tamperward 2.24.7 → 2.25.1

package/dist/cli/index.js

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err3) => function __init() {
+  if (err3) throw err3[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err3 = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -559,6 +564,10 @@ function defaultPolicy(version = 1) {
       // through the block-count rule (rows, assertion arguments, setup). Severity
       // backed by the real-commit corpus measurement recorded in the rule's SPEC row.
       "test-content-removal": { severity: "block" },
+      // the files that SERVE the specs under the same globs — helpers, setup
+      // modules, mocks, JSON fixtures — deleted, moved out or shrunk (#443). They
+      // define no test, so a review prompt, not a gate; the spec rules cede them.
+      "test-support": { severity: "warn" },
       "test-skip": { severity: "block" },
       "ts-any-cast": { severity: "block" },
       // the unambiguous explicit casts + ts-suppression directives
@@ -3447,9 +3456,62 @@ function assertedType(node) {
   while (ts.isParenthesizedTypeNode(t)) t = t.type;
   return t;
 }
-function isDoubleCast(node) {
+function bareKind(type) {
+  let x = type;
+  while (ts.isParenthesizedTypeNode(x)) x = x.type;
+  switch (x.kind) {
+    case ts.SyntaxKind.AnyKeyword:
+      return "any";
+    case ts.SyntaxKind.NeverKeyword:
+      return "never";
+    case ts.SyntaxKind.UnknownKeyword:
+      return "unknown";
+    case ts.SyntaxKind.ObjectKeyword:
+      return "objectish";
+  }
+  if (ts.isTypeLiteralNode(x) && x.members.length === 0) return "empty";
+  if (ts.isTypeReferenceNode(x) && ts.isIdentifier(x.typeName) && !x.typeArguments) {
+    if (x.typeName.text === "Object") return "objectish";
+    if (x.typeName.text === "const") return "const";
+  }
+  return null;
+}
+function kindOfType(type, resolveName) {
+  const bare = bareKind(type);
+  if (bare) return bare;
+  let x = type;
+  while (ts.isParenthesizedTypeNode(x)) x = x.type;
+  if (ts.isTypeReferenceNode(x) && ts.isIdentifier(x.typeName) && !x.typeArguments) return resolveName(x.typeName.text);
+  return null;
+}
+function buildAliasMap(sf) {
+  const decls = /* @__PURE__ */ new Map();
+  const collect2 = (node) => {
+    if (ts.isTypeAliasDeclaration(node) && (!node.typeParameters || node.typeParameters.length === 0)) decls.set(node.name.text, node.type);
+    ts.forEachChild(node, collect2);
+  };
+  collect2(sf);
+  const resolve16 = (name, seen) => {
+    if (seen.has(name)) return null;
+    seen.add(name);
+    const t = decls.get(name);
+    return t ? kindOfType(t, (n) => resolve16(n, seen)) : null;
+  };
+  const resolved = /* @__PURE__ */ new Map();
+  for (const name of decls.keys()) {
+    const k = resolve16(name, /* @__PURE__ */ new Set());
+    if (k) resolved.set(name, k);
+  }
+  return resolved;
+}
+function assertedLaunderKind(node, aliasMap) {
+  return kindOfType(assertedType(node), (n) => aliasMap.get(n) ?? null);
+}
+function isDoubleCast(node, aliasMap) {
   const inner = unparenthesized(node.expression);
-  return (ts.isAsExpression(inner) || ts.isTypeAssertionExpression(inner)) && assertedType(inner).kind === ts.SyntaxKind.UnknownKeyword;
+  if (!(ts.isAsExpression(inner) || ts.isTypeAssertionExpression(inner))) return false;
+  const k = assertedLaunderKind(inner, aliasMap ?? EMPTY_ALIASES);
+  return k != null && DOUBLE_CAST_INNER.has(k);
 }
 function surfaceOf(path, src) {
   const sf = parseSource(path, src, scriptKind(path));
@@ -3458,20 +3520,26 @@ function surfaceOf(path, src) {
   if (diagnostics.length > 0) return null;
   const surface = { type: 0, nonNull: 0, assertions: [] };
   const lines = src.split("\n");
+  const aliasMap = buildAliasMap(sf);
   const record = (kind, node) => {
     const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
     surface.assertions.push({ kind, line, text: node.getText(sf).replace(/\s+/g, " "), lineText: (lines[line - 1] ?? "").trim() });
     if (kind === "type") surface.type++;
