deployproof 0.1.0__tar.gz

deployproof-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SVSPraveen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

deployproof-0.1.0/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: deployproof
+Version: 0.1.0
+Summary: A deterministic pre-push verification tool that catches untested AI code, leaked credentials, sandbox escapes, and hallucinated packages before you ship.
+Author: SVS Praveen
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/SVSPraveen/deployproof
+Project-URL: Documentation, https://github.com/SVSPraveen/deployproof#readme
+Project-URL: Repository, https://github.com/SVSPraveen/deployproof.git
+Project-URL: Bug Tracker, https://github.com/SVSPraveen/deployproof/issues
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Requires-Dist: build>=1.0.0; extra == "dev"
+Requires-Dist: twine>=4.0.0; extra == "dev"
+Dynamic: license-file
+
+# DeployProof
+
+> A pre-push verification tool for AI-assisted codebases: mutation testing, credential scanning, sandbox-escape detection, and dependency hallucination checks.
+
+<!-- Once the package is published to PyPI, replace the two static badges below with:
+     [![PyPI version](https://img.shields.io/pypi/v/deployproof)](https://pypi.org/project/deployproof/)
+     [![Python](https://img.shields.io/pypi/pyversions/deployproof)](https://pypi.org/project/deployproof/) -->
+[![PyPI](https://img.shields.io/badge/PyPI-not_yet_published-lightgrey)](https://pypi.org/project/deployproof/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Python](https://img.shields.io/badge/python-3.10%2B-blue)](https://pypi.org/project/deployproof/)
+[![CI](https://github.com/SVSPraveen/deployproof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/deployproof/actions/workflows/ci.yml)
+
+---
+
+## Why This Exists
+
+AI-assisted development introduces failure modes that standard tools miss: test suites with high line coverage but near-zero mutation scores, hardcoded credentials generated in passing, symlinks that deceive approval prompts into escaping the repository sandbox, and package names hallucinated by LLMs that don't exist on PyPI. DeployProof catches these at the pre-push stage, before they reach CI or production.
+
+## Install
+
+```bash
+pip install deployproof
+```
+
+Requires Python 3.10+.
+
+## Quickstart
+
+Initialize in your repository:
+
+```bash
+deployproof init
+```
+
+Run all verification checks against changes in the current session:
+
+```bash
+deployproof check
+```
+
+Output includes a section for each check — symlink scan, secrets scan, dependency scan, and mutation score — with a pass/fail line at the bottom. Exit code is non-zero on any finding that should block a push.
+
+## What It Checks
+
+- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage.
+- **Secrets and Credentials** — Scans modified files for hardcoded API keys (OpenAI, Anthropic, AWS, GitHub, Stripe, private keys) and tracked `.env` files using pattern matching and entropy analysis.
+- **Symlink and Sandbox Escape** — Resolves symbolic links and flags any whose target escapes the repository root (CWE-61 / CWE-451). Catches the class of path-traversal trick used in the GhostApproval disclosure (Wiz Research, July 2026).
+- **Dependency and Slopsquatting** — For each new import or manifest entry introduced in the diff, queries the PyPI JSON API and checks registration age. Packages that don't exist (HTTP 404) are flagged HIGH RISK; packages registered within the last 30 days are flagged MEDIUM RISK. Network errors are reported as UNKNOWN — never silently treated as safe.
+
+## What This Doesn't Do
+
+- **Not a full-repo audit.** Checks are scoped to files changed in the current session (git diff). Files you haven't touched are not re-evaluated.
+- **Python only.** Mutation testing and import extraction currently support Python files only. Other languages are not scanned.
+- **No auto-fix.** DeployProof reports findings; it does not modify your code, rewrite imports, or suggest patches.
+- **No IDE plugin yet.** There is no VS Code extension or JetBrains plugin. The CLI is the interface. IDE integration is on the roadmap.
+
+## See It Catch Real Bugs
+
+Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 7 planted edge cases:
+
+```bash
+python stress_fixtures/run_stress_tests.py
+```
+
+Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, and GhostApproval sandbox-escape traps.
+
+## Status & Roadmap
+
+- **Current (v0.1.0):** Diff-scoped AST mutation testing, secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Next:** Multi-language mutation support and expanded ecosystem rule packs.
+
+## Contributing
+
+Issues and pull requests are welcome. Open an issue first for significant changes so the approach can be discussed before implementation.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+---
+
+*Created by [SVS Praveen](https://github.com/SVSPraveen) · [Portfolio](https://svspraveen.vercel.app/) · [LinkedIn](https://www.linkedin.com/in/svs-praveen-s/)*

