tamperward 2.7.0 → 2.7.1

package/dist/cli/index.js

@@ -1186,6 +1186,50 @@ function trackedFiles(ctx) {
   return files;
 }
 var branchCache = /* @__PURE__ */ new Map();
+var refsCache = /* @__PURE__ */ new Map();
+function branchRefs(ctx) {
+  if (!ctx?.cwd) return null;
+  const hit = refsCache.get(ctx.cwd);
+  if (hit !== void 0) return hit;
+  let refs = null;
+  try {
+    const out2 = execFileSync2("git", ["for-each-ref", "--format=%(refname:short)", "refs/heads", "refs/remotes"], {
+      cwd: ctx.cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    refs = new Set(out2.split("\n").map((l) => l.trim()).filter(Boolean));
+  } catch {
+    refs = null;
+  }
+  refsCache.set(ctx.cwd, refs);
+  return refs;
+}
+function branchExists(name, ctx) {
+  const refs = branchRefs(ctx);
+  if (!refs) return null;
+  if (refs.has(name)) return true;
+  for (const r of refs) if (r.endsWith("/" + name)) return true;
+  return false;
+}
+function revIsHead(rev, ctx) {
+  if (!ctx?.cwd || rev.startsWith("-")) return null;
+  const parse3 = (r) => {
+    try {
+      return execFileSync2("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${r}^{commit}`], {
+        cwd: ctx.cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const head = parse3("HEAD");
+  const target = parse3(rev);
+  if (!head || !target) return null;
+  return head === target;
+}
 function defaultBranch(ctx) {
   if (!ctx?.cwd) return null;
   const hit = branchCache.get(ctx.cwd);
@@ -1205,15 +1249,16 @@ function defaultBranch(ctx) {
   return name;
 }
 var dirOf = (t) => t.replace(/^\.\//, "").replace(/\/+$/, "");
-function containsProtected(token, policy, category, ctx) {
+function containsProtected(token, policy, category, ctx, except) {
   const dir = dirOf(token);
   if (!dir || dir === "." || dir === "/" || dir.startsWith("-")) return false;
+  const counts = (p) => isProtected(p, policy, category) && !(except && isProtected(p, policy, except));
   const files = trackedFiles(ctx);
   if (files) {
     const prefix = dir + "/";
-    return files.some((f) => f.startsWith(prefix) && isProtected(f, policy, category));
+    return files.some((f) => f.startsWith(prefix) && counts(f));
   }
-  if (isProtected(dir + "/probe", policy, category)) return true;
+  if (counts(dir + "/probe")) return true;
   const base = dir.split("/").pop() ?? "";
   return category === "tests" && /^(?:test|tests|__tests__|spec|specs)$/i.test(base);
 }
@@ -1316,6 +1361,10 @@ function parseThresholds(src) {
               if (!ts2.isPropertyAssignment(p)) continue;
               const k = keyName(p.name);
               if (k === null || isMetric(k)) continue;
+              if (key2 === "thresholds" && k === "100" && p.initializer.kind === ts2.SyntaxKind.TrueKeyword) {
+                res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
+                continue;
+              }
               const m = metricsOf(p.initializer, resolve5);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
@@ -1409,7 +1458,7 @@ function sectionText(src, key2) {
     return "";
   }
 }
-var BENIGN_EXEMPTION = /node_modules|(?:^|[/!])(?:dist|build|out|coverage|tmp|temp|vendor|test|tests|__tests__|__mocks__|__fixtures__|fixtures?|mocks?|spec|specs|e2e|cypress|playwright|storybook|scripts?|examples?|docs?|bin|types?|typings)(?:\/|$|\*)|\.(?:test|spec|stories|d)\.|\.(?:config|setup)\.|\.git\b|\.cache|\.next|\.nuxt|\.output|\.idea|\.d\.ts|\.json$|\.md$|\.css$|\.s[ac]ss$/i;
+var BENIGN_EXEMPTION = /node_modules|(?:^|[/!])(?:dist|build|out|coverage|tmp|temp|vendor|test|tests|__tests__|__mocks__|__fixtures__|fixtures?|mocks?|spec|specs|e2e|cypress|playwright|storybook|scripts?|examples?|docs?|bin|types?|typings|generated|__generated__|codegen|migrations?)(?:\/|$|\*)|\.(?:test|spec|stories|d|gen|generated|pb|e2e-spec)\.|\.(?:config|setup)\.|(?:^|[/!*])(?:manage|wsgi|asgi|__init__)\.py$|(?:^|[/!*])main\.[jt]sx?$|\.git\b|\.cache|\.next|\.nuxt|\.output|\.idea|\.d\.ts|\.json$|\.md$|\.css$|\.s[ac]ss$/i;
 function compareMetrics(scope, before, after, out2) {
   if (!before) return;
   for (const m of METRICS) {
@@ -1553,20 +1602,28 @@ var SIMPLE_FILES = [
 ];
