tamperward 2.25.0 → 2.25.1

package/dist/cli/index.js

@@ -3456,9 +3456,62 @@ function assertedType(node) {
   while (ts.isParenthesizedTypeNode(t)) t = t.type;
   return t;
 }
-function isDoubleCast(node) {
+function bareKind(type) {
+  let x = type;
+  while (ts.isParenthesizedTypeNode(x)) x = x.type;
+  switch (x.kind) {
+    case ts.SyntaxKind.AnyKeyword:
+      return "any";
+    case ts.SyntaxKind.NeverKeyword:
+      return "never";
+    case ts.SyntaxKind.UnknownKeyword:
+      return "unknown";
+    case ts.SyntaxKind.ObjectKeyword:
+      return "objectish";
+  }
+  if (ts.isTypeLiteralNode(x) && x.members.length === 0) return "empty";
+  if (ts.isTypeReferenceNode(x) && ts.isIdentifier(x.typeName) && !x.typeArguments) {
+    if (x.typeName.text === "Object") return "objectish";
+    if (x.typeName.text === "const") return "const";
+  }
+  return null;
+}
+function kindOfType(type, resolveName) {
+  const bare = bareKind(type);
+  if (bare) return bare;
+  let x = type;
+  while (ts.isParenthesizedTypeNode(x)) x = x.type;
+  if (ts.isTypeReferenceNode(x) && ts.isIdentifier(x.typeName) && !x.typeArguments) return resolveName(x.typeName.text);
+  return null;
+}
+function buildAliasMap(sf) {
+  const decls = /* @__PURE__ */ new Map();
+  const collect2 = (node) => {
+    if (ts.isTypeAliasDeclaration(node) && (!node.typeParameters || node.typeParameters.length === 0)) decls.set(node.name.text, node.type);
+    ts.forEachChild(node, collect2);
+  };
+  collect2(sf);
+  const resolve16 = (name, seen) => {
+    if (seen.has(name)) return null;
+    seen.add(name);
+    const t = decls.get(name);
+    return t ? kindOfType(t, (n) => resolve16(n, seen)) : null;
+  };
+  const resolved = /* @__PURE__ */ new Map();
+  for (const name of decls.keys()) {
+    const k = resolve16(name, /* @__PURE__ */ new Set());
+    if (k) resolved.set(name, k);
+  }
+  return resolved;
+}
+function assertedLaunderKind(node, aliasMap) {
+  return kindOfType(assertedType(node), (n) => aliasMap.get(n) ?? null);
+}
+function isDoubleCast(node, aliasMap) {
   const inner = unparenthesized(node.expression);
-  return (ts.isAsExpression(inner) || ts.isTypeAssertionExpression(inner)) && assertedType(inner).kind === ts.SyntaxKind.UnknownKeyword;
+  if (!(ts.isAsExpression(inner) || ts.isTypeAssertionExpression(inner))) return false;
+  const k = assertedLaunderKind(inner, aliasMap ?? EMPTY_ALIASES);
+  return k != null && DOUBLE_CAST_INNER.has(k);
 }
 function surfaceOf(path, src) {
   const sf = parseSource(path, src, scriptKind(path));
@@ -3467,20 +3520,26 @@ function surfaceOf(path, src) {
   if (diagnostics.length > 0) return null;
   const surface = { type: 0, nonNull: 0, assertions: [] };
   const lines = src.split("\n");
+  const aliasMap = buildAliasMap(sf);
   const record = (kind, node) => {
     const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
     surface.assertions.push({ kind, line, text: node.getText(sf).replace(/\s+/g, " "), lineText: (lines[line - 1] ?? "").trim() });
     if (kind === "type") surface.type++;
     else surface.nonNull++;
   };
+  const launderInner = /* @__PURE__ */ new Set();
+  const collectInners = (node) => {
+    if ((ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) && isDoubleCast(node, aliasMap)) launderInner.add(unparenthesized(node.expression));
+    ts.forEachChild(node, collectInners);
+  };
+  collectInners(sf);
   const isRow4OrHonest = (node) => {
-    const type = assertedType(node);
-    if (type.kind === ts.SyntaxKind.AnyKeyword || type.kind === ts.SyntaxKind.UnknownKeyword) return true;
-    return ts.isTypeReferenceNode(type) && ts.isIdentifier(type.typeName) && type.typeName.text === "const";
+    const k = assertedLaunderKind(node, aliasMap);
+    return k === "any" || k === "never" || k === "unknown" || k === "const";
   };
   const visit = (node) => {
     if (ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) {
-      if (!isDoubleCast(node) && !isRow4OrHonest(node)) record("type", node);
+      if (!isDoubleCast(node, aliasMap) && !isRow4OrHonest(node) && !launderInner.has(node)) record("type", node);
