tamperward 2.29.6 → 2.29.8

package/dist/cli/index.js

@@ -3478,7 +3478,7 @@ function skipRegexLiteral(line, start) {
   }
   return line.length - 1;
 }
-var CODE, EXT, COMMON, IMPORTS, HASH_COMMENT, DEBUG_ONLY, SLASH_COMMENT, HASH_COMMENT_LANGS, REGEX_KEYWORDS;
+var CODE, EXT, COMMON, IMPORTS, HASH_COMMENT, DEBUG_ONLY, SLASH_COMMENT, HASH_COMMENT_LANGS, CommentStringMasker, REGEX_KEYWORDS;
 var init_files = __esm({
   "src/detectors/files.ts"() {
     "use strict";
@@ -3510,6 +3510,90 @@ var init_files = __esm({
     DEBUG_ONLY = /^(?:console\.\w+\(.*\)\s*;?|debugger\s*;?)$/;
     SLASH_COMMENT = /^(?:\/\/|\/\*|\*(?:\s|\/|$))/;
     HASH_COMMENT_LANGS = /* @__PURE__ */ new Set(["py", "rb", "php"]);
+    CommentStringMasker = class {
+      constructor(maskStrings = true) {
+        this.maskStrings = maskStrings;
+      }
+      maskStrings;
+      stack = [];
+      mask(line) {
+        const out3 = line.split("");
+        for (const f of this.stack) if (f.kind === "string" || f.kind === "template") f.carried = true;
+        let i = 0;
+        while (i < line.length) {
+          const top = this.stack[this.stack.length - 1];
+          const ch = line[i];
+          const next = line[i + 1];
+          if (top?.kind === "block") {
+            out3[i] = " ";
+            if (ch === "*" && next === "/") {
+              out3[i + 1] = " ";
+              this.stack.pop();
+              i += 2;
+              continue;
+            }
+            i++;
+            continue;
+          }
+          if (top?.kind === "string" || top?.kind === "template") {
+            const blank = this.maskStrings || top.carried;
+            if (ch === "\\") {
+              if (blank) {
+                out3[i] = " ";
+                if (i + 1 < line.length) out3[i + 1] = " ";
+              }
+              i += 2;
+              continue;
+            }
+            if (top.kind === "string" ? ch === top.quote : ch === "`") {
+              this.stack.pop();
+              i++;
+              continue;
+            }
+            if (top.kind === "template" && ch === "$" && next === "{") {
+              this.stack.push({ kind: "subst", depth: 1 });
+              i += 2;
+              continue;
+            }
+            if (blank) out3[i] = " ";
+            i++;
+            continue;
+          }
+          if (ch === "/" && next === "/") {
+            for (let j = i; j < line.length; j++) out3[j] = " ";
+            i = line.length;
+            continue;
+          }
+          if (ch === "/" && next === "*") {
+            out3[i] = " ";
+            out3[i + 1] = " ";
+            this.stack.push({ kind: "block" });
+            i += 2;
+            continue;
+          }
+          if (ch === "`") {
+            this.stack.push({ kind: "template", carried: false });
+            i++;
+            continue;
+          }
+          if (ch === '"' || ch === "'") {
+            this.stack.push({ kind: "string", quote: ch, carried: false });
+            i++;
+            continue;
+          }
+          if (ch === "/" && regexPosition(line.slice(0, i))) {
+            i = skipRegexLiteral(line, i) + 1;
+            continue;
+          }
+          if (top?.kind === "subst") {
+            if (ch === "{") top.depth++;
+            else if (ch === "}" && --top.depth === 0) this.stack.pop();
+          }
+          i++;
+        }
+        return out3.join("");
+      }
+    };
     REGEX_KEYWORDS = /* @__PURE__ */ new Set([
       "return",
       "throw",
@@ -3885,29 +3969,35 @@ var init_ts_any_cast = __esm({
           }
           const jsdocCast = JS_FILE.test(c.path) ? new RegExp(JSDOC_ANY_CAST.source) : null;
           const aliasMap = aliasMapForAddedLines(c);
-          for (const l of addedLines(c)) {
-            if (NARROW_LINE.test(l.content) || lineHasRow4Cast(l.content, aliasMap) || lineHasLiveDirective(l.content) || jsdocCast && jsdocCast.test(l.content)) {
-              out3.push(
-                makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
-                  file: c.path,
-                  line: l.newLine ?? void 0,
-                  message: inTest ? "Type-checker escape in a test file (test infrastructure \u2014 flagged, not blocked)." : "Type safety discarded: an explicit cast/suppression was added.",
-                  evidence: l.content.trim(),
-                  remediation: inTest ? WARN_REMEDIATION : BLOCK_REMEDIATION,
