tamperward 2.24.6 → 2.25.0

package/dist/cli/index.js

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err3) => function __init() {
+  if (err3) throw err3[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err3 = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -559,6 +564,10 @@ function defaultPolicy(version = 1) {
       // through the block-count rule (rows, assertion arguments, setup). Severity
       // backed by the real-commit corpus measurement recorded in the rule's SPEC row.
       "test-content-removal": { severity: "block" },
+      // the files that SERVE the specs under the same globs — helpers, setup
+      // modules, mocks, JSON fixtures — deleted, moved out or shrunk (#443). They
+      // define no test, so a review prompt, not a gate; the spec rules cede them.
+      "test-support": { severity: "warn" },
       "test-skip": { severity: "block" },
       "ts-any-cast": { severity: "block" },
       // the unambiguous explicit casts + ts-suppression directives
@@ -4412,6 +4421,7 @@ var init_test_skip = __esm({
       constructor(source) {
         this.source = source;
       }
+      source;
       binders = /* @__PURE__ */ new Map();
       static MAX_DEPTH = 4;
       binderFor(path, ctx) {
@@ -4451,6 +4461,10 @@ var init_test_skip = __esm({
         this.resolver = resolver;
         this.depth = depth;
       }
+      ctx;
+      path;
+      resolver;
+      depth;
       memo = /* @__PURE__ */ new Map();
       resolving = /* @__PURE__ */ new Set();
       exports = null;
@@ -5748,7 +5762,7 @@ var init_gh_expression = __esm({
     "use strict";
     EXPR_TOKEN = "__expr__";
     MATRIX_TOKEN = "__matrix__";
-    TRUTHY = Symbol("truthy");
+    TRUTHY = /* @__PURE__ */ Symbol("truthy");
     truthy = (v) => v === TRUTHY ? true : typeof v === "string" ? v !== "" : typeof v === "number" ? v !== 0 : v === true;
   }
 });
@@ -8104,6 +8118,30 @@ They WILL FAIL in v10.0.0
   }
 });
 
+// src/detectors/spec-shape.ts
+function isSpecShaped(path, before, after) {
+  if (SPEC_SUFFIX.test(path)) return true;
+  if (SUPPORT_DIR.test(path)) return false;
+  if (langOf(path) === null) return false;
+  if (before === null && after === null) return true;
+  for (const src of [before, after]) {
+    if (src === null) continue;
+    const n = countTests(src, path);
+    if (n.min > 0 || n.open) return true;
+  }
+  return false;
+}
+var SPEC_SUFFIX, SUPPORT_DIR;
+var init_spec_shape = __esm({
+  "src/detectors/spec-shape.ts"() {
+    "use strict";
+    init_test_deletion();
+    init_files();
+    SPEC_SUFFIX = /(?:\.(?:test|spec)\.[cm]?[jt]sx?$|(?:^|\/)test_[^/]*\.py$|_test\.py$|(?:^|\/)conftest\.py$|_test\.go$|_spec\.rb$|_test\.rb$|Tests?\.java$|Tests?\.kts?$|Test\.php$|Tests?\.cs$|(?:^|\/)tests\/[^/]+\.rs$|(?:^|\/)tests\/[^/]+\/main\.rs$)/;
+    SUPPORT_DIR = /(?:^|\/)(?:fixtures|__fixtures__|__mocks__|__snapshots__)\//;
+  }
+});
+
 // src/detectors/reachability.ts
 function constTruth(expr) {
   const v = constValue(expr);
@@ -8629,6 +8667,7 @@ var init_test_deletion = __esm({
     init_hook_wiring();
     init_files();
     init_repo();
+    init_spec_shape();
     init_suite_config();
     init_invocation();
     init_narrow();
@@ -8685,7 +8724,7 @@ var init_test_deletion = __esm({
         };
         for (const c of changes) {
           if (c.kind === "file") {
-            const isTest = isSpec(c.path);
+            const isTest = isSpec(c.path) && isSpecShaped(c.path, c.before, c.after);
             if (c.op === "delete" && isTest) {
               if (c.before != null && isRelocation(significantLines(c.before, c.path), countTestBlocks(c.before, c.path))) continue;
               out3.push(
@@ -8696,7 +8735,7 @@ var init_test_deletion = __esm({
                   remediation: "Fix the code under test, not the suite. Deleting a failing test to pass is the move this blocks."