     else surface.nonNull++;
   };
+  const launderInner = /* @__PURE__ */ new Set();
+  const collectInners = (node) => {
+    if ((ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) && isDoubleCast(node, aliasMap)) launderInner.add(unparenthesized(node.expression));
+    ts.forEachChild(node, collectInners);
+  };
+  collectInners(sf);
   const isRow4OrHonest = (node) => {
-    const type = assertedType(node);
-    if (type.kind === ts.SyntaxKind.AnyKeyword || type.kind === ts.SyntaxKind.UnknownKeyword) return true;
-    return ts.isTypeReferenceNode(type) && ts.isIdentifier(type.typeName) && type.typeName.text === "const";
+    const k = assertedLaunderKind(node, aliasMap);
+    return k === "any" || k === "never" || k === "unknown" || k === "const";
   };
   const visit = (node) => {
     if (ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) {
-      if (!isDoubleCast(node) && !isRow4OrHonest(node)) record("type", node);
+      if (!isDoubleCast(node, aliasMap) && !isRow4OrHonest(node) && !launderInner.has(node)) record("type", node);
     } else if (ts.isNonNullExpression(node)) {
       record("non-null", node);
     }
@@ -3506,7 +3574,7 @@ function unmatchedAfter(before, after) {
   }
   return out3;
 }
-var RULE2, DECLARATION, OUT_OF_BUDGET_PATH, GENERATED_HEADER, HEADER_LINES, tsCastGrowth;
+var RULE2, DECLARATION, OUT_OF_BUDGET_PATH, GENERATED_HEADER, HEADER_LINES, DOUBLE_CAST_INNER, EMPTY_ALIASES, tsCastGrowth;
 var init_ts_cast_growth = __esm({
   "src/detectors/ts-cast-growth.ts"() {
     "use strict";
@@ -3520,6 +3588,8 @@ var init_ts_cast_growth = __esm({
     OUT_OF_BUDGET_PATH = /(?:^|\/)(?:node_modules|vendor|third_party|dist|build|generated|__generated__)\/|\.(?:generated|gen)\.[cm]?[jt]sx?$/;
     GENERATED_HEADER = /@generated\b|\bAUTO-?GENERATED\b|\bDO NOT EDIT\b/i;
     HEADER_LINES = 20;
+    DOUBLE_CAST_INNER = /* @__PURE__ */ new Set(["any", "never", "unknown", "empty", "objectish"]);
+    EMPTY_ALIASES = /* @__PURE__ */ new Map();
     tsCastGrowth = {
       id: RULE2,
       surface: ["file"],
@@ -3561,13 +3631,51 @@ var init_ts_cast_growth = __esm({
 });
 
 // src/detectors/ts-any-cast.ts
-function countAny(src) {
-  const r = { cast: 0, broad: 0, double: 0 };
+function commentIsLiveDirective(text) {
+  let inner = text;
+  if (inner.startsWith("//")) inner = inner.replace(/^\/+/, "");
+  else inner = inner.replace(/^\/\*+/, "").replace(/\*+\/$/, "");
+  for (const raw of inner.split("\n")) {
+    if (DIRECTIVE_START.test(raw.replace(/^\s*\*+/, "").trim())) return true;
+  }
+  return false;
+}
+function countLiveDirectives(src) {
+  let n = 0;
+  try {
+    const scanner = ts.createScanner(
+      ts.ScriptTarget.Latest,
+      /* skipTrivia */
+      false,
+      ts.LanguageVariant.Standard,
+      src
+    );
+    let tok = scanner.scan();
+    while (tok !== ts.SyntaxKind.EndOfFileToken) {
+      if (tok === ts.SyntaxKind.SingleLineCommentTrivia || tok === ts.SyntaxKind.MultiLineCommentTrivia) {
+        if (commentIsLiveDirective(scanner.getTokenText())) n++;
+      }
+      tok = scanner.scan();
+    }
+  } catch {
+  }
+  return n;
+}
+function countAny(src, path) {
+  const r = { cast: 0, never: 0, broad: 0, double: 0, suppress: 0, jsdoc: 0 };
+  r.suppress = countLiveDirectives(src);
+  r.jsdoc = JS_FILE.test(path) ? countMatches(src, JSDOC_ANY_CAST) : 0;
   try {
     const sf = parseSource("f.ts", src);
     if (!sf) return r;
+    const aliasMap = buildAliasMap(sf);
     const visit = (node) => {
-      if ((ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) && isDoubleCast(node)) r.double++;
+      if (ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) {
+        const k = assertedLaunderKind(node, aliasMap);
+        if (k === "any") r.cast++;
+        else if (k === "never") r.never++;
+        if (isDoubleCast(node, aliasMap)) r.double++;
+      }
       if (node.kind === ts.SyntaxKind.AnyKeyword) {
         let target = node;
         let p = target.parent;