     } else if (ts.isNonNullExpression(node)) {
       record("non-null", node);
     }
@@ -3515,7 +3574,7 @@ function unmatchedAfter(before, after) {
   }
   return out3;
 }
-var RULE2, DECLARATION, OUT_OF_BUDGET_PATH, GENERATED_HEADER, HEADER_LINES, tsCastGrowth;
+var RULE2, DECLARATION, OUT_OF_BUDGET_PATH, GENERATED_HEADER, HEADER_LINES, DOUBLE_CAST_INNER, EMPTY_ALIASES, tsCastGrowth;
 var init_ts_cast_growth = __esm({
   "src/detectors/ts-cast-growth.ts"() {
     "use strict";
@@ -3529,6 +3588,8 @@ var init_ts_cast_growth = __esm({
     OUT_OF_BUDGET_PATH = /(?:^|\/)(?:node_modules|vendor|third_party|dist|build|generated|__generated__)\/|\.(?:generated|gen)\.[cm]?[jt]sx?$/;
     GENERATED_HEADER = /@generated\b|\bAUTO-?GENERATED\b|\bDO NOT EDIT\b/i;
     HEADER_LINES = 20;
+    DOUBLE_CAST_INNER = /* @__PURE__ */ new Set(["any", "never", "unknown", "empty", "objectish"]);
+    EMPTY_ALIASES = /* @__PURE__ */ new Map();
     tsCastGrowth = {
       id: RULE2,
       surface: ["file"],
@@ -3570,13 +3631,51 @@ var init_ts_cast_growth = __esm({
 });
 
 // src/detectors/ts-any-cast.ts
-function countAny(src) {
-  const r = { cast: 0, broad: 0, double: 0 };
+function commentIsLiveDirective(text) {
+  let inner = text;
+  if (inner.startsWith("//")) inner = inner.replace(/^\/+/, "");
+  else inner = inner.replace(/^\/\*+/, "").replace(/\*+\/$/, "");
+  for (const raw of inner.split("\n")) {
+    if (DIRECTIVE_START.test(raw.replace(/^\s*\*+/, "").trim())) return true;
+  }
+  return false;
+}
+function countLiveDirectives(src) {
+  let n = 0;
+  try {
+    const scanner = ts.createScanner(
+      ts.ScriptTarget.Latest,
+      /* skipTrivia */
+      false,
+      ts.LanguageVariant.Standard,
+      src
+    );
+    let tok = scanner.scan();
+    while (tok !== ts.SyntaxKind.EndOfFileToken) {
+      if (tok === ts.SyntaxKind.SingleLineCommentTrivia || tok === ts.SyntaxKind.MultiLineCommentTrivia) {
+        if (commentIsLiveDirective(scanner.getTokenText())) n++;
+      }
+      tok = scanner.scan();
+    }
+  } catch {
+  }
+  return n;
+}
+function countAny(src, path) {
+  const r = { cast: 0, never: 0, broad: 0, double: 0, suppress: 0, jsdoc: 0 };
+  r.suppress = countLiveDirectives(src);
+  r.jsdoc = JS_FILE.test(path) ? countMatches(src, JSDOC_ANY_CAST) : 0;
   try {
     const sf = parseSource("f.ts", src);
     if (!sf) return r;
+    const aliasMap = buildAliasMap(sf);
     const visit = (node) => {
-      if ((ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) && isDoubleCast(node)) r.double++;
+      if (ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) {
+        const k = assertedLaunderKind(node, aliasMap);
+        if (k === "any") r.cast++;
+        else if (k === "never") r.never++;
+        if (isDoubleCast(node, aliasMap)) r.double++;
+      }
       if (node.kind === ts.SyntaxKind.AnyKeyword) {
         let target = node;
         let p = target.parent;
@@ -3585,8 +3684,7 @@ function countAny(src) {
           p = p.parent;
         }
         const isCast = p && ts.isAsExpression(p) && p.type === target || p && ts.isTypeAssertionExpression(p) && p.type === target;
-        if (isCast) r.cast++;
-        else r.broad++;
+        if (!isCast) r.broad++;
       }
       ts.forEachChild(node, visit);
     };
@@ -3595,22 +3693,33 @@ function countAny(src) {
   }
   return r;
 }
-function lineHasDoubleCast(line) {
+function lineHasLiveDirective(line) {
+  return countLiveDirectives(line) > 0 || FRAGMENT_DIRECTIVE.test(line);
+}
+function lineHasRow4Cast(line, aliasMap) {
   const sf = parseSource("line.ts", line);
   if (!sf) return false;
   let found = false;
   const visit = (n) => {
     if (found) return;
-    if ((ts.isAsExpression(n) || ts.isTypeAssertionExpression(n)) && isDoubleCast(n)) {
-      found = true;
-      return;
+    if (ts.isAsExpression(n) || ts.isTypeAssertionExpression(n)) {
+      const k = assertedLaunderKind(n, aliasMap);
+      if (k === "any" || k === "never" || isDoubleCast(n, aliasMap)) {
+        found = true;
+        return;
+      }
     }
     ts.forEachChild(n, visit);