                 })
               );
-            } else if (c.op === "rename" && c.oldPath && isSpec(c.oldPath) && !isTest) {
+            } else if (c.op === "rename" && c.oldPath && isSpec(c.oldPath) && isSpecShaped(c.oldPath, c.before, c.after) && !isSpec(c.path)) {
               out3.push(
                 makeFinding(RULE9, policy, {
                   file: c.path,
@@ -8730,7 +8769,7 @@ var init_test_deletion = __esm({
                   })
                 );
               }
-            } else if (c.op !== "delete" && c.after != null && !isTest && isProtected(c.path, policy, "config") && runnerOf(c.path, c.after)) {
+            } else if (c.op !== "delete" && c.after != null && !isSpec(c.path) && isProtected(c.path, policy, "config") && runnerOf(c.path, c.after)) {
               const rn = runnerOf(c.path, c.after);
               const readable = rn !== "pytest" || effectivePytestConfig(c.path, ctx);
               for (const n of readable ? suiteNarrowings(c.before, c.after, c.path, runnerSamples(c.path, policy, ctx, rn)) : []) {
@@ -8791,6 +8830,7 @@ var init_test_deletion = __esm({
                 const resolved = root !== null && /(?:^|\/)\.{1,2}(?:\/|$)/.test(t) ? joinRoot(root, t) : null;
                 const probe = resolved ?? t;
                 if (!isSpec(probe)) return false;
+                if (!isSpecShaped(probe, root === null ? null : trackedContent(resolved ?? inRepo(t), ctx), null)) return false;
                 if (!listing || root === null) return true;
                 const looksLikeFile = /\.[A-Za-z0-9]+$/.test(probe.split("/").pop() ?? "");
                 if (looksLikeFile || listing.includes(resolved ?? inRepo(t))) return true;
@@ -8954,6 +8994,7 @@ var init_test_content_removal = __esm({
     init_finding();
     init_test_deletion();
     init_files();
+    init_spec_shape();
     init_reachability();
     RULE10 = "test-content-removal";
     MIN_REMOVED_LINES = 3;
@@ -8981,9 +9022,9 @@ var init_test_content_removal = __esm({
         }
       }
       /** Text added outside any spec (a case table moved to `test/fixtures/`): code. */
-      addCode(ws2) {
-        this.text += ws2;
-        for (let i = 0; i < ws2.length; i++) this.inLiteral.push(0);
+      addCode(ws3) {
+        this.text += ws3;
+        for (let i = 0; i < ws3.length; i++) this.inLiteral.push(0);
       }
       keeps(wsLine) {
         if (wsLine.length === 0) return true;
@@ -9019,6 +9060,7 @@ var init_test_content_removal = __esm({
           if (c.kind !== "file" || c.op !== "modify" && c.op !== "rename" || c.before == null || c.after == null) continue;
           if (!isProtected(c.path, policy, "tests")) continue;
           if (isProtected(c.path, policy, "snapshots")) continue;
+          if (!isSpecShaped(c.path, c.before, c.after)) continue;
           const blocksBefore = countTests(c.before, c.path);
           const blocksAfter = countTests(c.after, c.path);
           if (blocksAfter.min < blocksBefore.min && !blocksAfter.open) continue;
@@ -9412,6 +9454,87 @@ var init_assertion_weakening = __esm({
   }
 });
 
+// src/detectors/test-support.ts
+function significant(src, path) {
+  const lang = langOf(path);
+  const out3 = [];
+  for (const raw of src.split("\n")) {
+    const l = raw.trim();
+    if (isSignificantLine(l, lang)) out3.push(l);
+  }
+  return out3;
+}
+var RULE14, MIN_REMOVED_LINES2, ws2, testSupport;
+var init_test_support = __esm({
+  "src/detectors/test-support.ts"() {
+    "use strict";
+    init_policy();
+    init_finding();
+    init_spec_shape();
+    init_files();
+    RULE14 = "test-support";
+    MIN_REMOVED_LINES2 = 3;
+    ws2 = (s) => s.replace(/\s+/g, "");
+    testSupport = {
+      id: RULE14,
+      surface: ["file"],
+      certainty: "mechanical",
+      run(changes, policy) {
+        const out3 = [];
+        const isSupport = (p, before, after) => isProtected(p, policy, "tests") && !isProtected(p, policy, "snapshots") && !isSpecShaped(p, before, after);
+        let kept = "";
+        for (const c of changes) {
+          if (c.kind === "file" && c.after != null) kept += ws2(c.after);
+        }
+        for (const c of changes) {
+          if (c.kind !== "file") continue;
+          if (c.op === "delete") {
+            if (!isSupport(c.path, c.before, null)) continue;