@@ -3576,8 +3684,7 @@ function countAny(src) {
           p = p.parent;
         }
         const isCast = p && ts.isAsExpression(p) && p.type === target || p && ts.isTypeAssertionExpression(p) && p.type === target;
-        if (isCast) r.cast++;
-        else r.broad++;
+        if (!isCast) r.broad++;
       }
       ts.forEachChild(node, visit);
     };
@@ -3586,22 +3693,33 @@ function countAny(src) {
   }
   return r;
 }
-function lineHasDoubleCast(line) {
+function lineHasLiveDirective(line) {
+  return countLiveDirectives(line) > 0 || FRAGMENT_DIRECTIVE.test(line);
+}
+function lineHasRow4Cast(line, aliasMap) {
   const sf = parseSource("line.ts", line);
   if (!sf) return false;
   let found = false;
   const visit = (n) => {
     if (found) return;
-    if ((ts.isAsExpression(n) || ts.isTypeAssertionExpression(n)) && isDoubleCast(n)) {
-      found = true;
-      return;
+    if (ts.isAsExpression(n) || ts.isTypeAssertionExpression(n)) {
+      const k = assertedLaunderKind(n, aliasMap);
+      if (k === "any" || k === "never" || isDoubleCast(n, aliasMap)) {
+        found = true;
+        return;
+      }
     }
     ts.forEachChild(n, visit);
   };
   visit(sf);
   return found;
 }
-var BLOCK_RULE, WARN_RULE, DOUBLE_CAST, SUPPRESS, JSDOC_ANY_CAST, JS_FILE, countMatches, NARROW_LINE, BROAD_LINE, BLOCK_REMEDIATION, WARN_REMEDIATION, tsAnyCast;
+function aliasMapForAddedLines(c) {
+  const snippet = addedLines(c).map((l) => l.content).join("\n");
+  const sf = parseSource("lines.ts", snippet);
+  return sf ? buildAliasMap(sf) : /* @__PURE__ */ new Map();
+}
+var BLOCK_RULE, WARN_RULE, JSDOC_ANY_CAST, JS_FILE, countMatches, DIRECTIVE_START, NARROW_LINE, BROAD_LINE, FRAGMENT_DIRECTIVE, BLOCK_REMEDIATION, WARN_REMEDIATION, tsAnyCast;
 var init_ts_any_cast = __esm({
   "src/detectors/ts-any-cast.ts"() {
     "use strict";
@@ -3613,13 +3731,13 @@ var init_ts_any_cast = __esm({
     init_ts_cast_growth();
     BLOCK_RULE = "ts-any-cast";
     WARN_RULE = "ts-any-launder";
-    DOUBLE_CAST = /\bas\s+\(*\s*unknown\s*\)*\s+as\b/g;
-    SUPPRESS = /@ts-(?:ignore|expect-error|nocheck)\b/g;
-    JSDOC_ANY_CAST = /\/\*\*\s*@type\s*\{\s*any\s*\}\s*\*\/\s*\(/g;
+    JSDOC_ANY_CAST = /\/\*\*\s*@type\s*\{\s*(?:any|\*|\?)\s*\}\s*\*\/\s*\(/g;
     JS_FILE = /\.(?:js|jsx|mjs|cjs)$/;
     countMatches = (s, re) => (s.match(re) || []).length;
-    NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>|@ts-(?:ignore|expect-error|nocheck)\b/;
+    DIRECTIVE_START = /^@ts-(?:ignore|expect-error|nocheck)\b/;
+    NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>/;
     BROAD_LINE = /:\s*any\b|<[^<>]*\bany\b[^<>]*>/;
+    FRAGMENT_DIRECTIVE = /^\s*\*?\s*@ts-(?:ignore|expect-error|nocheck)\b/;
     BLOCK_REMEDIATION = "Fix the underlying type instead of silencing the checker; do not cast to `any`.";
     WARN_REMEDIATION = "Prefer a precise type or `unknown` + a guard over `any` here \u2014 flagged for review.";
     tsAnyCast = {
@@ -3633,15 +3751,17 @@ var init_ts_any_cast = __esm({
           const inTest = protectedCategory(c.path, policy) === "tests";
           if (c.after != null && c.op !== "delete") {
             const before = c.before ?? "";
-            const a = countAny(c.after);
-            const b = countAny(before);
+            const a = countAny(c.after, c.path);
+            const b = countAny(before, c.path);
             const dCast = a.cast - b.cast;
+            const dNever = a.never - b.never;
             const dBroad = a.broad - b.broad;
-            const dDouble = Math.max(a.double - b.double, countMatches(c.after, DOUBLE_CAST) - countMatches(before, DOUBLE_CAST));
-            const dSuppr = countMatches(c.after, SUPPRESS) - countMatches(before, SUPPRESS);
-            const dJsdoc = JS_FILE.test(c.path) ? countMatches(c.after, JSDOC_ANY_CAST) - countMatches(before, JSDOC_ANY_CAST) : 0;
+            const dDouble = a.double - b.double;
+            const dSuppr = a.suppress - b.suppress;
+            const dJsdoc = a.jsdoc - b.jsdoc;
