attackmap 0.4.0__tar.gz → 0.4.2__tar.gz

{attackmap-0.4.0/src/attackmap.egg-info → attackmap-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.0
+Version: 0.4.2
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>

{attackmap-0.4.0 → attackmap-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.4.0"
+version = "0.4.2"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.4.0 → attackmap-0.4.2}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.4.0"
+__version__ = "0.4.2"

{attackmap-0.4.0 → attackmap-0.4.2}/src/attackmap/anomalies.py

@@ -36,10 +36,16 @@ from __future__ import annotations
 import re
 from dataclasses import dataclass
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 from .models import Anomaly, Route, ScanResult
 from .srcpaths import is_test_file
 
+if TYPE_CHECKING:
+    from .progress import JsonScanProgress, ScanProgress
+
+    _Progress = ScanProgress | JsonScanProgress
+
 
 @dataclass
 class _SignalCtx:
@@ -106,8 +112,17 @@ _MIN_GROUP = 3
 _SCAFFOLD_RE = re.compile(r"^(?:api|rest|graphql|gql|v\d+(?:beta\d*|alpha\d*)?)$", re.IGNORECASE)
 
 
-def find_anomalies(scan: ScanResult, root: str | Path | None = None) -> list[Anomaly]:
-    """Return within-repo consistency outliers for the routes in ``scan``."""
+def find_anomalies(
+    scan: ScanResult,
+    root: str | Path | None = None,
+    progress: "_Progress | None" = None,
+) -> list[Anomaly]:
+    """Return within-repo consistency outliers for the routes in ``scan``.
+
+    On a large route surface the per-cohort source-window reads dominate this
+    pass, so when a ``progress`` reporter is supplied it drives a determinate
+    bar over the cohorts (rather than an open-ended spinner).
+    """
     root_path = Path(root or scan.root).resolve()
 
     routes = [r for r in scan.routes if not is_test_file(r.file)]
@@ -129,8 +144,13 @@ def find_anomalies(scan: ScanResult, root: str | Path | None = None) -> list[Ano
 
     ctx = _SignalCtx(root_path, line_cache, file_route_lines)
 
+    if progress is not None:
+        progress.begin(len(groups), "Anomaly / outlier detection")
+
     out: list[Anomaly] = []
     for key, members in groups.items():
+        if progress is not None:
+            progress.advance(key)
         if len(members) < _MIN_GROUP:
             continue
         if not _is_route_like_cohort(key, members):

{attackmap-0.4.0 → attackmap-0.4.2}/src/attackmap/cli.py

@@ -25,7 +25,7 @@ from .diff import (
 )
 from .graph import build_graph
 from .llm_review import LlmReviewError, generate_llm_review
-from .progress import ScanProgress
+from .progress import create_progress
 from .recon_to_analysis import translate_recon
 from .report import render_console_summary, render_pr_comment, write_reports
 from .suggest import detect_ecosystems
@@ -124,6 +124,11 @@ def analyze(
         "--no-progress",
         help="Disable the live progress bar / ETA during scanning. Progress auto-disables when stderr isn't a terminal (CI, piped output).",
     ),
+    progress_format: str = typer.Option(
+        "auto",
+        "--progress-format",
+        help="Progress reporting: 'auto' (TTY bar when stderr is a terminal), 'json' (newline-delimited JSON events on stderr, for GUI/tool front-ends), or 'none'. --no-progress is equivalent to 'none'.",
+    ),
     pr_comment: str | None = typer.Option(
         None,
         "--pr-comment",
@@ -148,12 +153,18 @@ def analyze(
         except ValueError as exc:
             raise typer.BadParameter(str(exc)) from exc
 
