" },
         { re: /(?:^|[\s;{(])f(?:it|describe|context)\s*[('"]/, why: "an f-prefixed focused example (narrows the suite)" },
         { re: /\b(?:skip|pending):\s*(?:true|['"])/, why: "a skip/pending metadata flag" },
-        { re: /^\s*(?:it|specify|example)\s+(['"])(?:(?!\1).)*\1\s*$/, why: "an example with no block (RSpec reports it as pending)" }
+        { re: /^\s*(?:it|specify|example)\s+(['"])(?:(?!\1).)*\1\s*$/, why: "an example with no block (RSpec reports it as pending)" },
+        // `it 'x', if: false do` — RSpec's conditional filter with a constant that never
+        // lets the example run (#431). `if: ENV['SLOW']` is a real condition and passes.
+        { re: /(?:^|[\s;{(])(?:it|specify|example|describe|context|scenario|feature)\s*[('"].*(?:\bif:\s*false\b|\bunless:\s*true\b|:if\s*=>\s*false\b|:unless\s*=>\s*true\b)/, why: "a constant-false if:/unless: filter (the example never runs)" }
       ],
       java: [
         { re: /@(?:[\w.]+\.)?(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" },
+        { re: JVM_CONDITIONAL, why: "a conditional-execution annotation (@EnabledIf\u2026 / @DisabledIf\u2026: the test runs only when the condition allows)" },
         { re: /\bassume(?:True\(\s*false|False\(\s*true)\s*[,)]/, why: "an assumption that never holds (the test aborts as skipped)" }
       ],
       kt: [
         { re: /@(?:[\w.]+\.)?(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" },
+        { re: JVM_CONDITIONAL, why: "a conditional-execution annotation (@EnabledIf\u2026 / @DisabledIf\u2026: the test runs only when the condition allows)" },
         { re: /\bassume(?:True\(\s*false|False\(\s*true)\s*[,)]/, why: "an assumption that never holds (the test aborts as skipped)" }
       ],
       php: [{ re: /\bmarkTest(?:Skipped|Incomplete)\(/, why: "a markTestSkipped()/markTestIncomplete() call" }],
@@ -4268,6 +4397,12 @@ var init_test_skip = __esm({
       "bun:test",
       "@playwright/test"
     ]);
+    GO_TEST_MAIN = /^func\s+TestMain\s*\(\s*(\w+)\s+\*testing\.M\s*\)/;
+    RS_CFG = /^\s*#\[cfg\((.*)\)\]\s*$/;
+    RS_ATTR = /^\s*#!?\[/;
+    RS_TEST_ATTR = /^\s*#\[[\w:]*test\b/;
+    RS_MOD = /^\s*(?:pub(?:\([^)]*\))?\s+)?mod\s+\w+/;
+    RS_FN = /^\s*(?:pub(?:\([^)]*\))?\s+)?(?:async\s+)?(?:unsafe\s+)?fn\s+\w+/;
     RUNNER2 = { kind: "runner", causes: [] };
     NON_RUNNER = { kind: "non-runner" };
     UNKNOWN = { kind: "unknown" };
@@ -4559,6 +4694,18 @@ var init_test_skip = __esm({
               );
             }
           }
+          for (const hit of contextSkipHits(c, lang)) {
+            astHitLines.add(hit.line);
+            out3.push(
+              makeFinding(RULE4, policy, {
+                file: c.path,
+                line: hit.line,
+                message: `Test skipped or narrowed: ${hit.why}.`,
+                evidence: hit.evidence,
+                remediation: "Make the test pass rather than skipping it. If it is genuinely obsolete, a human must sign off."