deployproof-0.1.0/README.md

@@ -0,0 +1,82 @@
+# DeployProof
+
+> A pre-push verification tool for AI-assisted codebases: mutation testing, credential scanning, sandbox-escape detection, and dependency hallucination checks.
+
+<!-- Once the package is published to PyPI, replace the two static badges below with:
+     [![PyPI version](https://img.shields.io/pypi/v/deployproof)](https://pypi.org/project/deployproof/)
+     [![Python](https://img.shields.io/pypi/pyversions/deployproof)](https://pypi.org/project/deployproof/) -->
+[![PyPI](https://img.shields.io/badge/PyPI-not_yet_published-lightgrey)](https://pypi.org/project/deployproof/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Python](https://img.shields.io/badge/python-3.10%2B-blue)](https://pypi.org/project/deployproof/)
+[![CI](https://github.com/SVSPraveen/deployproof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/deployproof/actions/workflows/ci.yml)
+
+---
+
+## Why This Exists
+
+AI-assisted development introduces failure modes that standard tools miss: test suites with high line coverage but near-zero mutation scores, hardcoded credentials generated in passing, symlinks that deceive approval prompts into escaping the repository sandbox, and package names hallucinated by LLMs that don't exist on PyPI. DeployProof catches these at the pre-push stage, before they reach CI or production.
+
+## Install
+
+```bash
+pip install deployproof
+```
+
+Requires Python 3.10+.
+
+## Quickstart
+
+Initialize in your repository:
+
+```bash
+deployproof init
+```
+
+Run all verification checks against changes in the current session:
+
+```bash
+deployproof check
+```
+
+Output includes a section for each check — symlink scan, secrets scan, dependency scan, and mutation score — with a pass/fail line at the bottom. Exit code is non-zero on any finding that should block a push.
+
+## What It Checks
+
+- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage.
+- **Secrets and Credentials** — Scans modified files for hardcoded API keys (OpenAI, Anthropic, AWS, GitHub, Stripe, private keys) and tracked `.env` files using pattern matching and entropy analysis.
+- **Symlink and Sandbox Escape** — Resolves symbolic links and flags any whose target escapes the repository root (CWE-61 / CWE-451). Catches the class of path-traversal trick used in the GhostApproval disclosure (Wiz Research, July 2026).
+- **Dependency and Slopsquatting** — For each new import or manifest entry introduced in the diff, queries the PyPI JSON API and checks registration age. Packages that don't exist (HTTP 404) are flagged HIGH RISK; packages registered within the last 30 days are flagged MEDIUM RISK. Network errors are reported as UNKNOWN — never silently treated as safe.
+
+## What This Doesn't Do
+
+- **Not a full-repo audit.** Checks are scoped to files changed in the current session (git diff). Files you haven't touched are not re-evaluated.
+- **Python only.** Mutation testing and import extraction currently support Python files only. Other languages are not scanned.
+- **No auto-fix.** DeployProof reports findings; it does not modify your code, rewrite imports, or suggest patches.
+- **No IDE plugin yet.** There is no VS Code extension or JetBrains plugin. The CLI is the interface. IDE integration is on the roadmap.
+
+## See It Catch Real Bugs
+
+Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 7 planted edge cases:
+
+```bash
+python stress_fixtures/run_stress_tests.py
+```
+
+Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, and GhostApproval sandbox-escape traps.
+
+## Status & Roadmap
+
+- **Current (v0.1.0):** Diff-scoped AST mutation testing, secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Next:** Multi-language mutation support and expanded ecosystem rule packs.
+
+## Contributing
+
+Issues and pull requests are welcome. Open an issue first for significant changes so the approach can be discussed before implementation.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+---
+
+*Created by [SVS Praveen](https://github.com/SVSPraveen) · [Portfolio](https://svspraveen.vercel.app/) · [LinkedIn](https://www.linkedin.com/in/svs-praveen-s/)*

deployproof-0.1.0/pyproject.toml

@@ -0,0 +1,50 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "deployproof"
+version = "0.1.0"
+description = "A deterministic pre-push verification tool that catches untested AI code, leaked credentials, sandbox escapes, and hallucinated packages before you ship."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+authors = [
+    { name = "SVS Praveen" }
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+    "Topic :: Software Development :: Testing",
+]
+dependencies = []
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.0.0",
+    "build>=1.0.0",
+    "twine>=4.0.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/SVSPraveen/deployproof"
+Documentation = "https://github.com/SVSPraveen/deployproof#readme"
+Repository = "https://github.com/SVSPraveen/deployproof.git"
+"Bug Tracker" = "https://github.com/SVSPraveen/deployproof/issues"
+
+[project.scripts]
+deployproof = "deployproof.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]

deployproof-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

deployproof-0.1.0/src/deployproof/__init__.py

@@ -0,0 +1,3 @@
+"""DeployProof - A deterministic AI-code deployability checker."""
+
+__version__ = "0.1.0"