 var lessThan = (a, b) => a === "auto" ? b !== "auto" : b === "auto" ? false : a < b;
 var numOf = (s) => s === "auto" ? "auto" : Number(s);
-function numbersOf(src, key2, scoped = false) {
-  const out2 = [];
+function* scopedLines(src) {
   const stack = [];
   for (const line of src.split("\n")) {
-    let scope = "";
-    if (scoped) {
-      const m = line.match(/^(\s*)([\w-]+):/);
-      if (m) {
-        const ind = m[1].length;
-        while (stack.length && stack[stack.length - 1].ind >= ind) stack.pop();
-        stack.push({ ind, key: m[2] });
-      }
-      scope = [...stack.slice(0, -1)].reverse().find((s) => /^(?:project|patch|changes)$/.test(s.key))?.key ?? "";
+    const m = line.match(/^(\s*)([\w-]+):/);
+    if (m) {
+      const ind = m[1].length;
+      while (stack.length && stack[stack.length - 1].ind >= ind) stack.pop();
+      stack.push({ ind, key: m[2] });
     }
+    const scope = [...stack.slice(0, -1)].reverse().find((s) => /^(?:project|patch|changes)$/.test(s.key))?.key ?? "";
+    yield [line, scope];
+  }
+}
+function scopedKeys(src, key2) {
+  const out2 = [];
+  for (const [line, scope] of scopedLines(src)) if (key2.test(line)) out2.push(scope);
+  return out2;
+}
+function numbersOf(src, key2, scoped = false) {
+  const out2 = [];
+  for (const [line, inScope] of scopedLines(src)) {
+    const scope = scoped ? inScope : "";
     if (key2.global) {
       for (const m of line.matchAll(key2)) out2.push({ v: numOf(m[1]), scope });
     } else {
@@ -1645,6 +1702,9 @@ function simpleNarrowings(path, before, after) {
     const off2 = (s) => new Set(s.split("\n").map((l) => l.match(/^\s*(project|patch):\s*off\b/)?.[1]).filter((x) => !!x));
     const had = off2(before);
     for (const s of off2(after)) if (!had.has(s)) out2.push(`codecov status.${s} switched off`);
+    const informational = (s) => new Set(scopedKeys(s, /^\s*informational:\s*true\b/).filter((scope) => scope !== "patch" && scope !== "changes"));
+    const was = informational(before);
+    for (const scope of informational(after)) if (!was.has(scope)) out2.push(`codecov ${scope || "project"} status informational: true added \u2014 the status can no longer fail`);
   }
   return out2;
 }
@@ -1688,13 +1748,14 @@ var SWITCHES = [
     re: /"?check-coverage"?\s*[:=]\s*false\b/,
     message: "check-coverage: false \u2014 nyc will no longer fail on the thresholds.",
     remediation: "Keep check-coverage on; raise real coverage instead."
-  },
-  {
-    re: /^\s*informational:\s*true\b/,
-    message: "informational: true added \u2014 the codecov status can no longer fail.",
-    remediation: "Remove informational; a status that cannot fail is not a gate."
   }
 ];
+function dirHasSpec(configPath, policy, ctx) {
+  const files = trackedFiles(ctx);
+  if (!files) return null;
+  const root = configPath.includes("/") ? configPath.slice(0, configPath.lastIndexOf("/") + 1) : "";
+  return files.some((f) => f.startsWith(root) && isProtected(f, policy, "tests"));
+}
 var isJsConfig = (path) => /\.(?:[cm]?[jt]sx?|json)$/.test(path);
 function gateMovedElsewhere(c, changes, policy) {
   const before = c.before ?? "";
@@ -1787,6 +1848,7 @@ var coverageLowering = {
         for (const s of SWITCHES) {
           if (!s.re.test(l.content)) continue;
           if (removed.some((r) => s.re.test(r.content))) continue;
+          if (/passWithNoTests/.test(s.re.source) && dirHasSpec(c.path, policy, ctx) === false) continue;
           out2.push(
             makeFinding(RULE4, policy, {
               file: c.path,
@@ -1838,7 +1900,7 @@ var RULE5 = "ci-tampering";
 var USES = /^\s*-\s*uses:/;
 var CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|playwright|coverage|tamperward)\b/i;
 var YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
-var INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward)\b/;
+var INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint|node\s+--test|biome\s+(?:ci|check|lint)|deno\s+(?:test|lint|check)|ruff\s+check)\b/;
 var INVOKES_SCRIPT = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|tests|lint|typecheck|type-check|coverage)\b|\b(?:make|cargo|go)\s+test\b|\bgradle\w*\s+(?:test|check)\b/;