+              })
+            );
+          }
           if (lang === "py") {
             for (const hit of pyAliasDecoratorHits(c)) {
               if (hit.line != null) astHitLines.add(hit.line);
@@ -7957,6 +8104,289 @@ They WILL FAIL in v10.0.0
   }
 });
 
+// src/detectors/reachability.ts
+function constTruth(expr) {
+  const v = constValue(expr);
+  if (v === null) return null;
+  return v.kind === "unknown" ? v.truthy : Boolean(v.value);
+}
+function constValue(expr) {
+  if (ts.isParenthesizedExpression(expr)) return constValue(expr.expression);
+  if (expr.kind === ts.SyntaxKind.TrueKeyword) return { kind: "value", value: true };
+  if (expr.kind === ts.SyntaxKind.FalseKeyword) return { kind: "value", value: false };
+  if (expr.kind === ts.SyntaxKind.NullKeyword) return { kind: "value", value: null };
+  if (ts.isIdentifier(expr)) {
+    if (expr.text === "undefined") return { kind: "value", value: void 0 };
+    if (expr.text === "NaN") return { kind: "value", value: NaN };
+    return null;
+  }
+  if (ts.isNumericLiteral(expr)) return { kind: "value", value: Number(expr.text) };
+  if (ts.isBigIntLiteral(expr)) return { kind: "unknown", truthy: !/^0+n$/.test(expr.text) };
+  if (ts.isStringLiteralLike(expr)) return { kind: "value", value: expr.text };
+  if (ts.isVoidExpression(expr)) return { kind: "value", value: void 0 };
+  if (ts.isPrefixUnaryExpression(expr)) {
+    if (expr.operator === ts.SyntaxKind.ExclamationToken) {
+      const inner = constTruth(expr.operand);
+      return inner === null ? null : { kind: "value", value: !inner };
+    }
+    if (expr.operator === ts.SyntaxKind.MinusToken || expr.operator === ts.SyntaxKind.PlusToken) {
+      const inner = constValue(expr.operand);
+      if (inner === null || inner.kind !== "value" || typeof inner.value !== "number") return null;
+      return { kind: "value", value: expr.operator === ts.SyntaxKind.MinusToken ? -inner.value : inner.value };
+    }
+    return null;
+  }
+  if (ts.isBinaryExpression(expr)) {
+    const op = expr.operatorToken.kind;
+    if (op === ts.SyntaxKind.AmpersandAmpersandToken || op === ts.SyntaxKind.BarBarToken) {
+      const l2 = constTruth(expr.left);
+      const r2 = constTruth(expr.right);
+      const and = op === ts.SyntaxKind.AmpersandAmpersandToken;
+      if (and) {
+        if (l2 === false || r2 === false) return { kind: "unknown", truthy: false };
+        if (l2 === true) return r2 === null ? null : { kind: "unknown", truthy: r2 };
+        if (r2 === true) return l2 === null ? null : { kind: "unknown", truthy: l2 };
+        return null;
+      }
+      if (l2 === true || r2 === true) return { kind: "unknown", truthy: true };
+      if (l2 === false) return r2 === null ? null : { kind: "unknown", truthy: r2 };
+      if (r2 === false) return l2 === null ? null : { kind: "unknown", truthy: l2 };
+      return null;
+    }
+    const l = constValue(expr.left);
+    const r = constValue(expr.right);
+    if (l === null || r === null || l.kind !== "value" || r.kind !== "value") return null;
+    const a = l.value;
+    const b = r.value;
+    switch (op) {
+      case ts.SyntaxKind.EqualsEqualsEqualsToken:
+        return { kind: "value", value: a === b };
+      case ts.SyntaxKind.ExclamationEqualsEqualsToken:
+        return { kind: "value", value: a !== b };
+      case ts.SyntaxKind.EqualsEqualsToken:
+        return { kind: "value", value: a == b };
+      case ts.SyntaxKind.ExclamationEqualsToken:
+        return { kind: "value", value: a != b };
+      default:
+        break;
+    }
+    if (typeof a === "number" && typeof b === "number") {
+      switch (op) {
+        case ts.SyntaxKind.LessThanToken:
+          return { kind: "value", value: a < b };
+        case ts.SyntaxKind.LessThanEqualsToken:
+          return { kind: "value", value: a <= b };
+        case ts.SyntaxKind.GreaterThanToken:
+          return { kind: "value", value: a > b };
+        case ts.SyntaxKind.GreaterThanEqualsToken:
+          return { kind: "value", value: a >= b };
+        default:
+          break;
+      }
+    }
+    return null;
+  }
+  return null;
+}
+function isTerminal(stmt) {
+  return ts.isReturnStatement(stmt) || ts.isThrowStatement(stmt) || ts.isBreakStatement(stmt) || ts.isContinueStatement(stmt);
