testguard-cli 0.18.3 → 0.20.0

package/src/replay/replay.mjs

@@ -2,7 +2,7 @@ import { resetInterpreterCache } from '../probe/runners/python.mjs';
 import { existsSync, rmSync, realpathSync } from 'node:fs';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { git, GitError, repoRoot, headSha } from '../git.mjs';
+import { git, GitError, NO_HOOKS, repoRoot, headSha } from '../git.mjs';
 import { createScratch, PreconditionError } from '../probe/worktree.mjs';
 import { selectRunner, discoverRunnerManifest, RUNNERS, OWNED_RUNNERS, mergeRuns } from '../probe/runners/index.mjs';
 import { parseCommandTemplate } from '../probe/runners/shared.mjs';
@@ -90,6 +90,7 @@ export async function replay({
   runnerCommand,
   runnerName = 'auto',
   nodeModules,
+  python,
   scratchBase,
   limit,
   toolVersion = '0.0.0',
@@ -123,7 +124,7 @@ export async function replay({
       let universe;
       if (!commandTemplate) {
         const budgetFor = () => commandBudget?.runBudget(budgetMs) ?? budgetMs;
-        const sel = await selectRunner({ projectDir: iso.projectDir, sourceDir: projectDir, name: runnerName, budgetMs: budgetFor(), budgetFor });
+        const sel = await selectRunner({ projectDir: iso.projectDir, sourceDir: projectDir, python, name: runnerName, budgetMs: budgetFor(), budgetFor });
         commandBudget?.assertOpen();
         if (sel.error) throw new PreconditionError(`test runner is not resolvable in the scratch worktree (${sel.error}). Pass --node-modules <path>.`);
         runnerUsed = sel.runner;
@@ -135,7 +136,7 @@ export async function replay({
         const primaryIsPython = ['python', 'pytest', 'unittest'].includes(runnerUsed.name);
         const owned = OWNED_RUNNERS.filter((candidate) => candidate !== runnerUsed && !(candidate.name === 'python' && primaryIsPython));
         for (const candidate of owned) {
-          const check = await candidate.check({ projectDir: iso.projectDir, sourceDir: projectDir, budgetMs: budgetFor(), budgetFor });
+          const check = await candidate.check({ projectDir: iso.projectDir, sourceDir: projectDir, python, budgetMs: budgetFor(), budgetFor });
           commandBudget?.assertOpen();
           if (!check.ok) continue;
           try {
@@ -146,7 +147,7 @@ export async function replay({
         }
         universe = buildReplayRunnerUniverse(runnerUsed, manifests);
       }
-      const record = await replayOne({ fix, iso, root, projectDir, confirmRuns, budgetMs, commandBudget, workers, serial, commandTemplate, runner: runnerUsed, universe, onStage, index: i + 1, total: selected.length });
+      const record = await replayOne({ fix, iso, root, projectDir, python, confirmRuns, budgetMs, commandBudget, workers, serial, commandTemplate, runner: runnerUsed, universe, onStage, index: i + 1, total: selected.length });
       records.push(record);
       onProgress(record);
     } finally {
@@ -213,7 +214,7 @@ export function partitionReplayDefenders(files, primary, universe) {
   return groups;
 }
 