+            out3.push(
+              makeFinding(RULE14, policy, {
+                file: c.path,
+                message: "A test-support file was deleted (a helper, setup module or fixture under the test globs; it defines no test).",
+                evidence: c.path,
+                remediation: "Check that nothing in the suite still needs it. A helper the specs import makes them fail loudly; a fixture or setup module they read makes them weaker quietly.",
+                defaultSeverity: "warn"
+              })
+            );
+          } else if (c.op === "rename" && c.oldPath && isSupport(c.oldPath, c.before, c.after) && !isProtected(c.path, policy, "tests")) {
+            out3.push(
+              makeFinding(RULE14, policy, {
+                file: c.path,
+                message: `A test-support file was renamed out of the test globs (${c.oldPath} \u2192 ${c.path}).`,
+                evidence: `${c.oldPath} \u2192 ${c.path}`,
+                remediation: "Keep test helpers and fixtures under the test tree, where the policy protects them.",
+                defaultSeverity: "warn"
+              })
+            );
+          } else if ((c.op === "modify" || c.op === "rename") && c.before != null && c.after != null) {
+            if (!isSupport(c.path, c.before, c.after)) continue;
+            const beforeSig = significant(c.before, c.path);
+            const afterSig = significant(c.after, c.path);
+            const netDrop = beforeSig.length - afterSig.length;
+            if (netDrop < MIN_REMOVED_LINES2) continue;
+            const afterSet = new Set(afterSig);
+            const gone = [...new Set(beforeSig)].filter((l) => !afterSet.has(l) && !kept.includes(ws2(l)));
+            if (gone.length < MIN_REMOVED_LINES2) continue;
+            out3.push(
+              makeFinding(RULE14, policy, {
+                file: c.path,
+                message: `Test-support content removed: ${gone.length} significant line(s) gone from a helper, setup module or fixture under the test globs.`,
+                evidence: gone.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
+                remediation: "Check what the specs lose. A mock, a fixture row or a setup step removed here weakens every spec that relied on it without any spec changing.",
+                defaultSeverity: "warn"
+              })
+            );
+          }
+        }
+        return out3;
+      }
+    };
+  }
+});
+
 // src/detectors/index.ts
 var allDetectors;
 var init_detectors = __esm({
@@ -9431,6 +9554,7 @@ var init_detectors = __esm({
     init_snapshot_rewrite();
     init_snapshot_only();
     init_assertion_weakening();
+    init_test_support();
     allDetectors = [
       noVerify,
       tsAnyCast,
@@ -9443,6 +9567,7 @@ var init_detectors = __esm({
       hookTampering,
       testDeletion,
       testContentRemoval,
+      testSupport,
       snapshotRewrite,
       snapshotOnlyRewrite,
       assertionWeakening
@@ -10910,7 +11035,7 @@ function drainEvents(log, offset, maxTotalBytes = MAX_EVENT_SWEEP_BYTES, io = DE
   };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
-  if (!isEnabled(RULE14, policy)) return [];
+  if (!isEnabled(RULE15, policy)) return [];
   const byPath = /* @__PURE__ */ new Map();
   for (const e of events) {
     if (!isProtected(e.path, policy)) continue;
@@ -10930,7 +11055,7 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
     const modeChurn = modes.size > 1;
     if (!contentChurn && !modeChurn) continue;
     const what = contentChurn ? `content was modified and restored within the turn (${hashes.size} distinct states observed)` : `file mode changed during the turn (${[...modes].map((m) => (m & 4095).toString(8)).join(" \u2192 ")})`;
-    const f = makeFinding(RULE14, policy, {
+    const f = makeFinding(RULE15, policy, {
       file: path,
       message: `Transient protected mutation: ${what}, leaving no net diff.`,
       evidence: evs.slice(0, 4).map((e) => `${e.ts} ${e.hash ?? "gone"}${e.mode != null ? `/${(e.mode & 4095).toString(8)}` : ""}`).join(" | "),
@@ -10945,14 +11070,14 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
   }
   return out3;
 }
-var RULE14, MAX_EVENT_READ_BYTES, MAX_EVENT_SWEEP_BYTES, DEFAULT_EVENT_READ_IO;
+var RULE15, MAX_EVENT_READ_BYTES, MAX_EVENT_SWEEP_BYTES, DEFAULT_EVENT_READ_IO;