+}
+function namedFunctionBody(node) {
+  if (ts.isFunctionDeclaration(node) && node.name && node.body) return { name: node.name.text, body: node.body, owner: node };
+  if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+    let init = node.initializer;
+    while (ts.isParenthesizedExpression(init) || ts.isAsExpression(init) || ts.isSatisfiesExpression(init)) init = init.expression;
+    if (ts.isFunctionExpression(init) || ts.isArrowFunction(init)) return { name: node.name.text, body: init.body, owner: node };
+  }
+  return null;
+}
+function isExportedDeclaration(node) {
+  const stmt = ts.isVariableDeclaration(node) ? node.parent.parent : node;
+  if (ts.isExportAssignment(stmt)) return true;
+  return ts.canHaveModifiers(stmt) && (ts.getModifiers(stmt) ?? []).some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+}
+function unreachableNodes(sf) {
+  const dead = /* @__PURE__ */ new Set();
+  const markBranches = (node) => {
+    if (ts.isIfStatement(node)) {
+      const t = constTruth(node.expression);
+      if (t === false) dead.add(node.thenStatement);
+      else if (t === true && node.elseStatement) dead.add(node.elseStatement);
+    } else if (ts.isWhileStatement(node) || ts.isForStatement(node)) {
+      const cond = ts.isWhileStatement(node) ? node.expression : node.condition;
+      if (cond && constTruth(cond) === false) dead.add(node.statement);
+    } else if (ts.isConditionalExpression(node)) {
+      const t = constTruth(node.condition);
+      if (t === false) dead.add(node.whenTrue);
+      else if (t === true) dead.add(node.whenFalse);
+    } else if (ts.isBinaryExpression(node)) {
+      const op = node.operatorToken.kind;
+      const l = constTruth(node.left);
+      if (op === ts.SyntaxKind.AmpersandAmpersandToken && l === false || op === ts.SyntaxKind.BarBarToken && l === true) {
+        dead.add(node.right);
+      }
+    }
+    if (ts.isSourceFile(node) || ts.isBlock(node) || ts.isModuleBlock(node) || ts.isCaseClause(node) || ts.isDefaultClause(node)) {
+      let ended = false;
+      for (const stmt of node.statements) {
+        if (ended && !ts.isFunctionDeclaration(stmt)) dead.add(stmt);
+        if (isTerminal(stmt)) ended = true;
+      }
+    }
+    ts.forEachChild(node, markBranches);
+  };
+  markBranches(sf);
+  const candidates = [];
+  const collect2 = (node) => {
+    const fn = namedFunctionBody(node);
+    if (fn && !isExportedDeclaration(fn.owner)) candidates.push(fn);
+    ts.forEachChild(node, collect2);
+  };
+  collect2(sf);
+  if (candidates.length === 0) return dead;
+  const inDead = (node) => {
+    for (let n = node; n; n = n.parent) if (dead.has(n)) return true;
+    return false;
+  };
+  const within2 = (node, owner) => node.pos >= owner.pos && node.end <= owner.end;
+  for (let round = 0; round < MAX_ROUNDS; round++) {
+    const live = /* @__PURE__ */ new Map();
+    const gather = (node) => {
+      if (dead.has(node)) return;
+      if (ts.isIdentifier(node)) {
+        const list3 = live.get(node.text);
+        if (list3) list3.push(node);
+        else live.set(node.text, [node]);
+      }
+      ts.forEachChild(node, gather);
+    };
+    gather(sf);
+    let changed = false;
+    for (const fn of candidates) {
+      if (dead.has(fn.body) || inDead(fn.owner)) continue;
+      const refs = (live.get(fn.name) ?? []).filter((id) => !within2(id, fn.owner));
+      if (refs.length === 0) {
+        dead.add(fn.body);
+        changed = true;
+      }
+    }
+    if (!changed) break;
+  }
+  return dead;
+}
+function literalInteriors(sf) {
+  const out3 = [];
+  const visit = (node) => {
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+      out3.push([node.getStart(sf) + 1, Math.max(node.getStart(sf) + 1, node.getEnd() - 1)]);
+    } else if (ts.isTemplateHead(node) || ts.isTemplateMiddle(node)) {
+      out3.push([node.getStart(sf) + 1, Math.max(node.getStart(sf) + 1, node.getEnd() - 2)]);
+    } else if (ts.isTemplateTail(node)) {
+      out3.push([node.getStart(sf) + 1, Math.max(node.getStart(sf) + 1, node.getEnd() - 1)]);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return out3;
+}
+function partitionJs(src) {
+  const sf = parseSource("spec.ts", src);
+  if (!sf) return null;
+  const dead = unreachableNodes(sf);