 function isActiveWorkflow(path) {
   return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
@@ -1847,8 +1909,19 @@ var invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line
 function commandCore(line) {
   return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
 }
+function foldExpressions(s) {
+  return s.replace(/\$\{\{([^}]*)\}\}/g, (_m, e) => {
+    const v = foldConst(e.trim());
+    if (v !== void 0 && v !== TRUTHY) return String(v);
+    return /\b(?:matrix|strategy|inputs)\./.test(e) ? MATRIX_TOKEN : EXPR_TOKEN;
+  });
+}
+var EXPR_TOKEN = "__expr__";
+var MATRIX_TOKEN = "__matrix__";
+var MATRIX_FLAG = new RegExp(`(?:^|\\s)-{1,2}[\\w-]+(?:=|\\s+)${MATRIX_TOKEN}(?:/\\S*)?(?=\\s|$)`, "g");
 function canonical(core) {
-  let s = core.replace(/^(['"])(.*)\1$/, "$2").trim();
+  let s = foldExpressions(core.replace(/^(['"])(.*)\1$/, "$2").trim()).replace(MATRIX_FLAG, " ").replace(/\s+/g, " ").trim();
+  s = s.replace(/^(?:cd|pushd)\s+\S+\s*&&\s*/, "");
   s = s.replace(/^(?:npx|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx)|bunx|bun\s+x)\s+/, "exec ");
   s = s.replace(/^(?:npm|pnpm|yarn|bun)\s+(?:run(?:-script)?\s+)?/, "exec ");
   s = s.replace(/^exec\s+(?:t|tst)(?=\s|$)/, "exec test");
@@ -1878,8 +1951,8 @@ function checkKind(core) {
   if (!invokesCheck(core)) return null;
   const s = canonical(core);
   if (/\btamperward\b/.test(s)) return "gate";
-  if (/\b(?:lint|eslint)\b/i.test(s)) return "lint";
-  if (/\b(?:typecheck|type-check|tsc)\b/i.test(s)) return "types";
+  if (/\b(?:lint|eslint|biome|oxlint|golangci-lint|ruff)\b/i.test(s)) return "lint";
+  if (/\b(?:typecheck|type-check|tsc|tsgo|mypy)\b|\bdeno\s+check\b/i.test(s)) return "types";
   return "test";
 }
 function survives(removedCore, isUses, afterCores, addedCores) {
@@ -1888,13 +1961,15 @@ function survives(removedCore, isUses, afterCores, addedCores) {
     return afterCores.some((a) => usesRef(a) === ref) ? { state: "kept" } : { state: "gone" };
   }
   const r = canonical(removedCore);
+  const kind = checkKind(removedCore);
+  const narrowed = (args) => kind === "test" && narrowedByPositional(args);
   let neutralised;
   for (const raw of afterCores) {
     const a = canonical(raw);
     if (a === r) return { state: "kept" };
     if (a.startsWith(r + " ")) {
       const rest = a.slice(r.length);
-      if (NEUTRALISING_SUFFIX.test(rest) || narrowedByPositional(rest)) neutralised ??= raw;
+      if (NEUTRALISING_SUFFIX.test(rest) || narrowed(rest)) neutralised ??= raw;
       else return { state: "kept" };
     } else if (r.startsWith(a + " ") && invokesCheck(a)) {
       return { state: "kept" };
@@ -1903,7 +1978,6 @@ function survives(removedCore, isUses, afterCores, addedCores) {
       if (w && (canonical(w[1]) === r || canonical(w[1]).startsWith(r + " "))) neutralised ??= raw;
     }
   }
-  const kind = checkKind(removedCore);
   let respelled = false;
   for (const raw of addedCores) {
     if (!kind || checkKind(raw) !== kind) continue;
@@ -1913,7 +1987,7 @@ function survives(removedCore, isUses, afterCores, addedCores) {
       continue;
     }
     const args = a.slice(a.indexOf(" ") + 1 || a.length);
-    if (a.includes(" ") && (NEUTRALISING_SUFFIX.test(" " + args) || narrowedByPositional(args))) neutralised ??= raw;
+    if (a.includes(" ") && (NEUTRALISING_SUFFIX.test(" " + args) || narrowed(args))) neutralised ??= raw;
     else respelled = true;
   }
   if (respelled) return { state: "kept" };
@@ -2085,6 +2159,7 @@ function isTruthy(raw) {
   const f = foldConst(m[1]);
   return f !== void 0 && truthy(f);
 }
+var SHELL_ERREXIT = /(?:^|\s)-[a-zA-Z]*e[a-zA-Z]*(?:\s|$)|-o\s+errexit\b/;
 var indentOf = (l) => l.match(/^\s*/)[0].length;
 var STEP_START = /^\s*-\s+(?:name|uses|run|if|id|with|env|shell|continue-on-error|working-directory|timeout-minutes):/;
 function stepOf(lines, i) {
@@ -2110,8 +2185,10 @@ function jobOf(lines, i) {
   while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > hi)) e++;
   return [h, e];
 }
-var stepHasCheck = (lines, range) => range === null || lines.slice(range[0], range[1]).some((l) => invokesCheck(l) || USES.test(l) && CHECK.test(l));