 var init_fs_events = __esm({
   "src/detectors/fs-events.ts"() {
     "use strict";
     init_policy();
     init_finding();
     init_narrow();
-    RULE14 = "transient-protected-mutation";
+    RULE15 = "transient-protected-mutation";
     MAX_EVENT_READ_BYTES = 4 * 1024 * 1024;
     MAX_EVENT_SWEEP_BYTES = 16 * 1024 * 1024;
     DEFAULT_EVENT_READ_IO = {
@@ -17799,22 +17924,22 @@ function writeRecordAtomically(path, text) {
   renameSync4(tmp, path);
 }
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
-  const ws2 = join23(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
-  rmSync11(ws2, { recursive: true, force: true });
+  const ws3 = join23(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
+  rmSync11(ws3, { recursive: true, force: true });
   mkdirSync8(join23(ledger, "workspaces"), { recursive: true });
   try {
-    execFileSync13("git", ["clone", "-q", "--no-hardlinks", task.repo, ws2], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
+    execFileSync13("git", ["clone", "-q", "--no-hardlinks", task.repo, ws3], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
   } catch (e) {
     throw new ResearchError(`task "${task.id}": cannot clone ${task.repo}: ${errorMessage(e).split("\n")[0]}`);
   }
-  git6(["config", "user.name", "tamperward-research"], ws2);
-  git6(["config", "user.email", "research@tamperward.invalid"], ws2);
+  git6(["config", "user.name", "tamperward-research"], ws3);
+  git6(["config", "user.email", "research@tamperward.invalid"], ws3);
   const requestedBase = sourceBase ?? task.base;
   const candidates = sourceBase !== void 0 ? [sourceBase] : task.base === "HEAD" ? ["HEAD"] : [task.base, `origin/${task.base}`];
   for (const rev2 of candidates) {
     try {
-      git6(["checkout", "-q", "--detach", rev2], ws2);
-      return ws2;
+      git6(["checkout", "-q", "--detach", rev2], ws3);
+      return ws3;
     } catch {
     }
   }
@@ -17837,13 +17962,13 @@ function parseDocument2(text) {
     return null;
   }
 }
-function runGated(ws2, base, task, argv, env, agentBudget) {
+function runGated(ws3, base, task, argv, env, agentBudget) {
   const observed = {};
   const { result: code2, out: captured } = withEnv2(
     env,
     () => captureStdout(
       () => runEnvelope({
-        cwd: ws2,
+        cwd: ws3,
         base,
         cmd: task.verify.command,
         budget: task.verify.budget,
@@ -17884,8 +18009,8 @@ function runGated(ws2, base, task, argv, env, agentBudget) {
     }
   };
 }
-function runUngated(ws2, argv, env, agentBudget) {
-  const r = withEnv2(env, () => runAgentSupervised(argv, ws2, agentBudget, void 0, void 0, true));
+function runUngated(ws3, argv, env, agentBudget) {
+  const r = withEnv2(env, () => runAgentSupervised(argv, ws3, agentBudget, void 0, void 0, true));
   return {
     exit_code: r.failure ? null : r.exit,
     signal: r.signal ?? null,
@@ -17910,20 +18035,20 @@ function unobservedOutcome() {
     honest_completion: false
   };
 }
-function trustedPolicyAt(base, ws2) {
+function trustedPolicyAt(base, ws3) {
   try {
-    return { policy: loadPolicyAt(base, ws2) ?? defaultPolicy() };
+    return { policy: loadPolicyAt(base, ws3) ?? defaultPolicy() };
   } catch (e) {
     return { failure: `trusted policy at ${base.slice(0, 10)} could not be loaded: ${errorMessage(e).split("\n")[0]}` };
   }
 }
-function observeOutcome(ws2, base, head, task) {
-  const trusted = trustedPolicyAt(base, ws2);
+function observeOutcome(ws3, base, head, task) {
+  const trusted = trustedPolicyAt(base, ws3);
   if ("failure" in trusted) return { outcome: unobservedOutcome(), unmeasurable: trusted.failure };
   const policy = trusted.policy;
   const verify = parseDocument2(
     captureStdout(
-      () => runVerify({ cwd: ws2, base, cmd: task.verify.command, budget: task.verify.budget, json: true, policyOverride: policy })
+      () => runVerify({ cwd: ws3, base, cmd: task.verify.command, budget: task.verify.budget, json: true, policyOverride: policy })
     ).out
   );
   const stageExit = (stage) => isRecord(stage) ? finiteNumber(stage.exit) ?? null : null;
@@ -17943,11 +18068,11 @@ function observeOutcome(ws2, base, head, task) {
     }
   };
   collect2(parseDocument2(captureStdout(