-async function replayOne({ fix, iso, root, projectDir, confirmRuns, budgetMs, commandBudget, workers, serial, commandTemplate, runner, universe, onStage, index, total }) {
+async function replayOne({ fix, iso, root, projectDir, python, confirmRuns, budgetMs, commandBudget, workers, serial, commandTemplate, runner, universe, onStage, index, total }) {
   // git reports paths from the REPOSITORY root; the runner and every file
   // operation here work inside the scratch worktree, relative to the PROJECT
   // directory. Map once, and refuse anything that would land outside the
@@ -262,7 +263,7 @@ async function replayOne({ fix, iso, root, projectDir, confirmRuns, budgetMs, co
     return { ...base, faultClass, verdict: 'unverifiable', reason: 'no-prior-version', runs: [{ outcome: 'error', durationMs: 0 }] };
   }
   try {
-    if (existedBefore.length) git(['checkout', `${fix.commit}^`, '--', ...existedBefore.map(rel)], iso.projectDir);
+    if (existedBefore.length) git([...NO_HOOKS, 'checkout', `${fix.commit}^`, '--', ...existedBefore.map(rel)], iso.projectDir);
     for (const f of addedByTheFix) {
       const abs = join(iso.projectDir, rel(f));
       if (existsSync(abs)) rmSync(inside(abs), { force: true });
@@ -329,12 +330,12 @@ async function replayOne({ fix, iso, root, projectDir, confirmRuns, budgetMs, co
       // A custom command is one explicit execution boundary. Preserve that
       // contract exactly; TestGuard cannot infer several native engines from
       // an opaque user command.
-      res = await runner.run({ projectDir: iso.projectDir, sourceDir: projectDir, files: related, budgetMs: commandBudget?.runBudget(budgetMs) ?? budgetMs, commandTemplate, workers, serial });
+      res = await runner.run({ projectDir: iso.projectDir, sourceDir: projectDir, python, files: related, budgetMs: commandBudget?.runBudget(budgetMs) ?? budgetMs, commandTemplate, workers, serial });
     } else {
       const parts = [];
       for (const [configuredRunner, files] of partitionReplayDefenders(related, runner, universe)) {
         commandBudget?.assertOpen();
-        parts.push(await configuredRunner.run({ projectDir: iso.projectDir, sourceDir: projectDir, files, budgetMs: commandBudget?.runBudget(budgetMs) ?? budgetMs, workers, serial }));
+        parts.push(await configuredRunner.run({ projectDir: iso.projectDir, sourceDir: projectDir, python, files, budgetMs: commandBudget?.runBudget(budgetMs) ?? budgetMs, workers, serial }));
         commandBudget?.assertOpen();
       }
       res = mergeRuns(parts);

package/src/supply/concerns.mjs

@@ -27,9 +27,10 @@
  * look; the probe says what it found; a human states the sentence worth
  * defending. Nothing here is written to `testguard.claims.json`.
  */
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { saveSurface } from './savepath.mjs';
+import { readSpecDoc } from '../evidence/writer.mjs';
 import { globToRegExp, walk } from '../util/glob.mjs';
 
 export const defaultConcernsPath = (projectDir) => join(projectDir, 'testguard.concerns.json');
@@ -80,8 +81,13 @@ export function loadConcerns(projectDir, { path } = {}) {
   let project = [];
   let source = null;
   if (existsSync(p)) {
-    const doc = JSON.parse(readFileSync(p, 'utf8'));
-    project = doc.concerns ?? [];
+    // Through the spec reader, for every caller: a file that does not parse or
+    // does not conform is a SpecDocError naming the file (exit 2), never a
+    // crash reported as a bug in this tool — and never a concern sweep quietly
+    // aims at nothing. A glob concern with no globs matches no file, and a
+    // sweep over no file reports clean.
+    const doc = readSpecDoc('concerns', p);
+    project = doc.concerns;
     source = p;
   }
   const overridden = new Set(project.map((c) => c.id));
@@ -91,11 +97,11 @@ export function loadConcerns(projectDir, { path } = {}) {
   ];
   return {
     concerns,
-    // The project's own entries, exactly as written. Validation runs against
-    // these: the enriched objects above carry a `builtin` marker this tool
-    // added, and a schema that refuses unknown properties is right to reject
-    // them. Validating what we constructed instead of what the user wrote
-    // would report OUR bug as THEIR malformed file.
+    // The project's own entries, exactly as written — and as validated above,
+    // before enrichment: the objects in `concerns` carry a `builtin` marker
+    // this tool added, and a schema that refuses unknown properties is right to
+    // reject them. Validating what we constructed instead of what the user
+    // wrote would report OUR bug as THEIR malformed file.
     raw: project.map(({ builtin, ...c }) => c),
     source,
     shadowed: BUILTIN_CONCERNS.filter((c) => overridden.has(c.id)).map((c) => c.id),

package/src/sweep/sweep.mjs

@@ -169,6 +169,7 @@ export async function sweep({
   runnerCommand,
   runnerName,
   nodeModules,
+  python,
   toolVersion = '0.0.0',
   generatedAt = new Date().toISOString(),
   claimsPath,
@@ -274,6 +275,7 @@ export async function sweep({
       runnerCommand,
       runnerName,
       nodeModules,
+      python,
       toolVersion,
       onStage,
       onWarn,