             const blockReasons = [];
             if (dCast > 0) blockReasons.push("`as any` cast");
+            if (dNever > 0) blockReasons.push("`as never` cast");
             if (dDouble > 0) blockReasons.push("`as unknown as` double cast");
             if (dSuppr > 0) blockReasons.push("@ts-ignore/@ts-expect-error/@ts-nocheck suppression");
             if (dJsdoc > 0) blockReasons.push("JSDoc `@type {any}` cast");
@@ -3670,8 +3790,9 @@ var init_ts_any_cast = __esm({
             continue;
           }
           const jsdocCast = JS_FILE.test(c.path) ? new RegExp(JSDOC_ANY_CAST.source) : null;
+          const aliasMap = aliasMapForAddedLines(c);
           for (const l of addedLines(c)) {
-            if (NARROW_LINE.test(l.content) || lineHasDoubleCast(l.content) || jsdocCast && jsdocCast.test(l.content)) {
+            if (NARROW_LINE.test(l.content) || lineHasRow4Cast(l.content, aliasMap) || lineHasLiveDirective(l.content) || jsdocCast && jsdocCast.test(l.content)) {
               out3.push(
                 makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
                   file: c.path,
@@ -4412,6 +4533,7 @@ var init_test_skip = __esm({
       constructor(source) {
         this.source = source;
       }
+      source;
       binders = /* @__PURE__ */ new Map();
       static MAX_DEPTH = 4;
       binderFor(path, ctx) {
@@ -4451,6 +4573,10 @@ var init_test_skip = __esm({
         this.resolver = resolver;
         this.depth = depth;
       }
+      ctx;
+      path;
+      resolver;
+      depth;
       memo = /* @__PURE__ */ new Map();
       resolving = /* @__PURE__ */ new Set();
       exports = null;
@@ -5748,7 +5874,7 @@ var init_gh_expression = __esm({
     "use strict";
     EXPR_TOKEN = "__expr__";
     MATRIX_TOKEN = "__matrix__";
-    TRUTHY = Symbol("truthy");
+    TRUTHY = /* @__PURE__ */ Symbol("truthy");
     truthy = (v) => v === TRUTHY ? true : typeof v === "string" ? v !== "" : typeof v === "number" ? v !== 0 : v === true;
   }
 });
@@ -8104,6 +8230,30 @@ They WILL FAIL in v10.0.0
   }
 });
 
+// src/detectors/spec-shape.ts
+function isSpecShaped(path, before, after) {
+  if (SPEC_SUFFIX.test(path)) return true;
+  if (SUPPORT_DIR.test(path)) return false;
+  if (langOf(path) === null) return false;
+  if (before === null && after === null) return true;
+  for (const src of [before, after]) {
+    if (src === null) continue;
+    const n = countTests(src, path);
+    if (n.min > 0 || n.open) return true;
+  }
+  return false;
+}
+var SPEC_SUFFIX, SUPPORT_DIR;
+var init_spec_shape = __esm({
+  "src/detectors/spec-shape.ts"() {
+    "use strict";
+    init_test_deletion();
+    init_files();
+    SPEC_SUFFIX = /(?:\.(?:test|spec)\.[cm]?[jt]sx?$|(?:^|\/)test_[^/]*\.py$|_test\.py$|(?:^|\/)conftest\.py$|_test\.go$|_spec\.rb$|_test\.rb$|Tests?\.java$|Tests?\.kts?$|Test\.php$|Tests?\.cs$|(?:^|\/)tests\/[^/]+\.rs$|(?:^|\/)tests\/[^/]+\/main\.rs$)/;
+    SUPPORT_DIR = /(?:^|\/)(?:fixtures|__fixtures__|__mocks__|__snapshots__)\//;
+  }
+});
+
 // src/detectors/reachability.ts
 function constTruth(expr) {
   const v = constValue(expr);
@@ -8629,6 +8779,7 @@ var init_test_deletion = __esm({
     init_hook_wiring();
     init_files();
     init_repo();
+    init_spec_shape();
     init_suite_config();
     init_invocation();
     init_narrow();
@@ -8685,7 +8836,7 @@ var init_test_deletion = __esm({
         };
         for (const c of changes) {
           if (c.kind === "file") {
-            const isTest = isSpec(c.path);
+            const isTest = isSpec(c.path) && isSpecShaped(c.path, c.before, c.after);
             if (c.op === "delete" && isTest) {
               if (c.before != null && isRelocation(significantLines(c.before, c.path), countTestBlocks(c.before, c.path))) continue;
               out3.push(
@@ -8696,7 +8847,7 @@ var init_test_deletion = __esm({
                   remediation: "Fix the code under test, not the suite. Deleting a failing test to pass is the move this blocks."