+    if progress_format not in {"auto", "tty", "json", "none"}:
+        raise typer.BadParameter("--progress-format must be one of: auto, json, none.")
     active_analyzers = resolve_run_analyzers(repo_path, analyzers=selected_analyzers)
-    scan_progress = ScanProgress(enabled=not no_progress)
+    scan_progress = create_progress(progress_format, no_progress=no_progress)
     scan = analyze_repository(repo_path, analyzers=active_analyzers, progress=scan_progress)
     if cve and scan.dependencies:
         typer.echo(f"Checking {len(scan.dependencies)} dependencies against OSV.dev…")
-        vulns, cve_summary = query_vulnerabilities(scan.dependencies)
+        scan_progress.stage(f"Checking {len(scan.dependencies)} dependencies against OSV.dev")
+        try:
+            vulns, cve_summary = query_vulnerabilities(scan.dependencies)
+        finally:
+            scan_progress.done()
         scan.vulnerabilities = vulns
         typer.echo(
             f"CVE lookup: {len(vulns)} vulnerabilit"
@@ -250,15 +261,19 @@ def analyze(
             typer.echo(
                 f"Generating narrative review via Claude (backend={llm_backend}, may take a minute)..."
             )
-            result = generate_llm_review(
-                scan,
-                attack_surfaces,
-                findings,
-                attack_paths,
-                model=llm_model,
-                effort=effort_value,  # type: ignore[arg-type]
-                backend=llm_backend,  # type: ignore[arg-type]
-            )
+            scan_progress.stage(f"Claude is writing the defensive review (backend={llm_backend})")
+            try:
+                result = generate_llm_review(
+                    scan,
+                    attack_surfaces,
+                    findings,
+                    attack_paths,
+                    model=llm_model,
+                    effort=effort_value,  # type: ignore[arg-type]
+                    backend=llm_backend,  # type: ignore[arg-type]
+                )
+            finally:
+                scan_progress.done()
         except LlmReviewError as exc:
             typer.echo(f"LLM review skipped: {exc}", err=True)
         else:
@@ -300,16 +315,23 @@ def analyze(
                 f"Hunting for vulnerability hypotheses via Claude "
                 f"({'adjudicated against source, ' if verify else ''}backend={llm_backend}, may take a minute)..."
             )
-            hunt_result = generate_llm_review(
-                scan,
-                attack_surfaces,
-                findings,
-                attack_paths,
-                model=llm_model,
-                effort=hunt_effort_value,  # type: ignore[arg-type]
-                backend=llm_backend,  # type: ignore[arg-type]
-                mode=hunt_mode,  # type: ignore[arg-type]
+            scan_progress.stage(
+                f"Claude is hunting exploit-chain hypotheses"
+                f"{' + verifying against source' if verify else ''} (backend={llm_backend})"
             )
+            try:
+                hunt_result = generate_llm_review(
+                    scan,
+                    attack_surfaces,
+                    findings,
+                    attack_paths,
+                    model=llm_model,
+                    effort=hunt_effort_value,  # type: ignore[arg-type]
+                    backend=llm_backend,  # type: ignore[arg-type]
+                    mode=hunt_mode,  # type: ignore[arg-type]
+                )
+            finally:
+                scan_progress.done()
         except LlmReviewError as exc:
             typer.echo(f"Vulnerability hunt skipped: {exc}", err=True)
         else:
@@ -352,16 +374,20 @@ def analyze(
             typer.echo(
                 f"Generating remediation suggestions via Claude (backend={llm_backend}, may take a minute)..."
             )
-            rem_result = generate_llm_review(
-                scan,
-                attack_surfaces,
-                findings,
-                attack_paths,
-                model=llm_model,
-                effort=rem_effort_value,  # type: ignore[arg-type]
-                backend=llm_backend,  # type: ignore[arg-type]
-                mode="remediate",
-            )
+            scan_progress.stage(f"Claude is drafting remediation suggestions (backend={llm_backend})")
+            try:
+                rem_result = generate_llm_review(
+                    scan,
+                    attack_surfaces,
+                    findings,
+                    attack_paths,
+                    model=llm_model,
+                    effort=rem_effort_value,  # type: ignore[arg-type]
+                    backend=llm_backend,  # type: ignore[arg-type]
+                    mode="remediate",
+                )
+            finally:
+                scan_progress.done()
         except LlmReviewError as exc:
             typer.echo(f"Remediation skipped: {exc}", err=True)
         else:

{attackmap-0.4.0 → attackmap-0.4.2}/src/attackmap/progress.py

@@ -15,11 +15,16 @@ scanner drives it through the small hook surface (`begin`/`advance`/`stage`/
 
 from __future__ import annotations
 
+import json
 import sys
 import threading
 import time
 from typing import TextIO
 