+  const deadRanges = [];
+  for (const n of dead) deadRanges.push([n.getStart(sf), n.getEnd()]);
+  const literals3 = literalInteriors(sf);
+  const mask = new Uint8Array(src.length);
+  for (const [s, e] of deadRanges) for (let i = s; i < e; i++) mask[i] = 1;
+  for (const [s, e] of literals3) for (let i = s; i < e; i++) if (mask[i] === 0) mask[i] = 2;
+  const live = src.split("");
+  const hidden = src.split("");
+  const inLiteral = new Uint8Array(src.length);
+  for (let i = 0; i < src.length; i++) {
+    if (mask[i] === 1) {
+      if (live[i] !== "\n") live[i] = " ";
+    } else if (mask[i] === 2) {
+      inLiteral[i] = 1;
+    } else if (hidden[i] !== "\n") hidden[i] = " ";
+  }
+  let lineStart = 0;
+  for (let i = 0; i <= src.length; i++) {
+    if (i === src.length || src[i] === "\n") {
+      let all = i > lineStart;
+      for (let j = lineStart; j < i && all; j++) if (mask[j] !== 2 && /\S/.test(src[j])) all = false;
+      if (all) blankRange(live, lineStart, i);
+      lineStart = i + 1;
+    }
+  }
+  return { live: live.join(""), hidden: hidden.join(""), inLiteral };
+}
+function partitionPy(src) {
+  const lines = src.split("\n");
+  const dead = new Array(lines.length).fill(false);
+  let killIndent = null;
+  let suiteIndent = null;
+  for (let i = 0; i < lines.length; i++) {
+    const l = lines[i];
+    if (!/\S/.test(l) || /^\s*#/.test(l)) continue;
+    const indent = PY_INDENT(l);
+    if (killIndent !== null && indent < killIndent) killIndent = null;
+    if (suiteIndent !== null && indent <= suiteIndent) suiteIndent = null;
+    if (killIndent !== null && indent >= killIndent || suiteIndent !== null && indent > suiteIndent) {
+      dead[i] = true;
+      continue;
+    }
+    if (PY_TERMINAL.test(l)) killIndent = indent;
+    else if (PY_CONST_FALSE.test(l)) suiteIndent = indent;
+  }
+  const live = lines.map((l, i) => dead[i] ? "" : l).join("\n");
+  const hidden = lines.map((l, i) => dead[i] ? l : "").join("\n");
+  return { live, hidden, inLiteral: new Uint8Array(live.length) };
+}
+function partition(src, path) {
+  const lang = langOf(path);
+  if (lang === "js" || lang === null) {
+    const p = partitionJs(src);
+    if (p) return p;
+  } else if (lang === "py") {
+    return partitionPy(src);
+  }
+  return { live: src, hidden: "", inLiteral: new Uint8Array(src.length) };
+}
+function pytestCollectedDefs(src) {
+  let n = 0;
+  const stack = [];
+  for (const line of src.split("\n")) {
+    if (!/\S/.test(line) || /^\s*#/.test(line)) continue;
+    const indent = PY_INDENT(line);
+    while (stack.length && indent <= stack[stack.length - 1].indent) stack.pop();
+    const cls = PY_CLASS.exec(line);
+    if (cls) {
+      stack.push({ indent, collected: PY_COLLECTED_CLASS(cls[1], cls[2] ?? "") });
+      continue;
+    }
+    if (PY_TEST_DEF.test(line) && stack.every((c) => c.collected)) n++;
+  }
+  return n;
+}
+var MAX_ROUNDS, blankRange, PY_INDENT, PY_TERMINAL, PY_CONST_FALSE, PY_CLASS, PY_TEST_DEF, PY_COLLECTED_CLASS;
+var init_reachability = __esm({
+  "src/detectors/reachability.ts"() {
+    "use strict";
+    init_ts_lazy();
+    init_files();
+    MAX_ROUNDS = 8;
+    blankRange = (chars, start, end) => {
+      for (let i = start; i < end && i < chars.length; i++) if (chars[i] !== "\n") chars[i] = " ";
+    };
+    PY_INDENT = (line) => line.length - line.trimStart().length;
+    PY_TERMINAL = /^\s*(?:return\b|raise\b)/;
+    PY_CONST_FALSE = /^\s*(?:if|while)\s+(?:False|0|None|not\s+True)\s*:/;
+    PY_CLASS = /^\s*class\s+(\w+)\s*(?:\(([^)]*)\))?\s*:/;
+    PY_TEST_DEF = /^\s*(?:async\s+)?def\s+test\w*\s*\(/;
+    PY_COLLECTED_CLASS = (name, bases) => /^Test/.test(name) || /Test/.test(bases);
+  }
+});
+
 // src/detectors/test-deletion.ts
 function calleeName(expr) {
   if (ts.isIdentifier(expr)) return expr.text;
@@ -8006,6 +8436,7 @@ function eachRows(call) {
 }
 function countTests(src, path = "spec.ts", substantiveOnly = false) {
   const lang = langOf(path);
+  if (lang === "py") return { min: pytestCollectedDefs(src), open: false };
   if (lang && lang !== "js") {
     const re = TEST_DEFS[lang];
     let n2 = 0;
@@ -8016,7 +8447,9 @@ function countTests(src, path = "spec.ts", substantiveOnly = false) {
   if (!sf) return { min: 0, open: true };