                 })
               );
-            } else if (c.op === "rename" && c.oldPath && isSpec(c.oldPath) && !isTest) {
+            } else if (c.op === "rename" && c.oldPath && isSpec(c.oldPath) && isSpecShaped(c.oldPath, c.before, c.after) && !isSpec(c.path)) {
               out3.push(
                 makeFinding(RULE9, policy, {
                   file: c.path,
@@ -8730,7 +8881,7 @@ var init_test_deletion = __esm({
                   })
                 );
               }
-            } else if (c.op !== "delete" && c.after != null && !isTest && isProtected(c.path, policy, "config") && runnerOf(c.path, c.after)) {
+            } else if (c.op !== "delete" && c.after != null && !isSpec(c.path) && isProtected(c.path, policy, "config") && runnerOf(c.path, c.after)) {
               const rn = runnerOf(c.path, c.after);
               const readable = rn !== "pytest" || effectivePytestConfig(c.path, ctx);
               for (const n of readable ? suiteNarrowings(c.before, c.after, c.path, runnerSamples(c.path, policy, ctx, rn)) : []) {
@@ -8791,6 +8942,7 @@ var init_test_deletion = __esm({
                 const resolved = root !== null && /(?:^|\/)\.{1,2}(?:\/|$)/.test(t) ? joinRoot(root, t) : null;
                 const probe = resolved ?? t;
                 if (!isSpec(probe)) return false;
+                if (!isSpecShaped(probe, root === null ? null : trackedContent(resolved ?? inRepo(t), ctx), null)) return false;
                 if (!listing || root === null) return true;
                 const looksLikeFile = /\.[A-Za-z0-9]+$/.test(probe.split("/").pop() ?? "");
                 if (looksLikeFile || listing.includes(resolved ?? inRepo(t))) return true;
@@ -8954,6 +9106,7 @@ var init_test_content_removal = __esm({
     init_finding();
     init_test_deletion();
     init_files();
+    init_spec_shape();
     init_reachability();
     RULE10 = "test-content-removal";
     MIN_REMOVED_LINES = 3;
@@ -8981,9 +9134,9 @@ var init_test_content_removal = __esm({
         }
       }
       /** Text added outside any spec (a case table moved to `test/fixtures/`): code. */
-      addCode(ws2) {
-        this.text += ws2;
-        for (let i = 0; i < ws2.length; i++) this.inLiteral.push(0);
+      addCode(ws3) {
+        this.text += ws3;
+        for (let i = 0; i < ws3.length; i++) this.inLiteral.push(0);
       }
       keeps(wsLine) {
         if (wsLine.length === 0) return true;
@@ -9019,6 +9172,7 @@ var init_test_content_removal = __esm({
           if (c.kind !== "file" || c.op !== "modify" && c.op !== "rename" || c.before == null || c.after == null) continue;
           if (!isProtected(c.path, policy, "tests")) continue;
           if (isProtected(c.path, policy, "snapshots")) continue;
+          if (!isSpecShaped(c.path, c.before, c.after)) continue;
           const blocksBefore = countTests(c.before, c.path);
           const blocksAfter = countTests(c.after, c.path);
           if (blocksAfter.min < blocksBefore.min && !blocksAfter.open) continue;
@@ -9412,6 +9566,87 @@ var init_assertion_weakening = __esm({
   }
 });
 
+// src/detectors/test-support.ts
+function significant(src, path) {
+  const lang = langOf(path);
+  const out3 = [];
+  for (const raw of src.split("\n")) {
+    const l = raw.trim();
+    if (isSignificantLine(l, lang)) out3.push(l);
+  }
+  return out3;
+}
+var RULE14, MIN_REMOVED_LINES2, ws2, testSupport;
+var init_test_support = __esm({
+  "src/detectors/test-support.ts"() {
+    "use strict";
+    init_policy();
+    init_finding();
+    init_spec_shape();
+    init_files();
+    RULE14 = "test-support";
+    MIN_REMOVED_LINES2 = 3;
+    ws2 = (s) => s.replace(/\s+/g, "");
+    testSupport = {
+      id: RULE14,
+      surface: ["file"],
+      certainty: "mechanical",
+      run(changes, policy) {
+        const out3 = [];
+        const isSupport = (p, before, after) => isProtected(p, policy, "tests") && !isProtected(p, policy, "snapshots") && !isSpecShaped(p, before, after);
+        let kept = "";
+        for (const c of changes) {
+          if (c.kind === "file" && c.after != null) kept += ws2(c.after);
+        }
+        for (const c of changes) {
+          if (c.kind !== "file") continue;
+          if (c.op === "delete") {
+            if (!isSupport(c.path, c.before, null)) continue;
