deployproof 0.1.2__tar.gz → 0.1.5__tar.gz

{deployproof-0.1.2/src/deployproof.egg-info → deployproof-0.1.5}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: deployproof
-Version: 0.1.2
-Summary: A deterministic pre-push verification tool that catches untested AI code, leaked credentials, sandbox escapes, and hallucinated packages before you ship.
+Version: 0.1.5
+Summary: A deterministic AI-code deployability checker that catches what coverage misses.
 Author: SVS Praveen
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/SVSPraveen/deployproof
@@ -33,7 +33,7 @@ Dynamic: license-file
 
 [![PyPI version](https://img.shields.io/pypi/v/deployproof.svg?color=blue)](https://pypi.org/project/deployproof/)
 [![Python versions](https://img.shields.io/pypi/pyversions/deployproof.svg?color=blue)](https://pypi.org/project/deployproof/)
-[![Tests](https://img.shields.io/badge/tests-61%20passed-brightgreen.svg)](https://github.com/SVSPraveen/DeployProof)
+[![Tests](https://img.shields.io/badge/tests-79%20passed-brightgreen.svg)](https://github.com/SVSPraveen/DeployProof)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 ---
@@ -64,14 +64,99 @@ Run all verification checks against changes in the current session:
 deployproof check
 ```
 
-Output includes a section for each check — symlink scan, secrets scan, dependency scan, and mutation score — with a pass/fail line at the bottom. Exit code is non-zero on any finding that should block a push.
+Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. Exit code is non-zero on any finding that should block a push. Supports `--json` for machine-readable output and `--strict-mocks` / `--strict-error-handling` to turn informational checks into hard verification gates.
+
+### Machine-Readable Output (`--json`)
+
+DeployProof provides a stable structured JSON schema for CI/CD pipelines, IDEs, and automation:
+
+```bash
+deployproof check --json
+```
+
+#### JSON Output Schema
+
+```json
+{
+  "version": "0.1.5",
+  "status": "passed",
+  "summary": {
+    "target_files_count": 1,
+    "mutation_score": 100.0,
+    "threshold": 80.0,
+    "secrets_found": 0,
+    "symlink_escapes_found": 0,
+    "dependency_findings": {
+      "high_risk": 0,
+      "medium_risk": 0,
+      "ok": 1,
+      "unknown": 0,
+      "unscanned": 0
+    },
+    "mock_usages_found": 0,
+    "control_flow_findings": 0,
+    "strict_mocks_active": false,
+    "strict_mocks_triggered": false,
+    "strict_error_handling_active": false,
+    "strict_error_handling_triggered": false
+  },
+  "scope": {
+    "target_files": [
+      {
+        "file": "app.py",
+        "loc": 45,
+        "is_large": false
+      }
+    ]
+  },
+  "mutation_testing": {
+    "score": 100.0,
+    "threshold": 80.0,
+    "total_mutants": 6,
+    "killed_mutants": 6,
+    "survived_mutants_count": 0,
+    "duration_seconds": 1.2,
+    "surviving_mutants": [],
+    "skipped_constructs": [],
+    "untested_files": []
+  },
+  "secrets": {
+    "clean": true,
+    "files_scanned": 1,
+    "findings": []
+  },
+  "symlinks": {
+    "clean": true,
+    "files_scanned": 1,
+    "findings": []
+  },
+  "dependencies": {
+    "clean": true,
+    "total_scanned": 1,
+    "findings": [],
+    "unscanned_sources": []
+  },
+  "mocks": {
+    "clean": true,
+    "strict_gate_triggered": false,
+    "findings": []
+  },
+  "control_flow": {
+    "clean": true,
+    "strict_gate_triggered": false,
+    "findings": []
+  }
+}
+```
 
 ## What It Checks
 
 - **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage.
 - **Secrets and Credentials** — Scans modified files for hardcoded API keys (OpenAI, Anthropic, AWS, GitHub, Stripe, private keys) and tracked `.env` files using pattern matching and entropy analysis.
 - **Symlink and Sandbox Escape** — Resolves symbolic links and flags any whose target escapes the repository root (CWE-61 / CWE-451). Catches the class of path-traversal trick used in the GhostApproval disclosure (Wiz Research, July 2026).
-- **Dependency and Slopsquatting** — For each new import or manifest entry introduced in the diff, queries the PyPI JSON API and checks registration age. Packages that don't exist (HTTP 404) are flagged HIGH RISK; packages registered within the last 30 days are flagged MEDIUM RISK. Network errors are reported as UNKNOWN — never silently treated as safe.