   let n = 0;
   let open = false;
+  const dead = unreachableNodes(sf);
   const visit = (node, mult) => {
+    if (dead.has(node)) return;
     if (ts.isForOfStatement(node)) {
       const r = loopRows(node.expression);
       if (r.open) open = true;
@@ -8193,11 +8626,13 @@ var init_test_deletion = __esm({
     init_policy();
     init_finding();
     init_command();
+    init_hook_wiring();
     init_files();
     init_repo();
     init_suite_config();
     init_invocation();
     init_narrow();
+    init_reachability();
     init_runner_chain();
     RULE9 = "test-deletion";
     JVM_TEST = /^\s*(?:@\w+(?:\([^)]*\))?\s+)*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/;
@@ -8328,16 +8763,31 @@ var init_test_deletion = __esm({
             }
           } else {
             let root = "";
+            const fed = [];
             for (const seg of segments(c.raw)) {
-              const toks = tokens(seg).map(unquote);
+              const toks = tokens(seg).map(shellWord);
               const cdTo = toks[0] === "cd" ? toks[1] : null;
               if (cdTo !== null) {
                 root = cdTo === void 0 || /^[/~$]/.test(cdTo) || root === null ? null : joinRoot(root, cdTo);
+                fed.push(...toks);
                 continue;
               }
               const inRepo = (t) => root ? `${root}/${t}` : t;
               const listing = trackedFiles(ctx);
-              const testToks = toks.filter((t) => {
+              const whole = (t) => /^(?:\.|\.\/|\*|\.\/\*)$/.test(t);
+              const expand = (raw) => {
+                const t = raw.replace(/^(?:of|if)=/, "");
+                if (!isGlob(t) || whole(t)) return [t];
+                if (listing && root !== null) return expandGlob(inRepo(t), listing).map((p) => root ? p.slice(root.length + 1) : p);
+                return expandBraces(t).flatMap((alt) => {
+                  if (!isGlob(alt)) return [alt];
+                  const base = alt.split("/").pop() ?? "";
+                  if (/test|spec/i.test(base.replace(/[*?]|\[[^\]]*\]/g, ""))) return [alt.replace(/\*\*\//g, "").replace(/\*/g, "a").replace(/\?/g, "t")];
+                  const dir = alt.includes("/") ? alt.replace(/\/[^/]*$/, "") : "";
+                  return dir && !isGlob(dir) && containsProtected(dir, policy, "tests", ctx, "snapshots") ? [dir] : [];
+                });
+              };
+              const specPath = (t) => {
                 const resolved = root !== null && /(?:^|\/)\.{1,2}(?:\/|$)/.test(t) ? joinRoot(root, t) : null;
                 const probe = resolved ?? t;
                 if (!isSpec(probe)) return false;
@@ -8345,56 +8795,82 @@ var init_test_deletion = __esm({
                 const looksLikeFile = /\.[A-Za-z0-9]+$/.test(probe.split("/").pop() ?? "");
                 if (looksLikeFile || listing.includes(resolved ?? inRepo(t))) return true;
                 return containsProtected(resolved ?? inRepo(t), policy, "tests", ctx, "snapshots");
-              });
+              };
               const rootHasProtected = () => listing ? listing.some(isSpec) : true;
-              const dirToks = toks.filter((t) => {
-                if (t.startsWith("-") || testToks.includes(t)) return false;
-                const whole = /^(?:\.|\.\/|\*|\.\/\*)$/.test(t);
-                if (!whole && /[*?{}[\]]/.test(t)) return false;
-                if (root === null) return whole ? false : containsProtected(t, policy, "tests", ctx, "snapshots");
-                const dir = whole ? root : joinRoot(root, t);
+              const dirPath = (t) => {
+                if (t.startsWith("-")) return false;
+                const isWhole = whole(t);
+                if (!isWhole && isGlob(t)) return false;
+                if (root === null) return isWhole ? false : containsProtected(t, policy, "tests", ctx, "snapshots");
+                const dir = isWhole ? root : joinRoot(root, t);
                 if (dir === null) return false;
                 if (dir === "") return rootHasProtected();
                 return containsProtected(dir, policy, "tests", ctx, "snapshots");
-              });
+              };
+              const xargs = xargsCommand(toks);
+              const source = xargs ? [...fed, ...toks] : toks;