-                  defaultSeverity: inTest ? "warn" : "block"
-                })
-              );
-            } else if (BROAD_LINE.test(l.content)) {
-              out3.push(
-                makeFinding(WARN_RULE, policy, {
-                  file: c.path,
-                  line: l.newLine ?? void 0,
-                  message: "Type laundered to `any` in a type/generic position.",
-                  evidence: l.content.trim(),
-                  remediation: WARN_REMEDIATION,
-                  defaultSeverity: "warn"
-                })
-              );
+          for (const h of c.hunks) {
+            const masker = new CommentStringMasker();
+            for (const l of h.lines) {
+              if (l.type === "del") continue;
+              const code2 = masker.mask(l.content);
+              if (l.type !== "add") continue;
+              if (NARROW_LINE.test(code2) || lineHasRow4Cast(code2, aliasMap) || lineHasLiveDirective(l.content) || jsdocCast && jsdocCast.test(l.content)) {
+                out3.push(
+                  makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
+                    file: c.path,
+                    line: l.newLine ?? void 0,
+                    message: inTest ? "Type-checker escape in a test file (test infrastructure \u2014 flagged, not blocked)." : "Type safety discarded: an explicit cast/suppression was added.",
+                    evidence: l.content.trim(),
+                    remediation: inTest ? WARN_REMEDIATION : BLOCK_REMEDIATION,
+                    defaultSeverity: inTest ? "warn" : "block"
+                  })
+                );
+              } else if (BROAD_LINE.test(code2)) {
+                out3.push(
+                  makeFinding(WARN_RULE, policy, {
+                    file: c.path,
+                    line: l.newLine ?? void 0,
+                    message: "Type laundered to `any` in a type/generic position.",
+                    evidence: l.content.trim(),
+                    remediation: WARN_REMEDIATION,
+                    defaultSeverity: "warn"
+                  })
+                );
+              }
             }
           }
         }
@@ -4940,23 +5030,30 @@ var init_test_skip = __esm({
               );
             }
           }
-          for (const l of addedLines(c)) {
-            if (l.newLine != null && astHitLines.has(l.newLine)) continue;
-            const comment = isCommentLine(l.content.trim(), lang);
-            for (const p of patterns) {
-              if (astAuthoritative && p.astOwned && !(l.newLine != null && unowned.has(l.newLine))) continue;
-              if (comment && !p.comment) continue;
-              if (matchesOutsideString(p, l.content, lang)) {
-                out3.push(
-                  makeFinding(RULE4, policy, {
-                    file: c.path,
-                    line: l.newLine ?? void 0,
-                    message: `Test skipped or narrowed: ${p.why}.`,
-                    evidence: l.content.trim(),
-                    remediation: "Make the test pass rather than skipping it. If it is genuinely obsolete, a human must sign off."
-                  })
-                );
-                break;
+          const maskJs = lang === "js" || lang == null;
+          for (const h of c.hunks) {
+            const masker = maskJs ? new CommentStringMasker(false) : null;
+            for (const l of h.lines) {
+              if (l.type === "del") continue;
+              const code2 = masker ? masker.mask(l.content) : l.content;
+              if (l.type !== "add") continue;
+              if (l.newLine != null && astHitLines.has(l.newLine)) continue;
+              const comment = isCommentLine(code2.trim(), lang);
+              for (const p of patterns) {
+                if (astAuthoritative && p.astOwned && !(l.newLine != null && unowned.has(l.newLine))) continue;
+                if (comment && !p.comment) continue;
+                if (matchesOutsideString(p, p.comment ? l.content : code2, lang)) {
+                  out3.push(
+                    makeFinding(RULE4, policy, {
+                      file: c.path,
+                      line: l.newLine ?? void 0,
+                      message: `Test skipped or narrowed: ${p.why}.`,
+                      evidence: l.content.trim(),
+                      remediation: "Make the test pass rather than skipping it. If it is genuinely obsolete, a human must sign off."