+# NDJSON progress protocol version (consumed by the macOS GUI and other
+# non-TTY front-ends). Bump only on a breaking change to the event shape.
+PROGRESS_PROTOCOL_VERSION = 1
+
 _SPINNER = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
 _BAR_WIDTH = 24
 _MIN_REDRAW_INTERVAL = 0.08  # seconds — cap redraws so we don't thrash the TTY
@@ -152,4 +157,97 @@ def _truncate(text: str, width: int) -> str:
     return "…" + text[-(width - 1):]
 
 
-__all__ = ["ScanProgress"]
+class JsonScanProgress:
+    """Emit scan progress as newline-delimited JSON (one object per line).
+
+    Same hook surface as ``ScanProgress`` (``begin``/``advance``/``stage``/
+    ``done``) so the scanner drives either interchangeably. Unlike the TTY
+    renderer this never gates on ``isatty`` — its whole purpose is to feed a
+    non-terminal consumer (the macOS GUI) reading the child process's stderr.
+
+    Event shapes (all carry ``"v": PROGRESS_PROTOCOL_VERSION``)::
+
+        {"v":1,"event":"begin","total":1240,"label":"Scanning files"}
+        {"v":1,"event":"advance","done":37,"total":1240,"current":"src/app.ts"}
+        {"v":1,"event":"stage","label":"Taint analysis"}
+        {"v":1,"event":"done","summary":"…","done":1240,"total":1240,"elapsed_s":92.4}
+
+    ``advance`` events are throttled to at most one per ``min_interval`` seconds
+    to keep the stream sane on large trees; ``done`` (per-file count) stays
+    accurate because every advance still increments the internal counter and the
+    latest count rides on each emitted event.
+    """
+
+    def __init__(self, *, stream: TextIO | None = None, min_interval: float = 0.1) -> None:
+        self._stream = stream if stream is not None else sys.stderr
+        self._min_interval = max(0.0, min_interval)
+        self._total = 0
+        self._done = 0
+        self._start = 0.0
+        self._last_emit = 0.0
+
+    def begin(self, total: int, label: str = "Scanning files") -> None:
+        self._total = max(0, total)
+        self._done = 0
+        self._start = time.monotonic()
+        self._last_emit = self._start  # anchor throttle window to scan start
+        self._emit("begin", total=self._total, label=label)
+
+    def advance(self, current: str = "") -> None:
+        self._done += 1
+        now = time.monotonic()
+        # Always emit the final file; throttle the rest.
+        if self._done < self._total and (now - self._last_emit) < self._min_interval:
+            return
+        self._last_emit = now
+        self._emit("advance", done=self._done, total=self._total, current=current)
+
+    def stage(self, label: str) -> None:
+        self._emit("stage", label=label)
+
+    def done(self, summary: str = "") -> None:
+        elapsed = round(time.monotonic() - self._start, 3) if self._start else 0.0
+        self._emit(
+            "done",
+            summary=summary,
+            done=self._done,
+            total=self._total,
+            elapsed_s=elapsed,
+        )
+
+    def _emit(self, event: str, **fields: object) -> None:
+        payload = {"v": PROGRESS_PROTOCOL_VERSION, "event": event, **fields}
+        try:
+            self._stream.write(json.dumps(payload, ensure_ascii=False) + "\n")
+            self._stream.flush()
+        except (ValueError, OSError):
+            # Never let a broken/closed pipe take down a scan.
+            pass
+
+
+def create_progress(
+    fmt: str = "auto",
+    *,
+    no_progress: bool = False,
+    stream: TextIO | None = None,
+):
+    """Build the right progress sink for ``--progress-format``.
+
+    - ``none`` (or ``no_progress=True``) → a disabled ``ScanProgress`` no-op.
+    - ``json`` → :class:`JsonScanProgress` (NDJSON, always emits).
+    - ``auto`` / ``tty`` → :class:`ScanProgress` (TTY bar, self-silences when
+      stderr isn't a terminal).
+    """
+    if no_progress or fmt == "none":
+        return ScanProgress(enabled=False, stream=stream)
+    if fmt == "json":
+        return JsonScanProgress(stream=stream)
+    return ScanProgress(enabled=True, stream=stream)
+
+
+__all__ = [
+    "ScanProgress",
+    "JsonScanProgress",
+    "create_progress",
+    "PROGRESS_PROTOCOL_VERSION",
+]