+              fed.push(...toks);
+              const testToks = source.filter((t) => expand(t).some(specPath));
+              const dirToks = source.filter((t) => !t.startsWith("-") && !testToks.includes(t) && expand(t).some(dirPath));
               if (testToks.length === 0 && dirToks.length === 0) continue;
               const named = [...testToks, ...dirToks];
-              const cmd = toks[0] ?? "";
+              let at = 0;
+              while (at < toks.length && WRAPPERS.test(toks[at])) at++;
+              const cmdToks = toks.slice(at);
+              const cmd = xargs ? xargs.cmd : (cmdToks[0] ?? "").replace(/^.*\//, "");
+              const args = xargs ? xargs.args : cmdToks.slice(1);
+              const inPlace = (a) => /^-[A-Za-z]*i|^--in-place/.test(a);
+              const isDir = (p) => listing ? listing.some((f) => f.startsWith(inRepo(p).replace(/\/+$/, "") + "/")) : /\/$/.test(p);
+              const exists = (p) => !listing || root === null || listing.includes(inRepo(p.replace(/^\.\//, "")));
+              const ARG_TAKING = /^-(?:t|m|o|g|S|e)$|^--(?:target-directory|mode|owner|group|suffix|rsh|exclude|include|files-from)$/;
+              const positional = args.filter((a, i) => a !== "--" && !a.startsWith("-") && !ARG_TAKING.test(args[i - 1] ?? ""));
               let why = null;
               let evidence = seg;
-              const redirectTarget = seg.match(/>\s*(\S+)/)?.[1];
-              const redirectsOntoTest = redirectTarget ? isSpec(unquote(redirectTarget)) : false;
+              const redirectsOntoTest = [...seg.matchAll(REDIRECT_TARGET)].some((m) => isSpec(shellWord(m[1])));
               const findDeletes = cmd === "find" && /\s(?:-delete\b|-exec\s+(?:rm|unlink)\b|-execdir\s+(?:rm|unlink)\b)/.test(seg);
-              const gitRestoresOld = cmd === "git" && /^git\s+(?:checkout|restore)\b/.test(seg) && (() => {
+              const gitSub = cmd === "git" ? gitSubcommand(cmdToks) : null;
+              const gitRestoresOld = (gitSub === "checkout" || gitSub === "restore") && (() => {
                 const src = seg.match(/--source[= ]\s*(\S+)/)?.[1];
-                const revIdx = toks.findIndex((t, i) => i >= 2 && !t.startsWith("-") && !named.includes(t) && t !== "--");
-                const rev2 = src ?? (revIdx >= 0 ? toks[revIdx] : void 0);
+                const revIdx = cmdToks.findIndex((t, i) => i >= 2 && !t.startsWith("-") && !named.includes(t) && t !== "--");
+                const rev2 = src ?? (revIdx >= 0 ? cmdToks[revIdx] : void 0);
                 if (!rev2 || rev2 === "HEAD" || rev2 === "@" || revIsHead(rev2, ctx) === true) return false;
                 if (src || seg.includes(" -- ")) return true;
-                return revIdx >= 0 && toks.some((t, i) => i > revIdx && named.includes(t));
+                return revIdx >= 0 && cmdToks.some((t, i) => i > revIdx && named.includes(t));
               })();
-              if (/\brm\b/.test(seg) && !/^(?:git|npm|yarn|pnpm|bun)\b/.test(seg)) {
-                why = "rm deletes a test file";
-              } else if (cmd === "git" && /^git\s+rm\b/.test(seg)) {
+              const dests = cmd === "cp" || cmd === "install" || cmd === "rsync" || cmd === "ln" || cmd === "mv" ? destinations(cmd, args, isDir) : [];
+              const overwrites = dests.some((d) => isSpec(d) && exists(d)) && positional.some((p) => !dests.includes(p) && !isSpec(p));
+              if (xargs) {
+                if (cmd === "rm" || cmd === "unlink" || cmd === "shred") why = `xargs ${cmd} deletes a test file named earlier in the line`;
+                else if (cmd === "truncate") why = "xargs truncate empties a test file named earlier in the line";
+                else if (cmd === "mv") why = "xargs mv moves a test file named earlier in the line";
+                else if (cmd === "tee" || cmd === "sponge") why = `xargs ${cmd} rewrites a test file named earlier in the line`;
+                else if ((cmd === "sed" || cmd === "perl") && args.some(inPlace)) why = `xargs ${cmd} -i rewrites a test file named earlier in the line`;
+              } else if (cmd === "rm" || cmd === "unlink" || cmd === "shred") {
+                why = `${cmd} deletes a test file`;
+              } else if (gitSub === "rm") {