-var jobHasCheck = (lines, range) => lines.slice(range[0], range[1]).some((l) => invokesCheck(l) || USES.test(l) && CHECK.test(l) || /^\s*uses:\s*\S/.test(l));
+var REPORTER_ACTION = /^\s*-?\s*uses:\s*\S*?(?:[\w-]*-reporter|[\w-]*-results?[\w-]*|upload-[\w-]*|codecov[\w-]*|coveralls[\w-]*)(?:@|\s|$)/i;
+var usesCheck = (l) => USES.test(l) && CHECK.test(l) && !REPORTER_ACTION.test(l);
+var stepHasCheck = (lines, range) => range === null || lines.slice(range[0], range[1]).some((l) => invokesCheck(l) || usesCheck(l));
+var jobHasCheck = (lines, range) => lines.slice(range[0], range[1]).some((l) => invokesCheck(l) || usesCheck(l) || /^\s*uses:\s*\S/.test(l));
 function runBlocks(lines) {
   const out2 = [];
   for (let i = 0; i < lines.length; i++) {
@@ -2256,7 +2333,8 @@ function triggerNarrowings(before, after, opts) {
     const now = after.branches.get(e);
     if (!now || !after.events.has(e)) continue;
     if (now.some(ALL)) continue;
-    const lostDefault = namesDefault(was) && !namesDefault(now);
+    const renamed = (b) => DEFAULT_BRANCH.test(b) && opts.hasBranch(b) !== false;
+    const lostDefault = namesDefault(was) && !namesDefault(now) && !now.some(renamed);
     const replaced = !namesDefault(was) && !namesDefault(now) && was.length > 0 && !was.some((b) => now.includes(b));
     if (lostDefault || replaced) out2.push(`on.${e}.branches no longer names ${was.filter((b) => !now.includes(b)).join(", ")} (now [${now.join(", ")}])`);
   }
@@ -2342,6 +2420,7 @@ var ciTampering = {
         }
         for (const l of addedLines(c)) {
           if (!/^\s*-?\s*shell:\s*.*\{0\}/.test(l.content) || l.newLine == null) continue;
+          if (SHELL_ERREXIT.test(uncommented(l.content.replace(/^\s*-?\s*shell:\s*/, "")))) continue;
           const step = stepOf(afterLines, l.newLine - 1);
           if (step && !stepHasCheck(afterLines, step)) continue;
           out2.push(
@@ -2355,7 +2434,7 @@ var ciTampering = {
           );
         }
         if (c.before != null) {
-          triggerOpts ??= { defaultBranch: defaultBranch(ctx), sources: sourceProbes(ctx) };
+          triggerOpts ??= { defaultBranch: defaultBranch(ctx), sources: sourceProbes(ctx), hasBranch: (b) => branchExists(b, ctx) };
           for (const reason of triggerNarrowings(parseTriggers(c.before), parseTriggers(c.after), triggerOpts)) {
             out2.push(
               makeFinding(RULE5, policy, {
@@ -2380,7 +2459,7 @@ var ciTampering = {
       }
       for (const l of removedLines(c)) {
         if (/^\s*#/.test(l.content)) continue;
-        const isUsesLine = USES.test(l.content) && CHECK.test(l.content);
+        const isUsesLine = usesCheck(l.content);
         const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck(l.content);
         if (!isUsesLine && !isCheckCommand) continue;
         const s = survives(commandCore(l.content), isUsesLine, afterCores, addedCores);
@@ -4442,21 +4521,20 @@ function collect(root, runner) {
     const entries = take(key2, e).map((pattern) => ({ pattern, key: key2 }));
     sel.ignore = [...sel.ignore ?? [], ...entries];
   };
+  let projectList = null;
   const projects = (e) => {
     sel.present = true;
-    if (!ts3.isArrayLiteralExpression(e)) {
+    projectList = e;
+  };
+  const visit = (node) => {
+    if (ts3.isSpreadAssignment(node) && spreadsIntoConfig(node, runner)) {
+      sel.present = true;
       sel.opaque = true;
-      return;
     }
-    const list2 = [];
-    for (const el of e.elements) {
-      if (ts3.isObjectLiteralExpression(el)) list2.push(collect(el, runner));
-      else sel.opaque = true;
+    if (ts3.isCallExpression(node) && /^(?:\w+\.)?mergeConfig$/.test(node.expression.getText()) && node.arguments[0] && !ts3.isObjectLiteralExpression(unwrapConfigCall(node.arguments[0]))) {
+      sel.present = true;
+      sel.opaque = true;
     }
-    sel.projects = list2;
-    if (list2.some((p) => p.opaque)) sel.opaque = true;
-  };
-  const visit = (node) => {
     if (ts3.isPropertyAssignment(node)) {
       const k = keyName2(node.name);
       if (runner === "jest") {
@@ -4476,7 +4554,7 @@ function collect(root, runner) {
       } else if (ownerKey2(node) === "test") {