+- **Dependency and Slopsquatting** — For each new import, dynamic import (`importlib.import_module`, `__import__`), or manifest entry (including recursive `-r` includes) introduced in the diff, queries the PyPI JSON API and checks registration age. Packages that don't exist (HTTP 404) are flagged HIGH RISK; packages registered within the last 30 days are flagged MEDIUM RISK.
+- **Mock Usage Detection** — Scans test diffs for newly introduced imports or fixture uses of `unittest.mock`, `mocker`, and `monkeypatch`, flagging them for human review with an optional `--strict-mocks` hard gate.
+- **Control Flow and Error Handling** — AST-based detector for bare `except:` without re-raise, silently swallowed broad exceptions (`except Exception:` that only `pass` or log/print without re-raising or returning error indicators), and dead/unreachable code following unconditional `return`, `raise`, `break`, or `continue`, with an optional `--strict-error-handling` hard gate.
 
 ## What This Doesn't Do
 
@@ -92,7 +177,7 @@ Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS cr
 
 ## Status & Roadmap
 
-- **Current (v0.1.2):** Diff-scoped AST mutation testing, secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Current (v0.1.5):** Diff-scoped AST mutation testing, secrets scanner (including unquoted .env values), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with recursive `-r` requirements scanning and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
 - **Next:** Multi-language mutation support and expanded ecosystem rule packs.
 
 ## Contributing

deployproof-0.1.5/README.md

@@ -0,0 +1,164 @@
+# DeployProof
+
+> A pre-push verification tool for AI-assisted codebases: mutation testing, credential scanning, sandbox-escape detection, and dependency hallucination checks.
+
+[![PyPI version](https://img.shields.io/pypi/v/deployproof.svg?color=blue)](https://pypi.org/project/deployproof/)
+[![Python versions](https://img.shields.io/pypi/pyversions/deployproof.svg?color=blue)](https://pypi.org/project/deployproof/)
+[![Tests](https://img.shields.io/badge/tests-79%20passed-brightgreen.svg)](https://github.com/SVSPraveen/DeployProof)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+---
+
+## Why This Exists
+
+AI-assisted development introduces failure modes that standard tools miss: test suites with high line coverage but near-zero mutation scores, hardcoded credentials generated in passing, symlinks that deceive approval prompts into escaping the repository sandbox, and package names hallucinated by LLMs that don't exist on PyPI. DeployProof catches these at the pre-push stage, before they reach CI or production.
+
+## Install
+
+```bash
+pip install deployproof
+```
+
+Requires Python 3.10+.
+
+## Quickstart
+
+Initialize in your repository:
+
+```bash
+deployproof init
+```
+
+Run all verification checks against changes in the current session:
+
+```bash
+deployproof check
+```
+
+Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. Exit code is non-zero on any finding that should block a push. Supports `--json` for machine-readable output and `--strict-mocks` / `--strict-error-handling` to turn informational checks into hard verification gates.
+
+### Machine-Readable Output (`--json`)
+
+DeployProof provides a stable structured JSON schema for CI/CD pipelines, IDEs, and automation:
+
+```bash
+deployproof check --json
+```
+
+#### JSON Output Schema
+
+```json
+{
+  "version": "0.1.5",
+  "status": "passed",
+  "summary": {
+    "target_files_count": 1,
+    "mutation_score": 100.0,
+    "threshold": 80.0,
+    "secrets_found": 0,
+    "symlink_escapes_found": 0,
+    "dependency_findings": {
+      "high_risk": 0,
+      "medium_risk": 0,
+      "ok": 1,
+      "unknown": 0,
+      "unscanned": 0
+    },
+    "mock_usages_found": 0,
+    "control_flow_findings": 0,
+    "strict_mocks_active": false,
+    "strict_mocks_triggered": false,
+    "strict_error_handling_active": false,
+    "strict_error_handling_triggered": false
+  },
+  "scope": {
+    "target_files": [
+      {
+        "file": "app.py",
+        "loc": 45,
+        "is_large": false
+      }
+    ]
+  },
+  "mutation_testing": {
+    "score": 100.0,
+    "threshold": 80.0,
+    "total_mutants": 6,
+    "killed_mutants": 6,
+    "survived_mutants_count": 0,
+    "duration_seconds": 1.2,
+    "surviving_mutants": [],
+    "skipped_constructs": [],
+    "untested_files": []
+  },
+  "secrets": {
+    "clean": true,
+    "files_scanned": 1,
+    "findings": []
+  },
+  "symlinks": {
+    "clean": true,
+    "files_scanned": 1,
+    "findings": []
+  },
+  "dependencies": {
+    "clean": true,
+    "total_scanned": 1,
+    "findings": [],
+    "unscanned_sources": []
+  },
+  "mocks": {
+    "clean": true,
+    "strict_gate_triggered": false,
+    "findings": []
+  },
+  "control_flow": {
+    "clean": true,
+    "strict_gate_triggered": false,
+    "findings": []
+  }
+}
+```
+
+## What It Checks
+
+- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage.