                 why = "git rm deletes a test file";
               } else if (cmd === "sed" && SED_INPLACE.test(seg)) {
                 why = "sed -i rewrites a test file in place";
               } else if (cmd === "perl" && /(?:^|\s)-[a-zA-Z]*i\b|\s-i\S*/.test(seg)) {
                 why = "perl -i rewrites a test file in place";
-              } else if (/\btruncate\b/.test(seg)) {
+              } else if (cmd === "truncate") {
                 why = "truncate empties a test file";
               } else if (redirectsOntoTest) {
                 why = "a redirect overwrites/empties a test file";
-              } else if (cmd === "cp" && testToks.length > 0 && isSpec(toks[toks.length - 1] ?? "") && !isSpec(toks[toks.length - 2] ?? "")) {
-                why = "cp overwrites a test file with something else";
-              } else if (cmd === "tee" && !toks.includes("-a") && !toks.includes("--append")) {
+              } else if (cmd !== "mv" && overwrites) {
+                why = `${cmd} overwrites a test file with something else`;
+              } else if (cmd === "tee" && !args.includes("-a") && !args.includes("--append")) {
                 why = "tee overwrites a test file";
+              } else if (cmd === "sponge" && !args.includes("-a")) {
+                why = "sponge rewrites a test file in place";
+              } else if (cmd === "dd" && args.some((a) => a.startsWith("of=") && isSpec(a.slice(3)))) {
+                why = "dd rewrites a test file";
               } else if (findDeletes) {
                 why = "find -delete removes test files";
               } else if (gitRestoresOld) {
                 why = "git checkout <rev> replaces a test file with an older version";
-              } else if (/\bmv\b/.test(seg)) {
-                const dest = toks[toks.length - 1];
+              } else if (cmd === "mv") {
+                const dest = positional[positional.length - 1];
                 if (dest && testToks.length > 0 && !isSpec(dest)) {
                   why = "mv renames a test file out of the test glob";
                   evidence = `${testToks[0]} \u2192 ${dest}`;
@@ -8404,6 +8880,8 @@ var init_test_deletion = __esm({
                 } else if (dest && testToks.length === 0 && dirToks[0] !== dest && leavesGlob(dirToks[0] ?? "", dest, policy, ctx)) {
                   why = "mv renames a test directory so its specs leave the test glob";
                   evidence = `${dirToks[0]} \u2192 ${dest}`;
+                } else if (overwrites) {
+                  why = "mv overwrites a test file with something else";
                 }
               }
               if (why) {
@@ -8464,7 +8942,10 @@ function significantLinesOrdered(src, path) {
   }
   return out3;
 }
-var RULE10, MIN_REMOVED_LINES, MIN_REMOVED_ROWS, ws, TEST_DIR_FILE, testContentRemoval;
+function liveSignificantLines(src, path) {
+  return significantLinesOrdered(partition(src, path).live, path);
+}
+var RULE10, MIN_REMOVED_LINES, MIN_REMOVED_ROWS, ws, TEST_DIR_FILE, KeptPool, testContentRemoval;
 var init_test_content_removal = __esm({
   "src/detectors/test-content-removal.ts"() {
     "use strict";
@@ -8473,22 +8954,58 @@ var init_test_content_removal = __esm({
     init_finding();
     init_test_deletion();
     init_files();
+    init_reachability();
     RULE10 = "test-content-removal";
     MIN_REMOVED_LINES = 3;
     MIN_REMOVED_ROWS = 2;
     ws = (s) => s.replace(/\s+/g, "");
     TEST_DIR_FILE = /(?:^|\/)(?:test|tests|__tests__|spec|specs)\//;
+    KeptPool = class {
+      text = "";
+      inLiteral = [];
+      addLive(src, path) {
+        const p = partition(src, path);
+        const lang = langOf(path);
+        let lineStart = 0;
+        for (let i = 0; i <= p.live.length; i++) {
+          if (i < p.live.length && p.live[i] !== "\n") continue;
+          const line = p.live.slice(lineStart, i);
+          if (isSignificantLine(line.trim(), lang)) {
+            for (let j = lineStart; j < i; j++) {
+              if (/\s/.test(p.live[j])) continue;
+              this.text += p.live[j];
+              this.inLiteral.push(p.inLiteral[j]);
+            }
+          }
+          lineStart = i + 1;
+        }
+      }
+      /** Text added outside any spec (a case table moved to `test/fixtures/`): code. */