         if (k === "include") sel.include = take(k, node.initializer);
         else if (k === "exclude") ignores(k, node.initializer);
-        else if (k === "dir") {
+        else if (k === "dir" || k === "root") {
           const { dir, opaque } = dirValue(node.initializer);
           sel.present = true;
           if (opaque) sel.opaque = true;
@@ -4490,8 +4568,68 @@ function collect(root, runner) {
     ts3.forEachChild(node, visit);
   };
   visit(root);
+  if (projectList) sel.projects = readProjects(projectList, sel, runner);
+  if (sel.projects?.some((p) => p.opaque)) sel.opaque = true;
   return sel;
 }
+function unwrapConfigCall(e) {
+  let x = e;
+  while (ts3.isParenthesizedExpression(x) || ts3.isAsExpression(x) || x.kind === ts3.SyntaxKind.SatisfiesExpression) {
+    x = x.expression;
+  }
+  if (ts3.isCallExpression(x) && /^(?:\w+\.)?define(?:Config|Project)$/.test(x.expression.getText()) && x.arguments[0]) return unwrapConfigCall(x.arguments[0]);
+  return x;
+}
+var JEST_SELECTION_KEYS = /^(?:testMatch|testRegex|testPathIgnorePatterns|modulePathIgnorePatterns|roots|rootDir|projects)$/;
+function spreadsIntoConfig(node, runner) {
+  const obj = node.parent;
+  if (!ts3.isObjectLiteralExpression(obj)) return false;
+  const keys = obj.properties.map((p) => ts3.isPropertyAssignment(p) ? keyName2(p.name) : null);
+  if (runner === "vitest") {
+    if (keys.includes("test")) return true;
+    let q = obj.parent;
+    while (q && (ts3.isParenthesizedExpression(q) || ts3.isAsExpression(q) || q.kind === ts3.SyntaxKind.SatisfiesExpression)) q = q.parent;
+    return !!q && ts3.isPropertyAssignment(q) && keyName2(q.name) === "test";
+  }
+  return keys.some((k) => k !== null && JEST_SELECTION_KEYS.test(k));
+}
+function extendsOf(el) {
+  for (const p of el.properties) {
+    if (!ts3.isPropertyAssignment(p) || keyName2(p.name) !== "extends") continue;
+    if (p.initializer.kind === ts3.SyntaxKind.TrueKeyword) return true;
+    if (p.initializer.kind === ts3.SyntaxKind.FalseKeyword) return null;
+    return "path";
+  }
+  return null;
+}
+function readProject(el, root, runner) {
+  const p = collect(el, runner);
+  const ext = extendsOf(el);
+  if (ext === "path") p.opaque = true;
+  else if (ext === true && root) {
+    p.include ??= root.include;
+    p.regex ??= root.regex;
+    p.ignore ??= root.ignore;
+    p.roots ??= root.roots;
+    p.base ??= root.base;
+    if (root.opaque) p.opaque = true;
+  }
+  p.present = true;
+  return p;
+}
+function readProjects(e, root, runner) {
+  if (!ts3.isArrayLiteralExpression(e)) {
+    root.opaque = true;
+    return [];
+  }
+  const list2 = [];
+  for (const el of e.elements) {
+    const lit = unwrapConfigCall(el);
+    if (ts3.isObjectLiteralExpression(lit)) list2.push(readProject(lit, root, runner));
+    else root.opaque = true;
+  }
+  return list2;
+}
 function workspaceArray(sf) {
   for (const st of sf.statements) {
     let e;
@@ -4513,14 +4651,9 @@ function parseSelection(src, runner, path = "") {
     if (runner === "vitest" && isWorkspaceFile(path)) {
       const arr = workspaceArray(sf);
       if (arr) {
-        const list2 = [];
-        for (const el of arr.elements) {
-          if (ts3.isObjectLiteralExpression(el)) list2.push(collect(el, runner));
-          else sel.opaque = true;
-        }
-        sel.projects = list2;
+        sel.projects = readProjects(arr, sel, runner);
         sel.present = true;
-        if (list2.some((p) => p.opaque)) sel.opaque = true;
+        if (sel.projects.some((p) => p.opaque)) sel.opaque = true;
       } else if (src.trim()) sel.opaque = true;
     } else sel = collect(sf, runner);
   } catch {
@@ -4580,8 +4713,8 @@ function predicate(sel, runner) {
       if (!inRoots(r)) return `roots no longer covers it (${JSON.stringify(sel.roots)})`;
       const hit = ignoredBy(r);
       if (hit) return `${hit.key === "exclude" ? "test.exclude" : hit.key} now matches it (${JSON.stringify(hit.pattern)})`;
-      const key2 = sel.include ? runner === "jest" ? "testMatch" : "test.include" : "testRegex";
-      return `${key2} no longer matches it (${JSON.stringify(sel.include ?? sel.regex ?? [])})`;