+                    })
+                  );
+                  break;
+                }
               }
             }
           }
@@ -9914,7 +10011,7 @@ function namesProtectedSnapshot(seg, policy) {
   }
   return null;
 }
-var RULE12, RUNNER3, PM_TEST_SCRIPT, UPDATE_ANY, UPDATE_WITH_RUNNER, INSTA_ACCEPT, UPDATE_EXPECT, REGEN_SCRIPT, MUTATE, snapshotRewrite;
+var RULE12, RUNNER3, PM_TEST_SCRIPT, UPDATE_ANY, UPDATE_WITH_RUNNER, INSTA_ACCEPT, UPDATE_EXPECT, TAP_SNAPSHOT, REGEN_SCRIPT, MUTATE, snapshotRewrite;
 var init_snapshot_rewrite = __esm({
   "src/detectors/snapshot-rewrite.ts"() {
     "use strict";
@@ -9922,12 +10019,13 @@ var init_snapshot_rewrite = __esm({
     init_finding();
     init_command();
     RULE12 = "snapshot-rewrite";
-    RUNNER3 = /\b(?:jest|vitest|playwright|ava)\b/;
+    RUNNER3 = /\b(?:jest|vitest|playwright|ava|tap)\b/;
     PM_TEST_SCRIPT = /(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:t|tst|test|run(?:-script)?\s+\S*test\S*)(?:\s|$)/;
     UPDATE_ANY = /--(?:update-?[sS]napshots?|test-update-snapshots|snapshot-update)\b/;
-    UPDATE_WITH_RUNNER = /(?:^|\s)(?:-u|--update)(?:\s|$)/;
+    UPDATE_WITH_RUNNER = /(?:^|\s)(?:-u|--update|--snapshot)(?:=(?:1|true))?(?:\s|$)/;
     INSTA_ACCEPT = /\bcargo\s+insta\s+(?:accept\b|.*\s--accept\b)/;
     UPDATE_EXPECT = /(?:^|\s)UPDATE_EXPECT=\S+/;
+    TAP_SNAPSHOT = /(?:^|\s)TAP_SNAPSHOT=1(?:\s|$)/;
     REGEN_SCRIPT = /\b(?:update|regen(?:erate)?|re?bless)[-_.]?(?:golden|snapshots?|baselines?|expected)\b/i;
     MUTATE = /(?:^|\s)(?:rm|cp|mv|tee|truncate|dd)(?:\s|$)|sed\s+-i|>{1,2}|\bfind\b.*\s-(?:delete\b|exec\s+rm\b)|\bgit\s+(?:checkout|restore)\b/;
     snapshotRewrite = {
@@ -9945,6 +10043,7 @@ var init_snapshot_rewrite = __esm({
               else if ((RUNNER3.test(seg) || PM_TEST_SCRIPT.test(seg)) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
               else if (INSTA_ACCEPT.test(seg)) why = "cargo insta accept rewrites every pending snapshot to match current output";
               else if (UPDATE_EXPECT.test(seg)) why = "UPDATE_EXPECT=1 rewrites every expect-test expectation to match current output";
+              else if (TAP_SNAPSHOT.test(seg)) why = "TAP_SNAPSHOT=1 rewrites every node-tap snapshot to match current output";
               else if (REGEN_SCRIPT.test(seg)) why = "a regeneration script rewrites the recorded expected output from current output";
               else {
                 const path = MUTATE.test(seg) ? namesProtectedSnapshot(seg, policy) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.6",
+  "version": "2.29.8",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",