deployproof-0.1.0/src/deployproof/cli.py

@@ -0,0 +1,288 @@
+"""Command-line interface for DeployProof."""
+
+import argparse
+import sys
+from pathlib import Path
+from typing import List, Optional
+
+from deployproof import __version__
+from deployproof.dependencies import (
+    extract_all_new_dependencies,
+    scan_dependencies,
+)
+from deployproof.diff import (
+    DiffScopeError,
+    InvalidBaseRefError,
+    NotAGitRepositoryError,
+    get_git_root,
+    is_test_file,
+    resolve_changed_python_files,
+    resolve_changed_session_files,
+)
+from deployproof.mutator import run_mutation_tests
+from deployproof.reporter import LARGE_FILE_LOC_THRESHOLD, format_report
+from deployproof.secrets import scan_session_files_for_secrets
+from deployproof.symlinks import scan_session_files_for_symlinks
+from deployproof.wsl import check_wsl_readiness, run_wsl_mutmut
+
+
+def create_parser() -> argparse.ArgumentParser:
+    """Create and configure the command-line argument parser."""
+    parser = argparse.ArgumentParser(
+        prog="deployproof",
+        description="DeployProof: A deterministic AI-code deployability checker.",
+    )
+    parser.add_argument(
+        "-v",
+        "--version",
+        action="version",
+        version=f"%(prog)s {__version__}",
+        help="Show program's version number and exit.",
+    )
+
+    subparsers = parser.add_subparsers(dest="command", help="Available commands")
+
+    # 'check' command for V1 scope
+    check_parser = subparsers.add_parser(
+        "check",
+        help="Run deployability verification checks against session changes.",
+    )
+    check_parser.add_argument(
+        "--base",
+        type=str,
+        default=None,
+        help="Base git ref (branch/commit/tag) to diff against.",
+    )
+    check_parser.add_argument(
+        "--files",
+        nargs="+",
+        type=str,
+        default=None,
+        help="Explicit files to evaluate (bypasses git diff).",
+    )
+    check_parser.add_argument(
+        "--tests",
+        nargs="+",
+        type=str,
+        default=None,
+        help="Specific test file(s) or directories to execute.",
+    )
+    check_parser.add_argument(
+        "--threshold",
+        type=float,
+        default=80.0,
+        help="Minimum mutation score percentage to pass (default: 80.0).",
+    )
+    check_parser.add_argument(
+        "--timeout",
+        type=float,
+        default=10.0,
+        help="Test runner timeout in seconds per mutant (default: 10.0).",
+    )
+    check_parser.add_argument(
+        "--wsl",
+        action="store_true",
+        default=False,
+        help="Delegate mutation testing to mutmut inside WSL (Windows only).",
+    )
+
+    # Placeholder 'init' command
+    subparsers.add_parser(
+        "init",
+        help="Initialize DeployProof configuration in the current repository.",
+    )
+
+    return parser
+
+
+def handle_check(args: argparse.Namespace) -> int:
+    """Handle the 'check' subcommand."""
+    cwd = Path.cwd().resolve()
+    repo_root: Optional[Path] = None
+
+    try:
+        if args.files:
+            session_files = [Path(f).resolve() for f in args.files]
+            if session_files:
+                try:
+                    repo_root = get_git_root(session_files[0].parent)
+                except DiffScopeError:
+                    repo_root = session_files[0].parent
+            else:
+                repo_root = cwd
+        else:
+            repo_root = get_git_root(cwd)
+            session_files = resolve_changed_session_files(cwd=cwd, base=args.base)
+    except NotAGitRepositoryError:
+        print("Error: Not a git repository. Initialize git or specify files with --files.", file=sys.stderr)
+        return 1
+    except InvalidBaseRefError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        return 1
+    except DiffScopeError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        return 1
+
+    if not session_files:
+        print("DeployProof: No modified files detected in current session.")
+        print("Working tree is clean. Use --base <ref> or --files <path...> to evaluate specific files.")
+        return 0
+
+    # 1. Run Symlink & Sandbox Escape Scanner across all session files
+    symlink_result = scan_session_files_for_symlinks(session_files, repo_root=repo_root or cwd)
+
+    # 2. Run Secrets & Credentials Scanner across all session files
+    secrets_result = scan_session_files_for_secrets(session_files)
+
+    # 3. Run Slopsquatting & Dependency Hallucination Scanner across session files
+    extracted_deps = extract_all_new_dependencies(session_files, root=repo_root or cwd, base=args.base)
+    dependency_result = scan_dependencies(extracted_deps)
+
+    # 4. Filter target Python files for mutation testing
+    if args.files:
+        target_files = [f for f in session_files if f.is_file() and f.suffix == ".py"]
+    else:
+        target_files = [f for f in session_files if f.is_file() and f.suffix == ".py" and not is_test_file(f)]
+
+    # Notify upfront if large files are in scope