+      const key2 = runner === "jest" ? sel.include ? "testMatch" : sel.regex ? "testRegex" : "testMatch (default)" : sel.include ? "test.include" : "test.include (default)";
+      return `${key2} no longer matches it (${JSON.stringify(sel.include ?? sel.regex ?? includeList ?? [])})`;
     }
   };
 }
@@ -4620,8 +4753,21 @@ function calleeName(expr) {
   }
   return null;
 }
-var isEachOf = (expr) => ts4.isPropertyAccessExpression(expr) && ts4.isIdentifier(expr.expression) && (expr.expression.text === "it" || expr.expression.text === "test") && expr.name.text === "each";
-var isDescribeEach = (expr) => ts4.isPropertyAccessExpression(expr) && ts4.isIdentifier(expr.expression) && expr.expression.text === "describe" && expr.name.text === "each";
+var TABLE_METHOD = /^(?:each|for)$/;
+var isEachOf = (expr) => ts4.isPropertyAccessExpression(expr) && ts4.isIdentifier(expr.expression) && (expr.expression.text === "it" || expr.expression.text === "test") && TABLE_METHOD.test(expr.name.text);
+var isDescribeEach = (expr) => ts4.isPropertyAccessExpression(expr) && ts4.isIdentifier(expr.expression) && expr.expression.text === "describe" && TABLE_METHOD.test(expr.name.text);
+function loopRows(iterable) {
+  if (ts4.isArrayLiteralExpression(iterable)) {
+    let n = 0;
+    let open = false;
+    for (const el of iterable.elements) {
+      if (ts4.isSpreadElement(el)) open = true;
+      else n++;
+    }
+    return { n: Math.max(n, open ? 0 : 1), open };
+  }
+  return { n: 1, open: true };
+}
 function templateRows(node) {
   const rows = node.template.getText().split("\n").filter((l) => /\S/.test(l.replace(/[`]/g, ""))).length - 1;
   return Math.max(rows, 1);
@@ -4659,7 +4805,23 @@ function countTests(src, path = "spec.ts", substantiveOnly = false) {
   let n = 0;
   let open = false;
   const visit = (node, mult) => {
+    if (ts4.isForOfStatement(node)) {
+      const r = loopRows(node.expression);
+      if (r.open) open = true;
+      visit(node.statement, mult * r.n);
+      return;
+    }
+    if (ts4.isForStatement(node) || ts4.isForInStatement(node) || ts4.isWhileStatement(node) || ts4.isDoStatement(node)) {
+      open = true;
+    }
     if (ts4.isCallExpression(node)) {
+      const callee = node.expression;
+      if (ts4.isPropertyAccessExpression(callee) && callee.name.text === "forEach") {
+        const r = loopRows(callee.expression);
+        if (r.open) open = true;
+        for (const a of node.arguments) visit(a, mult * r.n);
+        return;
+      }
       const head = node.expression;
       if (ts4.isCallExpression(head) && isDescribeEach(head.expression)) {
         const r = eachRows(head);
@@ -4707,6 +4869,12 @@ function runnerSamples(configPath, policy, ctx) {
   const own = files.filter((f) => f.startsWith(root) && langOf(f) === "js" && isProtected(f, policy, "tests") && !OTHER_RUNNER_DIR.test(f)).map((f) => f.slice(root.length));
   return own.length ? own : CANONICAL_SAMPLES;
 }
+var WHOLE_SUITE_SCRIPT = /^test(?::ci)?$/;
+function excludesOtherRunner(flag, cmd) {
+  if (flag !== "--exclude") return false;
+  const values = [...cmd.matchAll(/--exclude(?:=|\s+)(['"]?)(\S+?)\1(?=\s|$)/g)].map((m) => m[2]);
+  return values.length > 0 && values.every((v) => OTHER_RUNNER_DIR.test(v.replace(/^\.\//, "").replace(/(?:\/\*+)*\/?$/, "") + "/"));
+}
 function scriptNarrowings(before, after, path) {
   if ((path.split("/").pop() ?? path) !== "package.json") return [];
   const scriptsOf = (src) => {
@@ -4721,7 +4889,7 @@ function scriptNarrowings(before, after, path) {
   const now = scriptsOf(after);
   const out2 = [];
   for (const [name, cmd] of Object.entries(now)) {
-    if (!/^test(?:$|[:.-])/.test(name) || !/\b(?:jest|vitest)\b/.test(cmd)) continue;
+    if (!WHOLE_SUITE_SCRIPT.test(name) || !/\b(?:jest|vitest)\b/.test(cmd)) continue;
     const prev = was[name] ?? "";
     const flags = new RegExp(SUITE_NARROWING_FLAGS.source, "g");
     for (const m of cmd.matchAll(flags)) {
@@ -4729,6 +4897,7 @@ function scriptNarrowings(before, after, path) {
       if (!flag) continue;
       const one = new RegExp(SUITE_NARROWING_FLAGS.source);
       if (one.test(prev) && prev.includes(flag)) continue;