{attackmap-0.4.0 → attackmap-0.4.2}/src/attackmap/scanner.py

@@ -736,10 +736,9 @@ def scan_repo(
         progress.stage("Authorization (BOLA/IDOR)")
     result.authz_candidates = analyze_authz(result, root_path)
     # Anomaly / outlier pass (#78): the odd-one-out among sibling routes.
-    # Runs last so the full route list is assembled into cohorts.
-    if progress is not None:
-        progress.stage("Anomaly / outlier detection")
-    result.anomalies = find_anomalies(result, root_path)
+    # Runs last so the full route list is assembled into cohorts. It drives its
+    # own determinate per-cohort progress (the slow tail on big route surfaces).
+    result.anomalies = find_anomalies(result, root_path, progress=progress)
     if progress is not None:
         progress.done()
     return result

{attackmap-0.4.0 → attackmap-0.4.2/src/attackmap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.0
+Version: 0.4.2
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>

{attackmap-0.4.0 → attackmap-0.4.2}/tests/test_anomalies.py

@@ -369,3 +369,29 @@ def test_auth_outlier_becomes_tagged_finding(tmp_path: Path) -> None:
     assert auth.severity == "high"
     assert auth.attack_techniques
     assert any("/api/users/export" in e for e in auth.evidence)
+
+
+def test_progress_reported_per_cohort(tmp_path: Path) -> None:
+    """find_anomalies drives a determinate begin/advance over cohorts (#status)."""
+    import io
+    import json
+
+    from attackmap.progress import JsonScanProgress
+
+    scan = _scan_with_routes(
+        tmp_path,
+        "views.py",
+        _AUTH_COHORT,
+        [
+            ("/api/users", "GET", '"/api/users")'),
+            ("/api/users/<id>", "GET", '"/api/users/<id>")'),
+            ("/api/users/export", "GET", '"/api/users/export")'),
+        ],
+    )
+    stream = io.StringIO()
+    find_anomalies(scan, progress=JsonScanProgress(stream=stream, min_interval=0.0))
+    events = [json.loads(line) for line in stream.getvalue().splitlines() if line.strip()]
+    begin = next(e for e in events if e["event"] == "begin")
+    assert begin["label"] == "Anomaly / outlier detection"
+    assert begin["total"] >= 1
+    assert any(e["event"] == "advance" for e in events)