+    for f in target_files:
+        try:
+            loc = len(f.read_text(encoding="utf-8", errors="replace").splitlines())
+            if loc >= LARGE_FILE_LOC_THRESHOLD:
+                try:
+                    rel = f.relative_to(repo_root or cwd)
+                except ValueError:
+                    rel = f
+                print(
+                    f"Notice: Large file '{rel}' ({loc} LOC) detected - mutation testing may take several minutes."
+                )
+        except Exception:
+            pass
+
+    # Optional WSL delegation
+    if getattr(args, "wsl", False):
+        wsl_ready, wsl_msg = check_wsl_readiness()
+        if wsl_ready:
+            print("DeployProof - Delegating to mutmut in WSL...")
+            wsl_res = run_wsl_mutmut(repo_root or cwd, target_files)
+            if wsl_res.get("success"):
+                print(wsl_res.get("stdout", ""))
+                has_security_issue = bool(
+                    secrets_result.findings
+                    or symlink_result.escape_findings
+                    or dependency_result.high_risk_count > 0
+                )
+                return 1 if has_security_issue else 0
+            else:
+                print(f"WSL execution error: {wsl_res.get('error') or wsl_res.get('stderr')}", file=sys.stderr)
+                print("Falling back to Tier 1 local pre-check...")
+        else:
+            print(wsl_msg)
+            print("-" * 68)
+
+    result = run_mutation_tests(
+        target_files=target_files,
+        repo_root=repo_root or cwd,
+        test_runner_timeout=args.timeout,
+        extra_pytest_args=args.tests,
+    )
+
+    report_text = format_report(
+        result=result,
+        target_files=target_files,
+        secrets_result=secrets_result,
+        symlink_result=symlink_result,
+        dependency_result=dependency_result,
+        repo_root=repo_root or cwd,
+        threshold=args.threshold,
+    )
+    print(report_text)
+
+    # Fail if mutation score threshold not met, secrets detected, symlink sandbox escapes found, or hallucinated packages detected
+    if (
+        result.mutation_score < args.threshold
+        or len(result.untested_files) > 0
+        or len(secrets_result.findings) > 0
+        or len(symlink_result.escape_findings) > 0
+        or dependency_result.high_risk_count > 0
+    ):
+        return 1
+    return 0
+
+
+def handle_init(args: argparse.Namespace) -> int:
+    """Handle the 'init' subcommand to initialize configuration and git hooks."""
+    cwd = Path.cwd().resolve()
+    try:
+        repo_root = get_git_root(cwd)
+    except DiffScopeError:
+        repo_root = cwd
+
+    print(f"DeployProof: Initializing in {repo_root}...")
+
+    # 1. Create or verify configuration file (.deployproof.json)
+    config_path = repo_root / ".deployproof.json"
+    if not config_path.exists():
+        import json
+        default_config = {
+            "version": __version__,
+            "threshold": 80.0,
+            "timeout": 10.0,
+            "secrets_scanning": True,
+            "symlink_scanning": True,
+            "dependency_scanning": True,
+        }
+        config_path.write_text(json.dumps(default_config, indent=2) + "\n", encoding="utf-8")
+        print(f"  [+] Created configuration file: {config_path.name}")
+    else:
+        print(f"  [.] Configuration file already exists: {config_path.name}")
+
+    # 2. Install / verify git pre-push hook if inside git repo
+    hooks_dir = repo_root / ".git" / "hooks"
+    if hooks_dir.is_dir():
+        pre_push_hook = hooks_dir / "pre-push"
+        hook_script = "#!/usr/bin/env sh\n# DeployProof deterministic pre-push verification gate\ndeployproof check\n"
+        pre_push_hook.write_text(hook_script, encoding="utf-8")
+        try:
+            import stat
+            pre_push_hook.chmod(pre_push_hook.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+        except Exception:
+            pass
+        print("  [+] Installed git pre-push hook: .git/hooks/pre-push")
+    else:
+        print("  [i] Note: .git/hooks directory not found. Initialize git to enable automatic pre-push gating.")
+
+    print("\nDeployProof initialization complete. Run 'deployproof check' to verify your session changes.")
+    return 0
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    """Entry point for the DeployProof CLI."""
+    if hasattr(sys.stdout, "reconfigure"):
+        try:
+            sys.stdout.reconfigure(errors="replace")
+        except Exception:
+            pass
+    if hasattr(sys.stderr, "reconfigure"):
+        try:
+            sys.stderr.reconfigure(errors="replace")
+        except Exception:
+            pass
+
+    parser = create_parser()
+    args = parser.parse_args(argv)
+
+    if not args.command:
+        parser.print_help()
+        return 0
+
+    if args.command == "check":
+        return handle_check(args)
+    elif args.command == "init":
+        return handle_init(args)
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())