+      if (excludesOtherRunner(flag, cmd)) continue;
       out2.push({ script: name, flag, before: prev, after: cmd });
       break;
     }
@@ -4760,10 +4929,11 @@ var testDeletion = {
   certainty: "mechanical",
   run(changes, policy, _view, ctx) {
     const out2 = [];
+    const isSpec = (p) => isProtected(p, policy, "tests") && !isProtected(p, policy, "snapshots");
     const addedTestLines = /* @__PURE__ */ new Set();
     let addedTestBlocks = 0;
     for (const c of changes) {
-      if (c.kind !== "file" || c.after == null || !isProtected(c.path, policy, "tests")) continue;
+      if (c.kind !== "file" || c.after == null || !isSpec(c.path)) continue;
       if (c.op === "add") {
         for (const l of significantLines(c.after, c.path)) addedTestLines.add(l);
         addedTestBlocks += countTests(c.after, c.path, true).min;
@@ -4781,7 +4951,7 @@ var testDeletion = {
     };
     for (const c of changes) {
       if (c.kind === "file") {
-        const isTest = isProtected(c.path, policy, "tests");
+        const isTest = isSpec(c.path);
         if (c.op === "delete" && isTest) {
           if (c.before != null && isRelocation(significantLines(c.before, c.path), countTestBlocks(c.before, c.path))) continue;
           out2.push(
@@ -4792,7 +4962,7 @@ var testDeletion = {
               remediation: "Fix the code under test, not the suite. Deleting a failing test to pass is the move this blocks."
             })
           );
-        } else if (c.op === "rename" && c.oldPath && isProtected(c.oldPath, policy, "tests") && !isTest) {
+        } else if (c.op === "rename" && c.oldPath && isSpec(c.oldPath) && !isTest) {
           out2.push(
             makeFinding(RULE7, policy, {
               file: c.path,
@@ -4853,22 +5023,22 @@ var testDeletion = {
           const testToks = toks.filter((t) => {
             const resolved = root !== null && /(?:^|\/)\.{1,2}(?:\/|$)/.test(t) ? joinRoot(root, t) : null;
             const probe = resolved ?? t;
-            if (!isProtected(probe, policy, "tests")) return false;
+            if (!isSpec(probe)) return false;
             if (!listing || root === null) return true;
             const looksLikeFile = /\.[A-Za-z0-9]+$/.test(probe.split("/").pop() ?? "");
             if (looksLikeFile || listing.includes(resolved ?? inRepo(t))) return true;
-            return containsProtected(resolved ?? inRepo(t), policy, "tests", ctx);
+            return containsProtected(resolved ?? inRepo(t), policy, "tests", ctx, "snapshots");
           });
-          const rootHasProtected = () => listing ? listing.some((f) => isProtected(f, policy, "tests")) : true;
+          const rootHasProtected = () => listing ? listing.some(isSpec) : true;
           const dirToks = toks.filter((t) => {
             if (t.startsWith("-") || testToks.includes(t)) return false;
             const whole = /^(?:\.|\.\/|\*|\.\/\*)$/.test(t);
             if (!whole && /[*?{}[\]]/.test(t)) return false;
-            if (root === null) return whole ? false : containsProtected(t, policy, "tests", ctx);
+            if (root === null) return whole ? false : containsProtected(t, policy, "tests", ctx, "snapshots");
             const dir = whole ? root : joinRoot(root, t);
             if (dir === null) return false;
             if (dir === "") return rootHasProtected();
-            return containsProtected(dir, policy, "tests", ctx);
+            return containsProtected(dir, policy, "tests", ctx, "snapshots");
           });
           if (testToks.length === 0 && dirToks.length === 0) continue;
           const named = [...testToks, ...dirToks];
@@ -4876,13 +5046,13 @@ var testDeletion = {
           let why = null;
           let evidence = seg;
           const redirectTarget = seg.match(/>\s*(\S+)/)?.[1];
-          const redirectsOntoTest = redirectTarget ? isProtected(unquote(redirectTarget), policy, "tests") : false;
+          const redirectsOntoTest = redirectTarget ? isSpec(unquote(redirectTarget)) : false;
           const findDeletes = cmd === "find" && /\s(?:-delete\b|-exec\s+(?:rm|unlink)\b|-execdir\s+(?:rm|unlink)\b)/.test(seg);