attackmap-0.4.2/tests/test_progress.py

@@ -0,0 +1,183 @@
+"""Tests for the scan progress reporter (#36)."""
+
+from __future__ import annotations
+
+import io
+from pathlib import Path
+
+import json
+
+from attackmap.progress import (
+    PROGRESS_PROTOCOL_VERSION,
+    JsonScanProgress,
+    ScanProgress,
+    _fmt_duration,
+    _truncate,
+    create_progress,
+)
+from attackmap.scanner import scan_repo
+
+
+def _events(stream: io.StringIO) -> list[dict]:
+    return [json.loads(line) for line in stream.getvalue().splitlines() if line.strip()]
+
+
+class _FakeTTY(io.StringIO):
+    """StringIO that claims to be a terminal so progress renders."""
+
+    def isatty(self) -> bool:
+        return True
+
+
+def test_disabled_when_not_a_tty() -> None:
+    stream = io.StringIO()  # plain StringIO → isatty() False
+    p = ScanProgress(stream=stream)
+    p.begin(10)
+    p.advance("a.py")
+    p.done("done")
+    assert stream.getvalue() == ""
+
+
+def test_disabled_when_explicitly_off() -> None:
+    stream = _FakeTTY()
+    p = ScanProgress(enabled=False, stream=stream)
+    p.begin(10)
+    p.advance("a.py")
+    p.done()
+    assert stream.getvalue() == ""
+
+
+def test_renders_bar_and_percentage_on_tty() -> None:
+    stream = _FakeTTY()
+    p = ScanProgress(stream=stream)
+    p.begin(4)
+    for i in range(4):
+        p.advance(f"file{i}.py")
+    p.done("Scanned 4 files")
+    out = stream.getvalue()
+    assert "%" in out
+    assert "ETA" in out
+    assert "Scanned 4 files" in out
+
+
+def test_stage_renders_and_stops_cleanly() -> None:
+    stream = _FakeTTY()
+    p = ScanProgress(stream=stream)
+    p.begin(1)
+    p.advance("x.py")
+    p.stage("Taint / data-flow analysis")
+    p.done()
+    # spinner thread must be joined/stopped
+    assert p._spin_thread is None
+
+
+def test_fmt_duration() -> None:
+    assert _fmt_duration(0) == "00:00"
+    assert _fmt_duration(65) == "01:05"
+    assert _fmt_duration(3725) == "1h02m"
+
+
+def test_truncate_keeps_tail() -> None:
+    assert _truncate("short.py", 32) == "short.py"
+    long = "a/very/deeply/nested/path/to/module.py"
+    out = _truncate(long, 20)
+    assert out.startswith("…")
+    assert out.endswith("module.py")
+    assert len(out) == 20
+
+
+def test_scan_repo_drives_progress_without_error(tmp_path: Path) -> None:
+    (tmp_path / "app.py").write_text(
+        "from flask import Flask, request\n"
+        "app = Flask(__name__)\n"
+        "@app.route('/x')\n"
+        "def x(): return eval(request.args['e'])\n",
+        encoding="utf-8",
+    )
+    stream = _FakeTTY()
+    p = ScanProgress(stream=stream)
+    scan = scan_repo(tmp_path, progress=p)
+    assert scan.files_scanned == 1
+    out = stream.getvalue()
+    # per-file bar + at least one tail stage label rendered
+    assert "Scanning files" in out
+    assert "Taint" in out
+
+
+def test_scan_repo_unaffected_without_progress(tmp_path: Path) -> None:
+    (tmp_path / "app.py").write_text("print('hi')\n", encoding="utf-8")
+    scan = scan_repo(tmp_path)  # no progress arg → old behavior
+    assert scan.files_scanned == 1
+
+
+# --- NDJSON progress sink (M0 for the macOS GUI) -------------------------
+
+
+def test_json_progress_emits_ndjson_lifecycle() -> None:
+    stream = io.StringIO()  # plain StringIO (not a TTY) — JSON sink emits anyway
+    p = JsonScanProgress(stream=stream, min_interval=0.0)
+    p.begin(3, label="Scanning files")
+    p.advance("a.py")
+    p.advance("b.py")
+    p.advance("c.py")
+    p.stage("Taint analysis")
+    p.done("3 files, 1 finding")
+
+    events = _events(stream)
+    # Every line is valid JSON carrying the protocol version.
+    assert all(e["v"] == PROGRESS_PROTOCOL_VERSION for e in events)
+    kinds = [e["event"] for e in events]
+    assert kinds[0] == "begin"
+    assert kinds[-1] == "done"
+    assert "stage" in kinds
+
+    begin = events[0]
+    assert begin["total"] == 3 and begin["label"] == "Scanning files"
+
+    advances = [e for e in events if e["event"] == "advance"]
+    assert [a["done"] for a in advances] == [1, 2, 3]
+    assert advances[-1]["current"] == "c.py"
+
+    done = events[-1]
+    assert done["done"] == 3 and done["total"] == 3
+    assert done["summary"] == "3 files, 1 finding"
+    assert isinstance(done["elapsed_s"], (int, float)) and done["elapsed_s"] >= 0
+
+
+def test_json_progress_throttles_but_keeps_count_accurate() -> None:
+    stream = io.StringIO()
+    # Large min_interval → intermediate advances are suppressed, but the final
+    # file always emits and its count reflects every advance() call.
+    p = JsonScanProgress(stream=stream, min_interval=1_000.0)
+    p.begin(5)
+    for name in ("a", "b", "c", "d", "e"):
+        p.advance(name)
+    p.done()
+
+    advances = [e for e in _events(stream) if e["event"] == "advance"]
+    assert len(advances) == 1  # only the final file survived the throttle
+    assert advances[0]["done"] == 5 and advances[0]["total"] == 5
+
+
+def test_json_progress_survives_closed_stream() -> None:
+    stream = io.StringIO()
+    p = JsonScanProgress(stream=stream, min_interval=0.0)
+    p.begin(1)
+    stream.close()  # simulate the GUI hanging up mid-scan
+    p.advance("a.py")  # must not raise
+    p.done("done")
+
+
+def test_create_progress_selects_sink() -> None:
+    tty = _FakeTTY()
+    assert isinstance(create_progress("json", stream=io.StringIO()), JsonScanProgress)
+    assert isinstance(create_progress("auto", stream=tty), ScanProgress)
+    # 'none' and no_progress both yield a disabled no-op ScanProgress.
+    off = create_progress("none", stream=tty)
+    assert isinstance(off, ScanProgress)
+    off.begin(3)
+    off.advance("a.py")
+    off.done()
+    forced_off = create_progress("json", no_progress=True, stream=tty)
+    assert isinstance(forced_off, ScanProgress)
+    assert tty.getvalue() == ""  # nothing rendered by either disabled sink