+- **Secrets and Credentials** — Scans modified files for hardcoded API keys (OpenAI, Anthropic, AWS, GitHub, Stripe, private keys) and tracked `.env` files using pattern matching and entropy analysis.
+- **Symlink and Sandbox Escape** — Resolves symbolic links and flags any whose target escapes the repository root (CWE-61 / CWE-451). Catches the class of path-traversal trick used in the GhostApproval disclosure (Wiz Research, July 2026).
+- **Dependency and Slopsquatting** — For each new import, dynamic import (`importlib.import_module`, `__import__`), or manifest entry (including recursive `-r` includes) introduced in the diff, queries the PyPI JSON API and checks registration age. Packages that don't exist (HTTP 404) are flagged HIGH RISK; packages registered within the last 30 days are flagged MEDIUM RISK.
+- **Mock Usage Detection** — Scans test diffs for newly introduced imports or fixture uses of `unittest.mock`, `mocker`, and `monkeypatch`, flagging them for human review with an optional `--strict-mocks` hard gate.
+- **Control Flow and Error Handling** — AST-based detector for bare `except:` without re-raise, silently swallowed broad exceptions (`except Exception:` that only `pass` or log/print without re-raising or returning error indicators), and dead/unreachable code following unconditional `return`, `raise`, `break`, or `continue`, with an optional `--strict-error-handling` hard gate.
+
+## What This Doesn't Do
+
+- **Not a full-repo audit.** Checks are scoped to files changed in the current session (git diff). Files you haven't touched are not re-evaluated.
+- **Python only.** Mutation testing and import extraction currently support Python files only. Other languages are not scanned.
+- **No auto-fix.** DeployProof reports findings; it does not modify your code, rewrite imports, or suggest patches.
+- **No IDE plugin yet.** There is no VS Code extension or JetBrains plugin. The CLI is the interface. IDE integration is on the roadmap.
+
+## See It Catch Real Bugs
+
+Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 7 planted edge cases:
+
+```bash
+python stress_fixtures/run_stress_tests.py
+```
+
+Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, and GhostApproval sandbox-escape traps.
+
+## Status & Roadmap
+
+- **Current (v0.1.5):** Diff-scoped AST mutation testing, secrets scanner (including unquoted .env values), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with recursive `-r` requirements scanning and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Next:** Multi-language mutation support and expanded ecosystem rule packs.
+
+## Contributing
+
+Issues and pull requests are welcome. Open an issue first for significant changes so the approach can be discussed before implementation.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+---
+
+*Created by [SVS Praveen](https://github.com/SVSPraveen) · [Portfolio](https://svspraveen.vercel.app/) · [LinkedIn](https://www.linkedin.com/in/svs-praveen-s/)*

{deployproof-0.1.2 → deployproof-0.1.5}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "deployproof"
-version = "0.1.2"
-description = "A deterministic pre-push verification tool that catches untested AI code, leaked credentials, sandbox escapes, and hallucinated packages before you ship."
+version = "0.1.5"
+description = "A deterministic AI-code deployability checker that catches what coverage misses."
 readme = "README.md"
 requires-python = ">=3.10"
 license = "MIT"

{deployproof-0.1.2 → deployproof-0.1.5}/src/deployproof/__init__.py

@@ -1,2 +1,2 @@
 """DeployProof: Deterministic deployability verification for AI-assisted code."""