           const gitRestoresOld = cmd === "git" && /^git\s+(?:checkout|restore)\b/.test(seg) && (() => {
             const src = seg.match(/--source[= ]\s*(\S+)/)?.[1];
             const revIdx = toks.findIndex((t, i) => i >= 2 && !t.startsWith("-") && !named.includes(t) && t !== "--");
             const rev = src ?? (revIdx >= 0 ? toks[revIdx] : void 0);
-            if (!rev || rev === "HEAD") return false;
+            if (!rev || rev === "HEAD" || rev === "@" || revIsHead(rev, ctx) === true) return false;
             if (src || seg.includes(" -- ")) return true;
             return revIdx >= 0 && toks.some((t, i) => i > revIdx && named.includes(t));
           })();
@@ -4898,7 +5068,7 @@ var testDeletion = {
             why = "truncate empties a test file";
           } else if (redirectsOntoTest) {
             why = "a redirect overwrites/empties a test file";
-          } else if (cmd === "cp" && testToks.length > 0 && isProtected(toks[toks.length - 1] ?? "", policy, "tests") && !isProtected(toks[toks.length - 2] ?? "", policy, "tests")) {
+          } else if (cmd === "cp" && testToks.length > 0 && isSpec(toks[toks.length - 1] ?? "") && !isSpec(toks[toks.length - 2] ?? "")) {
             why = "cp overwrites a test file with something else";
           } else if (cmd === "tee" && !toks.includes("-a") && !toks.includes("--append")) {
             why = "tee overwrites a test file";
@@ -4908,7 +5078,7 @@ var testDeletion = {
             why = "git checkout <rev> replaces a test file with an older version";
           } else if (/\bmv\b/.test(seg)) {
             const dest = toks[toks.length - 1];
-            if (dest && testToks.length > 0 && !isProtected(dest, policy, "tests")) {
+            if (dest && testToks.length > 0 && !isSpec(dest)) {
               why = "mv renames a test file out of the test glob";
               evidence = `${testToks[0]} \u2192 ${dest}`;
             } else if (dest && testToks.length === 0 && dirToks[0] !== dest && leavesGlob(dirToks[0] ?? "", dest, policy, ctx)) {
@@ -4945,7 +5115,7 @@ function eachTables(src, path) {
   try {
     const sf = ts5.createSourceFile("spec.ts", src, ts5.ScriptTarget.Latest, true, ts5.ScriptKind.TS);
     const visit = (node) => {
-      if (ts5.isCallExpression(node) && ts5.isPropertyAccessExpression(node.expression) && node.expression.name.text === "each" && ts5.isIdentifier(node.expression.expression) && /^(?:it|test|describe)$/.test(node.expression.expression.text)) {
+      if (ts5.isCallExpression(node) && ts5.isPropertyAccessExpression(node.expression) && /^(?:each|for)$/.test(node.expression.name.text) && ts5.isIdentifier(node.expression.expression) && /^(?:it|test|describe)$/.test(node.expression.expression.text)) {
         const arg = node.arguments[0];
         if (arg && ts5.isArrayLiteralExpression(arg)) {
           for (const el of arg.elements) {
@@ -4966,6 +5136,7 @@ function eachTables(src, path) {
   }
   return { rows, open };
 }
+var TEST_DIR_FILE = /(?:^|\/)(?:test|tests|__tests__|spec|specs)\//;
 function significantLinesOrdered(src, path) {
   const out2 = [];
   const lang = langOf(path);
@@ -4986,11 +5157,14 @@ var testContentRemoval = {
     for (const c of changes) {
       if (c.kind !== "file" || c.after == null) continue;
       if (isProtected(c.path, policy, "tests")) keptPool += ws(significantLinesOrdered(c.after, c.path).join("\n"));
-      if (c.op === "add") addedPool += ws(c.after);
+      let addedHere = "";
+      if (c.op === "add") addedHere = ws(c.after);
       else if (c.before != null) {
         const had = new Set(c.before.split("\n").map((l) => l.trim()));
-        addedPool += ws(c.after.split("\n").filter((l) => !had.has(l.trim())).join("\n"));
+        addedHere = ws(c.after.split("\n").filter((l) => !had.has(l.trim())).join("\n"));
       }
+      addedPool += addedHere;
+      if (!isProtected(c.path, policy, "tests") && TEST_DIR_FILE.test(c.path) && langOf(c.path) === "js") keptPool += addedHere;
     }
     for (const c of changes) {
       if (c.kind !== "file" || c.op !== "modify" && c.op !== "rename" || c.before == null || c.after == null) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",