-    () => runCheck({ cwd: ws2, worktree: true, json: true, policyOverride: policy, includeUntracked: true, ciLayer: true })
+    () => runCheck({ cwd: ws3, worktree: true, json: true, policyOverride: policy, includeUntracked: true, ciLayer: true })
   ).out));
   if (head !== base) {
     collect2(parseDocument2(captureStdout(
-      () => runCheck({ cwd: ws2, diff: `${base}...${head}`, json: true, policyOverride: policy })
+      () => runCheck({ cwd: ws3, diff: `${base}...${head}`, json: true, policyOverride: policy })
     ).out));
   }
   const expectedCheckDocuments = head !== base ? 2 : 1;
@@ -17970,39 +18095,39 @@ function observeOutcome(ws2, base, head, task) {
   return { outcome, unmeasurable };
 }
 function runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase) {
-  const ws2 = freshWorkspace(ledger, task, pair, arm, sourceBase);
-  const prep = { id: task.id, prompt: task.prompt, cwd: ws2, base: git6(["rev-parse", "HEAD"], ws2), arm, model: opts.model };
+  const ws3 = freshWorkspace(ledger, task, pair, arm, sourceBase);
+  const prep = { id: task.id, prompt: task.prompt, cwd: ws3, base: git6(["rev-parse", "HEAD"], ws3), arm, model: opts.model };
   if (arm === "gated" && adapter.prepareGated) {
     captureStdout(() => adapter.prepareGated?.(prep));
-    if (git6(["status", "--porcelain"], ws2)) {
-      git6(["add", "-A"], ws2);
-      git6(["commit", "-qm", "tamperward research: wire enforcement (gated arm)"], ws2);
+    if (git6(["status", "--porcelain"], ws3)) {
+      git6(["add", "-A"], ws3);
+      git6(["commit", "-qm", "tamperward research: wire enforcement (gated arm)"], ws3);
     }
   }
-  const base = git6(["rev-parse", "HEAD"], ws2);
+  const base = git6(["rev-parse", "HEAD"], ws3);
   const launch2 = adapter.launch({ ...prep, base });
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   let agent;
   let treatment = null;
   if (arm === "gated") {
-    const gated = runGated(ws2, base, task, launch2.argv, launch2.env, opts.agentBudget);
+    const gated = runGated(ws3, base, task, launch2.argv, launch2.env, opts.agentBudget);
     agent = gated.agent;
     treatment = gated.treatment;
   } else {
-    agent = runUngated(ws2, launch2.argv, launch2.env, opts.agentBudget);
+    agent = runUngated(ws3, launch2.argv, launch2.env, opts.agentBudget);
   }
   const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const head = git6(["rev-parse", "HEAD"], ws2);
+  const head = git6(["rev-parse", "HEAD"], ws3);
   const protectedOnly = (rel) => {
     try {
-      return isProtected(rel, loadPolicyAt(base, ws2) ?? defaultPolicy());
+      return isProtected(rel, loadPolicyAt(base, ws3) ?? defaultPolicy());
     } catch {
       return true;
     }
   };
-  const fingerprintBefore = treeFingerprint(ws2, protectedOnly);
-  const observed = observeOutcome(ws2, base, head, task);
-  const movedDuringObservation = treeFingerprint(ws2, protectedOnly) !== fingerprintBefore;
+  const fingerprintBefore = treeFingerprint(ws3, protectedOnly);
+  const observed = observeOutcome(ws3, base, head, task);
+  const movedDuringObservation = treeFingerprint(ws3, protectedOnly) !== fingerprintBefore;
   const unmeasurable = agent.unmeasurable ?? observed.unmeasurable ?? (movedDuringObservation ? "NOT_QUIESCENT: the workspace changed while its outcome was being observed" : null);
   const { unmeasurable: _agentUnmeasurable, ...agentRecord } = agent;
   const outcome = unmeasurable === null ? observed.outcome : unobservedOutcome();
@@ -18010,7 +18135,7 @@ function runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase) {
   const releasedGreen = outcome.visible_green && agentSucceeded && (treatment === null || treatment.disposition === "passed" && treatment.exit_code === 0);
   return {
     arm,
-    workspace: ws2,
+    workspace: ws3,
     base,
     head,
     started_at: startedAt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.24.6",
+  "version": "2.25.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",
@@ -56,11 +56,11 @@
   },
   "devDependencies": {
     "@types/node": "^22.20.1",
-    "@types/picomatch": "^3.0.1",
-    "ajv": "^8.17.1",
-    "esbuild": "^0.25.12",
+    "@types/picomatch": "^4.0.3",
+    "ajv": "^8.20.0",
+    "esbuild": "^0.28.2",
     "semver": "7.8.5",
     "vitepress": "^2.0.0-alpha.19",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   }
 }