-__version__ = "0.1.2"
+__version__ = "0.1.5"

{deployproof-0.1.2 → deployproof-0.1.5}/src/deployproof/cli.py

@@ -10,6 +10,7 @@ from deployproof.dependencies import (
     extract_all_new_dependencies,
     scan_dependencies,
 )
+from deployproof.control_flow import scan_session_files_for_control_flow
 from deployproof.diff import (
     DiffScopeError,
     InvalidBaseRefError,
@@ -19,8 +20,9 @@ from deployproof.diff import (
     resolve_changed_python_files,
     resolve_changed_session_files,
 )
+from deployproof.mocks import scan_session_files_for_mocks
 from deployproof.mutator import run_mutation_tests
-from deployproof.reporter import LARGE_FILE_LOC_THRESHOLD, format_report
+from deployproof.reporter import LARGE_FILE_LOC_THRESHOLD, format_json_report, format_report
 from deployproof.secrets import scan_session_files_for_secrets
 from deployproof.symlinks import scan_session_files_for_symlinks
 from deployproof.wsl import check_wsl_readiness, run_wsl_mutmut
@@ -85,6 +87,24 @@ def create_parser() -> argparse.ArgumentParser:
         default=False,
         help="Delegate mutation testing to mutmut inside WSL (Windows only).",
     )
+    check_parser.add_argument(
+        "--strict-mocks",
+        action="store_true",
+        default=False,
+        help="Fail the verification gate if new mock or monkeypatch usage is introduced in test files.",
+    )
+    check_parser.add_argument(
+        "--strict-error-handling",
+        action="store_true",
+        default=False,
+        help="Fail the verification gate if bare excepts, swallowed exceptions, or unreachable code are detected.",
+    )
+    check_parser.add_argument(
+        "--json",
+        action="store_true",
+        default=False,
+        help="Output check results as a structured JSON object.",
+    )
 
     # Placeholder 'init' command
     subparsers.add_parser(
@@ -124,9 +144,50 @@ def handle_check(args: argparse.Namespace) -> int:
         return 1
 
     if not session_files:
-        print("DeployProof: No modified files detected in current session.")
-        print("Working tree is clean. Use --base <ref> or --files <path...> to evaluate specific files.")
-        return 0
+        if getattr(args, "json", False):
+            import json
+
+            print(
+                json.dumps(
+                    {
+                        "version": __version__,
+                        "status": "passed",
+                        "message": "No modified files detected in current session.",
+                        "scope": {"target_files": []},
+                        "summary": {
+                            "target_files_count": 0,
+                            "mutation_score": 100.0,
+                            "threshold": args.threshold,
+                            "secrets_found": 0,
+                            "symlink_escapes_found": 0,
+                            "dependency_findings": {
+                                "high_risk": 0,
+                                "medium_risk": 0,
+                                "ok": 0,
+                                "unknown": 0,
+                                "unscanned": 0,
+                            },
+                            "mock_usages_found": 0,
+                            "control_flow_findings": 0,
+                            "strict_mocks_active": getattr(args, "strict_mocks", False),
+                            "strict_mocks_triggered": False,
+                            "strict_error_handling_active": getattr(args, "strict_error_handling", False),
+                            "strict_error_handling_triggered": False,
+                        },
+                        "control_flow": {
+                            "clean": True,
+                            "strict_gate_triggered": False,
+                            "findings": [],
+                        },
+                    },
+                    indent=2,
+                )
+            )
+            return 0
+        else:
+            print("DeployProof: No modified files detected in current session.")
+            print("Working tree is clean. Use --base <ref> or --files <path...> to evaluate specific files.")
+            return 0
 
     # 1. Run Symlink & Sandbox Escape Scanner across all session files
     symlink_result = scan_session_files_for_symlinks(session_files, repo_root=repo_root or cwd)
@@ -138,47 +199,69 @@ def handle_check(args: argparse.Namespace) -> int:
     extracted_deps = extract_all_new_dependencies(session_files, root=repo_root or cwd, base=args.base)
     dependency_result = scan_dependencies(extracted_deps)
 
-    # 4. Filter target Python files for mutation testing
+    # 4. Run Mock Usage Detector across session test files
+    mock_result = scan_session_files_for_mocks(
+        session_files=session_files,
+        root=repo_root or cwd,
+        base=args.base,
+    )
+
+    # 5. Run Control Flow & Swallowed Exception Scanner across session files
+    control_flow_result = scan_session_files_for_control_flow(
+        session_files=session_files,
+        root=repo_root or cwd,
+        base=args.base,
+    )
+
+    # 6. Filter target Python files for mutation testing
     if args.files:
-        target_files = [f for f in session_files if f.is_file() and f.suffix == ".py"]
+        non_test_files = [f for f in session_files if f.is_file() and f.suffix == ".py" and not is_test_file(f)]
+        target_files = non_test_files if non_test_files else [f for f in session_files if f.is_file() and f.suffix == ".py"]
     else:
         target_files = [f for f in session_files if f.is_file() and f.suffix == ".py" and not is_test_file(f)]
 
-    # Notify upfront if large files are in scope
-    for f in target_files:
-        try:
-            loc = len(f.read_text(encoding="utf-8", errors="replace").splitlines())
-            if loc >= LARGE_FILE_LOC_THRESHOLD:
-                try:
-                    rel = f.relative_to(repo_root or cwd)
-                except ValueError:
-                    rel = f
-                print(
-                    f"Notice: Large file '{rel}' ({loc} LOC) detected - mutation testing may take several minutes."