+            out3.push(
+              makeFinding(RULE14, policy, {
+                file: c.path,
+                message: "A test-support file was deleted (a helper, setup module or fixture under the test globs; it defines no test).",
+                evidence: c.path,
+                remediation: "Check that nothing in the suite still needs it. A helper the specs import makes them fail loudly; a fixture or setup module they read makes them weaker quietly.",
+                defaultSeverity: "warn"
+              })
+            );
+          } else if (c.op === "rename" && c.oldPath && isSupport(c.oldPath, c.before, c.after) && !isProtected(c.path, policy, "tests")) {
+            out3.push(
+              makeFinding(RULE14, policy, {
+                file: c.path,
+                message: `A test-support file was renamed out of the test globs (${c.oldPath} \u2192 ${c.path}).`,
+                evidence: `${c.oldPath} \u2192 ${c.path}`,
+                remediation: "Keep test helpers and fixtures under the test tree, where the policy protects them.",
+                defaultSeverity: "warn"
+              })
+            );
+          } else if ((c.op === "modify" || c.op === "rename") && c.before != null && c.after != null) {
+            if (!isSupport(c.path, c.before, c.after)) continue;
+            const beforeSig = significant(c.before, c.path);
+            const afterSig = significant(c.after, c.path);
+            const netDrop = beforeSig.length - afterSig.length;
+            if (netDrop < MIN_REMOVED_LINES2) continue;
+            const afterSet = new Set(afterSig);
+            const gone = [...new Set(beforeSig)].filter((l) => !afterSet.has(l) && !kept.includes(ws2(l)));
+            if (gone.length < MIN_REMOVED_LINES2) continue;
+            out3.push(
+              makeFinding(RULE14, policy, {
+                file: c.path,
+                message: `Test-support content removed: ${gone.length} significant line(s) gone from a helper, setup module or fixture under the test globs.`,
+                evidence: gone.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
+                remediation: "Check what the specs lose. A mock, a fixture row or a setup step removed here weakens every spec that relied on it without any spec changing.",
+                defaultSeverity: "warn"
+              })
+            );
+          }
+        }
+        return out3;
+      }
+    };
+  }
+});
+
 // src/detectors/index.ts
 var allDetectors;
 var init_detectors = __esm({
@@ -9431,6 +9666,7 @@ var init_detectors = __esm({
     init_snapshot_rewrite();
     init_snapshot_only();
     init_assertion_weakening();
+    init_test_support();
     allDetectors = [
       noVerify,
       tsAnyCast,
@@ -9443,6 +9679,7 @@ var init_detectors = __esm({
       hookTampering,
       testDeletion,
       testContentRemoval,
+      testSupport,
       snapshotRewrite,
       snapshotOnlyRewrite,
       assertionWeakening
@@ -10910,7 +11147,7 @@ function drainEvents(log, offset, maxTotalBytes = MAX_EVENT_SWEEP_BYTES, io = DE
   };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
-  if (!isEnabled(RULE14, policy)) return [];
+  if (!isEnabled(RULE15, policy)) return [];
   const byPath = /* @__PURE__ */ new Map();
   for (const e of events) {
     if (!isProtected(e.path, policy)) continue;
@@ -10930,7 +11167,7 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
     const modeChurn = modes.size > 1;
     if (!contentChurn && !modeChurn) continue;
     const what = contentChurn ? `content was modified and restored within the turn (${hashes.size} distinct states observed)` : `file mode changed during the turn (${[...modes].map((m) => (m & 4095).toString(8)).join(" \u2192 ")})`;
-    const f = makeFinding(RULE14, policy, {
+    const f = makeFinding(RULE15, policy, {
       file: path,
       message: `Transient protected mutation: ${what}, leaving no net diff.`,
       evidence: evs.slice(0, 4).map((e) => `${e.ts} ${e.hash ?? "gone"}${e.mode != null ? `/${(e.mode & 4095).toString(8)}` : ""}`).join(" | "),
@@ -10945,14 +11182,14 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
   }
   return out3;
 }
-var RULE14, MAX_EVENT_READ_BYTES, MAX_EVENT_SWEEP_BYTES, DEFAULT_EVENT_READ_IO;
+var RULE15, MAX_EVENT_READ_BYTES, MAX_EVENT_SWEEP_BYTES, DEFAULT_EVENT_READ_IO;