   };
   visit(sf);
   return found;
 }
-var BLOCK_RULE, WARN_RULE, DOUBLE_CAST, SUPPRESS, JSDOC_ANY_CAST, JS_FILE, countMatches, NARROW_LINE, BROAD_LINE, BLOCK_REMEDIATION, WARN_REMEDIATION, tsAnyCast;
+function aliasMapForAddedLines(c) {
+  const snippet = addedLines(c).map((l) => l.content).join("\n");
+  const sf = parseSource("lines.ts", snippet);
+  return sf ? buildAliasMap(sf) : /* @__PURE__ */ new Map();
+}
+var BLOCK_RULE, WARN_RULE, JSDOC_ANY_CAST, JS_FILE, countMatches, DIRECTIVE_START, NARROW_LINE, BROAD_LINE, FRAGMENT_DIRECTIVE, BLOCK_REMEDIATION, WARN_REMEDIATION, tsAnyCast;
 var init_ts_any_cast = __esm({
   "src/detectors/ts-any-cast.ts"() {
     "use strict";
@@ -3622,13 +3731,13 @@ var init_ts_any_cast = __esm({
     init_ts_cast_growth();
     BLOCK_RULE = "ts-any-cast";
     WARN_RULE = "ts-any-launder";
-    DOUBLE_CAST = /\bas\s+\(*\s*unknown\s*\)*\s+as\b/g;
-    SUPPRESS = /@ts-(?:ignore|expect-error|nocheck)\b/g;
-    JSDOC_ANY_CAST = /\/\*\*\s*@type\s*\{\s*any\s*\}\s*\*\/\s*\(/g;
+    JSDOC_ANY_CAST = /\/\*\*\s*@type\s*\{\s*(?:any|\*|\?)\s*\}\s*\*\/\s*\(/g;
     JS_FILE = /\.(?:js|jsx|mjs|cjs)$/;
     countMatches = (s, re) => (s.match(re) || []).length;
-    NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>|@ts-(?:ignore|expect-error|nocheck)\b/;
+    DIRECTIVE_START = /^@ts-(?:ignore|expect-error|nocheck)\b/;
+    NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>/;
     BROAD_LINE = /:\s*any\b|<[^<>]*\bany\b[^<>]*>/;
+    FRAGMENT_DIRECTIVE = /^\s*\*?\s*@ts-(?:ignore|expect-error|nocheck)\b/;
     BLOCK_REMEDIATION = "Fix the underlying type instead of silencing the checker; do not cast to `any`.";
     WARN_REMEDIATION = "Prefer a precise type or `unknown` + a guard over `any` here \u2014 flagged for review.";
     tsAnyCast = {
@@ -3642,15 +3751,17 @@ var init_ts_any_cast = __esm({
           const inTest = protectedCategory(c.path, policy) === "tests";
           if (c.after != null && c.op !== "delete") {
             const before = c.before ?? "";
-            const a = countAny(c.after);
-            const b = countAny(before);
+            const a = countAny(c.after, c.path);
+            const b = countAny(before, c.path);
             const dCast = a.cast - b.cast;
+            const dNever = a.never - b.never;
             const dBroad = a.broad - b.broad;
-            const dDouble = Math.max(a.double - b.double, countMatches(c.after, DOUBLE_CAST) - countMatches(before, DOUBLE_CAST));
-            const dSuppr = countMatches(c.after, SUPPRESS) - countMatches(before, SUPPRESS);
-            const dJsdoc = JS_FILE.test(c.path) ? countMatches(c.after, JSDOC_ANY_CAST) - countMatches(before, JSDOC_ANY_CAST) : 0;
+            const dDouble = a.double - b.double;
+            const dSuppr = a.suppress - b.suppress;
+            const dJsdoc = a.jsdoc - b.jsdoc;
             const blockReasons = [];
             if (dCast > 0) blockReasons.push("`as any` cast");
+            if (dNever > 0) blockReasons.push("`as never` cast");
             if (dDouble > 0) blockReasons.push("`as unknown as` double cast");
             if (dSuppr > 0) blockReasons.push("@ts-ignore/@ts-expect-error/@ts-nocheck suppression");
             if (dJsdoc > 0) blockReasons.push("JSDoc `@type {any}` cast");
@@ -3679,8 +3790,9 @@ var init_ts_any_cast = __esm({
             continue;
           }
           const jsdocCast = JS_FILE.test(c.path) ? new RegExp(JSDOC_ANY_CAST.source) : null;
+          const aliasMap = aliasMapForAddedLines(c);
           for (const l of addedLines(c)) {
-            if (NARROW_LINE.test(l.content) || lineHasDoubleCast(l.content) || jsdocCast && jsdocCast.test(l.content)) {
+            if (NARROW_LINE.test(l.content) || lineHasRow4Cast(l.content, aliasMap) || lineHasLiveDirective(l.content) || jsdocCast && jsdocCast.test(l.content)) {
               out3.push(
                 makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
                   file: c.path,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.25.0",
+  "version": "2.25.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",