-                )
-        except Exception:
-            pass
+    # Notify upfront if large files are in scope (only in text mode)
+    if not getattr(args, "json", False):
+        for f in target_files:
+            try:
+                loc = len(f.read_text(encoding="utf-8", errors="replace").splitlines())
+                if loc >= LARGE_FILE_LOC_THRESHOLD:
+                    try:
+                        rel = f.relative_to(repo_root or cwd)
+                    except ValueError:
+                        rel = f
+                    print(
+                        f"Notice: Large file '{rel}' ({loc} LOC) detected - mutation testing may take several minutes."
+                    )
+            except Exception:
+                pass
 
     # Optional WSL delegation
     if getattr(args, "wsl", False):
         wsl_ready, wsl_msg = check_wsl_readiness()
         if wsl_ready:
-            print("DeployProof - Delegating to mutmut in WSL...")
+            if not getattr(args, "json", False):
+                print("DeployProof - Delegating to mutmut in WSL...")
             wsl_res = run_wsl_mutmut(repo_root or cwd, target_files)
             if wsl_res.get("success"):
-                print(wsl_res.get("stdout", ""))
+                if not getattr(args, "json", False):
+                    print(wsl_res.get("stdout", ""))
                 has_security_issue = bool(
                     secrets_result.findings
                     or symlink_result.escape_findings
                     or dependency_result.high_risk_count > 0
+                    or (getattr(args, "strict_mocks", False) and mock_result.total_findings > 0)
+                    or (getattr(args, "strict_error_handling", False) and control_flow_result.total_findings > 0)
                 )
                 return 1 if has_security_issue else 0
             else:
-                print(f"WSL execution error: {wsl_res.get('error') or wsl_res.get('stderr')}", file=sys.stderr)
-                print("Falling back to Tier 1 local pre-check...")
+                if not getattr(args, "json", False):
+                    print(f"WSL execution error: {wsl_res.get('error') or wsl_res.get('stderr')}", file=sys.stderr)
+                    print("Falling back to Tier 1 local pre-check...")
         else:
-            print(wsl_msg)
-            print("-" * 68)
+            if not getattr(args, "json", False):
+                print(wsl_msg)
+                print("-" * 68)
 
     result = run_mutation_tests(
         target_files=target_files,
@@ -187,24 +270,50 @@ def handle_check(args: argparse.Namespace) -> int:
         extra_pytest_args=args.tests,
     )
 
-    report_text = format_report(
-        result=result,
-        target_files=target_files,
-        secrets_result=secrets_result,
-        symlink_result=symlink_result,
-        dependency_result=dependency_result,
-        repo_root=repo_root or cwd,
-        threshold=args.threshold,
-    )
+    if getattr(args, "json", False):
+        report_text = format_json_report(
+            result=result,
+            target_files=target_files,
+            secrets_result=secrets_result,
+            symlink_result=symlink_result,
+            dependency_result=dependency_result,
+            mock_result=mock_result,
+            control_flow_result=control_flow_result,
+            strict_mocks=getattr(args, "strict_mocks", False),
+            strict_error_handling=getattr(args, "strict_error_handling", False),
+            repo_root=repo_root or cwd,
+            threshold=args.threshold,
+            version=__version__,
+        )
+    else:
+        report_text = format_report(
+            result=result,
+            target_files=target_files,
+            secrets_result=secrets_result,
+            symlink_result=symlink_result,
+            dependency_result=dependency_result,
+            mock_result=mock_result,
+            control_flow_result=control_flow_result,
+            strict_mocks=getattr(args, "strict_mocks", False),
+            strict_error_handling=getattr(args, "strict_error_handling", False),
+            repo_root=repo_root or cwd,
+            threshold=args.threshold,
+        )
     print(report_text)
 
-    # Fail if mutation score threshold not met, secrets detected, symlink sandbox escapes found, or hallucinated packages detected
+    # Fail if mutation score threshold not met, secrets detected, symlink sandbox escapes found, hallucinated packages detected, or strict flags triggered
+    strict_mocks_triggered = bool(getattr(args, "strict_mocks", False) and mock_result.total_findings > 0)
+    strict_error_triggered = bool(
+        getattr(args, "strict_error_handling", False) and control_flow_result.total_findings > 0
+    )
     if (
         result.mutation_score < args.threshold
         or len(result.untested_files) > 0
         or len(secrets_result.findings) > 0
         or len(symlink_result.escape_findings) > 0
         or dependency_result.high_risk_count > 0
+        or strict_mocks_triggered
+        or strict_error_triggered
     ):
         return 1
     return 0