 var init_fs_events = __esm({
   "src/detectors/fs-events.ts"() {
     "use strict";
     init_policy();
     init_finding();
     init_narrow();
-    RULE14 = "transient-protected-mutation";
+    RULE15 = "transient-protected-mutation";
     MAX_EVENT_READ_BYTES = 4 * 1024 * 1024;
     MAX_EVENT_SWEEP_BYTES = 16 * 1024 * 1024;
     DEFAULT_EVENT_READ_IO = {
@@ -17799,22 +18036,22 @@ function writeRecordAtomically(path, text) {
   renameSync4(tmp, path);
 }
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
-  const ws2 = join23(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
-  rmSync11(ws2, { recursive: true, force: true });
+  const ws3 = join23(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
+  rmSync11(ws3, { recursive: true, force: true });
   mkdirSync8(join23(ledger, "workspaces"), { recursive: true });
   try {
-    execFileSync13("git", ["clone", "-q", "--no-hardlinks", task.repo, ws2], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
+    execFileSync13("git", ["clone", "-q", "--no-hardlinks", task.repo, ws3], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
   } catch (e) {
     throw new ResearchError(`task "${task.id}": cannot clone ${task.repo}: ${errorMessage(e).split("\n")[0]}`);
   }
-  git6(["config", "user.name", "tamperward-research"], ws2);
-  git6(["config", "user.email", "research@tamperward.invalid"], ws2);
+  git6(["config", "user.name", "tamperward-research"], ws3);
+  git6(["config", "user.email", "research@tamperward.invalid"], ws3);
   const requestedBase = sourceBase ?? task.base;
   const candidates = sourceBase !== void 0 ? [sourceBase] : task.base === "HEAD" ? ["HEAD"] : [task.base, `origin/${task.base}`];
   for (const rev2 of candidates) {
     try {
-      git6(["checkout", "-q", "--detach", rev2], ws2);
-      return ws2;
+      git6(["checkout", "-q", "--detach", rev2], ws3);
+      return ws3;
     } catch {
     }
   }
@@ -17837,13 +18074,13 @@ function parseDocument2(text) {
     return null;
   }
 }
-function runGated(ws2, base, task, argv, env, agentBudget) {
+function runGated(ws3, base, task, argv, env, agentBudget) {
   const observed = {};
   const { result: code2, out: captured } = withEnv2(
     env,
     () => captureStdout(
       () => runEnvelope({
-        cwd: ws2,
+        cwd: ws3,
         base,
         cmd: task.verify.command,
         budget: task.verify.budget,
@@ -17884,8 +18121,8 @@ function runGated(ws2, base, task, argv, env, agentBudget) {
     }
   };
 }
-function runUngated(ws2, argv, env, agentBudget) {
-  const r = withEnv2(env, () => runAgentSupervised(argv, ws2, agentBudget, void 0, void 0, true));
+function runUngated(ws3, argv, env, agentBudget) {
+  const r = withEnv2(env, () => runAgentSupervised(argv, ws3, agentBudget, void 0, void 0, true));
   return {
     exit_code: r.failure ? null : r.exit,
     signal: r.signal ?? null,
@@ -17910,20 +18147,20 @@ function unobservedOutcome() {
     honest_completion: false
   };
 }
-function trustedPolicyAt(base, ws2) {
+function trustedPolicyAt(base, ws3) {
   try {
-    return { policy: loadPolicyAt(base, ws2) ?? defaultPolicy() };
+    return { policy: loadPolicyAt(base, ws3) ?? defaultPolicy() };
   } catch (e) {
     return { failure: `trusted policy at ${base.slice(0, 10)} could not be loaded: ${errorMessage(e).split("\n")[0]}` };
   }
 }
-function observeOutcome(ws2, base, head, task) {
-  const trusted = trustedPolicyAt(base, ws2);
+function observeOutcome(ws3, base, head, task) {
+  const trusted = trustedPolicyAt(base, ws3);
   if ("failure" in trusted) return { outcome: unobservedOutcome(), unmeasurable: trusted.failure };
   const policy = trusted.policy;
   const verify = parseDocument2(
     captureStdout(
-      () => runVerify({ cwd: ws2, base, cmd: task.verify.command, budget: task.verify.budget, json: true, policyOverride: policy })
+      () => runVerify({ cwd: ws3, base, cmd: task.verify.command, budget: task.verify.budget, json: true, policyOverride: policy })
     ).out
   );
   const stageExit = (stage) => isRecord(stage) ? finiteNumber(stage.exit) ?? null : null;
@@ -17943,11 +18180,11 @@ function observeOutcome(ws2, base, head, task) {
     }
   };
   collect2(parseDocument2(captureStdout(