attackmap-0.4.0/tests/test_progress.py

@@ -1,97 +0,0 @@
-"""Tests for the scan progress reporter (#36)."""
-
-from __future__ import annotations
-
-import io
-from pathlib import Path
-
-from attackmap.progress import ScanProgress, _fmt_duration, _truncate
-from attackmap.scanner import scan_repo
-
-
-class _FakeTTY(io.StringIO):
-    """StringIO that claims to be a terminal so progress renders."""
-
-    def isatty(self) -> bool:
-        return True
-
-
-def test_disabled_when_not_a_tty() -> None:
-    stream = io.StringIO()  # plain StringIO → isatty() False
-    p = ScanProgress(stream=stream)
-    p.begin(10)
-    p.advance("a.py")
-    p.done("done")
-    assert stream.getvalue() == ""
-
-
-def test_disabled_when_explicitly_off() -> None:
-    stream = _FakeTTY()
-    p = ScanProgress(enabled=False, stream=stream)
-    p.begin(10)
-    p.advance("a.py")
-    p.done()
-    assert stream.getvalue() == ""
-
-
-def test_renders_bar_and_percentage_on_tty() -> None:
-    stream = _FakeTTY()
-    p = ScanProgress(stream=stream)
-    p.begin(4)
-    for i in range(4):
-        p.advance(f"file{i}.py")
-    p.done("Scanned 4 files")
-    out = stream.getvalue()
-    assert "%" in out
-    assert "ETA" in out
-    assert "Scanned 4 files" in out
-
-
-def test_stage_renders_and_stops_cleanly() -> None:
-    stream = _FakeTTY()
-    p = ScanProgress(stream=stream)
-    p.begin(1)
-    p.advance("x.py")
-    p.stage("Taint / data-flow analysis")
-    p.done()
-    # spinner thread must be joined/stopped
-    assert p._spin_thread is None
-
-
-def test_fmt_duration() -> None:
-    assert _fmt_duration(0) == "00:00"
-    assert _fmt_duration(65) == "01:05"
-    assert _fmt_duration(3725) == "1h02m"
-
-
-def test_truncate_keeps_tail() -> None:
-    assert _truncate("short.py", 32) == "short.py"
-    long = "a/very/deeply/nested/path/to/module.py"
-    out = _truncate(long, 20)
-    assert out.startswith("…")
-    assert out.endswith("module.py")
-    assert len(out) == 20
-
-
-def test_scan_repo_drives_progress_without_error(tmp_path: Path) -> None:
-    (tmp_path / "app.py").write_text(
-        "from flask import Flask, request\n"
-        "app = Flask(__name__)\n"
-        "@app.route('/x')\n"
-        "def x(): return eval(request.args['e'])\n",
-        encoding="utf-8",
-    )
-    stream = _FakeTTY()
-    p = ScanProgress(stream=stream)
-    scan = scan_repo(tmp_path, progress=p)
-    assert scan.files_scanned == 1
-    out = stream.getvalue()
-    # per-file bar + at least one tail stage label rendered
-    assert "Scanning files" in out
-    assert "Taint" in out
-
-
-def test_scan_repo_unaffected_without_progress(tmp_path: Path) -> None:
-    (tmp_path / "app.py").write_text("print('hi')\n", encoding="utf-8")
-    scan = scan_repo(tmp_path)  # no progress arg → old behavior
-    assert scan.files_scanned == 1