+      addCode(ws2) {
+        this.text += ws2;
+        for (let i = 0; i < ws2.length; i++) this.inLiteral.push(0);
+      }
+      keeps(wsLine) {
+        if (wsLine.length === 0) return true;
+        let at = this.text.indexOf(wsLine);
+        while (at !== -1) {
+          if (this.inLiteral[at] === 0) return true;
+          at = this.text.indexOf(wsLine, at + 1);
+        }
+        return false;
+      }
+    };
     testContentRemoval = {
       id: RULE10,
       surface: ["file"],
       certainty: "mechanical",
       run(changes, policy) {
         const out3 = [];
-        let keptPool = "";
+        const keptPool = new KeptPool();
         let addedPool = "";
         for (const c of changes) {
           if (c.kind !== "file" || c.after == null) continue;
-          if (isProtected(c.path, policy, "tests")) keptPool += ws(significantLinesOrdered(c.after, c.path).join("\n"));
+          if (isProtected(c.path, policy, "tests")) keptPool.addLive(c.after, c.path);
           let addedHere = "";
           if (c.op === "add") addedHere = ws(c.after);
           else if (c.before != null) {
@@ -8496,7 +9013,7 @@ var init_test_content_removal = __esm({
             addedHere = ws(c.after.split("\n").filter((l) => !had.has(l.trim())).join("\n"));
           }
           addedPool += addedHere;
-          if (!isProtected(c.path, policy, "tests") && TEST_DIR_FILE.test(c.path) && langOf(c.path) === "js") keptPool += addedHere;
+          if (!isProtected(c.path, policy, "tests") && TEST_DIR_FILE.test(c.path) && langOf(c.path) === "js") keptPool.addCode(addedHere);
         }
         for (const c of changes) {
           if (c.kind !== "file" || c.op !== "modify" && c.op !== "rename" || c.before == null || c.after == null) continue;
@@ -8505,16 +9022,18 @@ var init_test_content_removal = __esm({
           const blocksBefore = countTests(c.before, c.path);
           const blocksAfter = countTests(c.after, c.path);
           if (blocksAfter.min < blocksBefore.min && !blocksAfter.open) continue;
-          const beforeSig = significantLinesOrdered(c.before, c.path);
-          const afterSig = significantLinesOrdered(c.after, c.path);
+          const beforeSig = liveSignificantLines(c.before, c.path);
+          const afterSig = liveSignificantLines(c.after, c.path);
           const netDrop = beforeSig.length - afterSig.length;
           const afterSet = new Set(afterSig);
           const gone = [];
           for (const line of new Set(beforeSig)) {
             if (afterSet.has(line)) continue;
-            if (keptPool.includes(ws(line))) continue;
+            if (keptPool.keeps(ws(line))) continue;
             gone.push(line);
           }
+          const hiddenPool = ws(partition(c.after, c.path).hidden);
+          const hidden = gone.filter((line) => hiddenPool.includes(ws(line)));
           const table = eachTables(c.before, c.path);
           const tableAfter = eachTables(c.after, c.path);
           const goneRows = table.rows.size && tableAfter.open ? [...table.rows].filter(([k]) => !tableAfter.rows.has(k) && !addedPool.includes(k)).map(([, text]) => text) : [];
@@ -8529,6 +9048,17 @@ var init_test_content_removal = __esm({
             );
             continue;
           }
+          if (hidden.length >= MIN_REMOVED_LINES) {
+            out3.push(
+              makeFinding(RULE10, policy, {
+                file: c.path,
+                message: `Test content made unreachable in a surviving spec: ${hidden.length} significant line(s) kept only where they cannot run (a string, a template literal, a dead branch, after a return).`,
+                evidence: hidden.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
+                remediation: "Fix the code under test. Assertions parked in a string or behind a constant-false branch or an early return no longer execute; the spec is weakened exactly as if they were deleted."
+              })
+            );
+            continue;
+          }
           if (gone.length >= MIN_REMOVED_LINES && netDrop >= MIN_REMOVED_LINES) {
             out3.push(
               makeFinding(RULE10, policy, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.24.3",
+  "version": "2.24.5",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",