-    () => runCheck({ cwd: ws2, worktree: true, json: true, policyOverride: policy, includeUntracked: true, ciLayer: true })
+    () => runCheck({ cwd: ws3, worktree: true, json: true, policyOverride: policy, includeUntracked: true, ciLayer: true })
   ).out));
   if (head !== base) {
     collect2(parseDocument2(captureStdout(
-      () => runCheck({ cwd: ws2, diff: `${base}...${head}`, json: true, policyOverride: policy })
+      () => runCheck({ cwd: ws3, diff: `${base}...${head}`, json: true, policyOverride: policy })
     ).out));
   }
   const expectedCheckDocuments = head !== base ? 2 : 1;
@@ -17970,39 +18207,39 @@ function observeOutcome(ws2, base, head, task) {
   return { outcome, unmeasurable };
 }
 function runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase) {
-  const ws2 = freshWorkspace(ledger, task, pair, arm, sourceBase);
-  const prep = { id: task.id, prompt: task.prompt, cwd: ws2, base: git6(["rev-parse", "HEAD"], ws2), arm, model: opts.model };
+  const ws3 = freshWorkspace(ledger, task, pair, arm, sourceBase);
+  const prep = { id: task.id, prompt: task.prompt, cwd: ws3, base: git6(["rev-parse", "HEAD"], ws3), arm, model: opts.model };
   if (arm === "gated" && adapter.prepareGated) {
     captureStdout(() => adapter.prepareGated?.(prep));
-    if (git6(["status", "--porcelain"], ws2)) {
-      git6(["add", "-A"], ws2);
-      git6(["commit", "-qm", "tamperward research: wire enforcement (gated arm)"], ws2);
+    if (git6(["status", "--porcelain"], ws3)) {
+      git6(["add", "-A"], ws3);
+      git6(["commit", "-qm", "tamperward research: wire enforcement (gated arm)"], ws3);
     }
   }
-  const base = git6(["rev-parse", "HEAD"], ws2);
+  const base = git6(["rev-parse", "HEAD"], ws3);
   const launch2 = adapter.launch({ ...prep, base });
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   let agent;
   let treatment = null;
   if (arm === "gated") {
-    const gated = runGated(ws2, base, task, launch2.argv, launch2.env, opts.agentBudget);
+    const gated = runGated(ws3, base, task, launch2.argv, launch2.env, opts.agentBudget);
     agent = gated.agent;
     treatment = gated.treatment;
   } else {
-    agent = runUngated(ws2, launch2.argv, launch2.env, opts.agentBudget);
+    agent = runUngated(ws3, launch2.argv, launch2.env, opts.agentBudget);
   }
   const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const head = git6(["rev-parse", "HEAD"], ws2);
+  const head = git6(["rev-parse", "HEAD"], ws3);
   const protectedOnly = (rel) => {
     try {
-      return isProtected(rel, loadPolicyAt(base, ws2) ?? defaultPolicy());
+      return isProtected(rel, loadPolicyAt(base, ws3) ?? defaultPolicy());
     } catch {
       return true;
     }
   };
-  const fingerprintBefore = treeFingerprint(ws2, protectedOnly);
-  const observed = observeOutcome(ws2, base, head, task);
-  const movedDuringObservation = treeFingerprint(ws2, protectedOnly) !== fingerprintBefore;
+  const fingerprintBefore = treeFingerprint(ws3, protectedOnly);
+  const observed = observeOutcome(ws3, base, head, task);
+  const movedDuringObservation = treeFingerprint(ws3, protectedOnly) !== fingerprintBefore;
   const unmeasurable = agent.unmeasurable ?? observed.unmeasurable ?? (movedDuringObservation ? "NOT_QUIESCENT: the workspace changed while its outcome was being observed" : null);
   const { unmeasurable: _agentUnmeasurable, ...agentRecord } = agent;
   const outcome = unmeasurable === null ? observed.outcome : unobservedOutcome();
@@ -18010,7 +18247,7 @@ function runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase) {
   const releasedGreen = outcome.visible_green && agentSucceeded && (treatment === null || treatment.disposition === "passed" && treatment.exit_code === 0);
   return {
     arm,
-    workspace: ws2,
+    workspace: ws3,
     base,
     head,
     started_at: startedAt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.24.7",
+  "version": "2.25.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",
@@ -56,11 +56,11 @@
   },
   "devDependencies": {
     "@types/node": "^22.20.1",
-    "@types/picomatch": "^3.0.1",
-    "ajv": "^8.17.1",
-    "esbuild": "^0.25.12",
+    "@types/picomatch": "^4.0.3",
+    "ajv": "^8.20.0",
+    "esbuild": "^0.28.2",
     "semver": "7.8.5",
     "vitepress": "^2.0.0-alpha.19",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   }
 }