deployproof 0.1.7__tar.gz → 0.2.0__tar.gz

{deployproof-0.1.7/src/deployproof.egg-info → deployproof-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deployproof
-Version: 0.1.7
+Version: 0.2.0
 Summary: A deterministic AI-code deployability checker that catches what coverage misses.
 Author-email: SVS Praveen <svspraveens@gmail.com>
 License-Expression: MIT
@@ -32,9 +32,11 @@ Dynamic: license-file
 
 > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
 
-[![PyPI version](https://img.shields.io/pypi/v/deployproof.svg?color=007ec6)](https://pypi.org/project/deployproof/)
-[![Python versions](https://img.shields.io/pypi/pyversions/deployproof.svg?color=3776ab)](https://pypi.org/project/deployproof/)
-[![Tests](https://img.shields.io/badge/tests-79%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.2.0-007ec6.svg)](https://pypi.org/project/deployproof/)
+[![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
+[![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
+[![Tests](https://img.shields.io/badge/tests-93%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![Stress Tests](https://img.shields.io/badge/stress%20tests-11%2F11%20passed-2ea44f.svg)](stress_fixtures/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 ---
@@ -65,7 +67,100 @@ Run all verification checks against changes in the current session (git diff):
 deployproof check
 ```
 
-Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. Exit code is non-zero on any finding that should block a push.
+Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. 
+
+### Exit Codes:
+* `0` — **PASSED**: All verification checks passed and mutation score meets threshold.
+* `1` — **FAILED**: Code quality or security gate triggered (mutation score below threshold, untested files, hardcoded secrets, sandbox-escape symlinks, hallucinated packages, or strict flags).
+* `2` — **ERROR**: Test environment failure (test suite failed to collect or execute before mutation testing began due to missing dependencies or broken imports).
+
+### Example Walkthrough
+
+Given a newly written function `calculator.py`:
+
+```python
+def calculate_discount(price: float, rate: float) -> float:
+    if rate > 0.5:
+        return price * 0.5
+    return price * (1.0 - rate)
+```
+
+With an AI-generated test that achieves 100% line coverage by only asserting standard discounts (`rate = 0.2`):
+
+```python
+def test_calculate_discount_basic():
+    assert calculate_discount(100.0, 0.2) == 80.0
+```
+
+Running `deployproof check` mutates AST operators and detects that boundary conditions and threshold caps are untested:
+
+```
+$ deployproof check
+
+DeployProof - LOCAL PRE-CHECK (approximate) - not the verified score
+====================================================================
+
+Target Scope (1 file evaluated):
+  * calculator.py
+
+Symlink & Sandbox Escape Scan (CWE-61/CWE-451):
+  Clean: No symlinks or sandbox-escape traversal links detected across 1 session file.
+
+Secrets & Credentials Pre-Push Scan:
+  Clean: No hardcoded secrets or tracked .env files detected across 1 session file.
+
+Dependency & Slopsquatting Scan (PyPI Registry & Age Analysis):
+  Clean: No new external packages introduced across 1 session file.
+
+Mock Usage Introduced (flagged for review):
+  Clean: No modified test files in scope.
+
+Control Flow & Error Handling (flagged for review):
+  Clean: No bare excepts, swallowed exceptions, or unreachable code detected across 1 session file.
+
+Local Pre-Check Mutation Verification:
+  Score:  57.1% (4/7 mutants killed)
+  Status: FAILED (score 57.1% below 80.0%) (threshold: 80.0%)
+  Time:   2.27s
+
+Skipped Constructs: None (No known unsupported constructs detected)
+
+Surviving Mutants (3 unverified changes):
+
+  [1] calculator.py:2
+      Mutation: Replace numeric constant '0.5' with '1.5'
+      Original: if rate > 0.5:
+      Mutated:  if rate > 1.5:
+
+  [2] calculator.py:3
+      Mutation: Replace numeric constant '0.5' with '1.5'
+      Original: return price * 0.5
+      Mutated:  return price * 1.5
+
+  [3] calculator.py:3
+      Mutation: Replace binary operator '*' with '/'
+      Original: return price * 0.5
+      Mutated:  return price / 0.5
+
+====================================================================
+Notice: Local pre-check only. Full verified score runs in CI on push (via mutmut).
+Pre-check FAILED: Score 57.1% is below threshold 80.0% (3 surviving mutants).
+```
+
+Adding tests for threshold cap (`rate = 0.8`) and exact boundary (`rate = 0.5`) kills all mutants:
+
+```
+Local Pre-Check Mutation Verification:
+  Score:  100.0% (7/7 mutants killed)
+  Status: PASSED (threshold: 80.0%)
+  Time:   2.31s
+
+Surviving Mutants: None (All generated mutants caught by test suite)
+
+====================================================================
+Notice: Local pre-check only. Full verified score runs in CI on push (via mutmut).
+Pre-check clean: 100% of tested basic mutations caught.
+```
 
 ### CLI Options & Flags
 
@@ -80,6 +175,8 @@ Output includes a section for each check — symlink scan, secrets scan, depende
 | `deployproof check --base <ref>` | Base git ref (branch/commit/tag) to diff against. |
 | `deployproof check --wsl` | Delegate mutation testing to `mutmut` inside WSL (Windows only). |
 
+> **Note:** `deployproof check --wsl` (Windows only) is newer and less battle-tested than the core checks — [file an issue](https://github.com/SVSPraveen/DeployProof/issues) if you hit something.
+
 ### Machine-Readable Output (`--json`)
 
 DeployProof provides a stable structured JSON schema for CI/CD pipelines, IDEs, and automation:
@@ -92,7 +189,7 @@ deployproof check --json
 
 ```json
 {
-  "version": "0.1.7",
+  "version": "0.2.0",
   "status": "passed",
   "summary": {
     "target_files_count": 1,
@@ -165,7 +262,7 @@ deployproof check --json
 
 ## What It Checks
 
-- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage.
+- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage. Features atomic file restoration protected by `SIGINT`/`SIGTERM`/`SIGBREAK` signal handlers to ensure interrupted runs never leave mutated code on disk.
 - **Secrets and Credentials** — Scans modified files for hardcoded API keys (OpenAI, Anthropic, AWS, GitHub, Stripe, private keys) and tracked `.env` files using pattern matching and entropy analysis.
 - **Symlink and Sandbox Escape** — Resolves symbolic links and flags any whose target escapes the repository root (CWE-61 / CWE-451). Catches the class of path-traversal trick used in the GhostApproval disclosure (Wiz Research, July 2026).
 - **Dependency and Slopsquatting** — For each new import, dynamic import (`importlib.import_module`, `__import__`), or manifest entry (including recursive `-r` includes) introduced in the diff, queries the PyPI JSON API and checks registration age. Packages that don't exist (HTTP 404) are flagged HIGH RISK; packages registered within the last 30 days are flagged MEDIUM RISK.
@@ -181,17 +278,17 @@ deployproof check --json
 
 ## See It Catch Real Bugs
 
-Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 7 planted edge cases:
+Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 11 planted edge cases:
 
 ```bash
 python stress_fixtures/run_stress_tests.py
 ```
 
-Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, and GhostApproval sandbox-escape traps.
+Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, GhostApproval sandbox-escape traps, swallowed exceptions/dead code, and mock-masked broken implementations.
 
 ## Status & Roadmap
 
-- **Current (v0.1.7):** Diff-scoped AST mutation testing, secrets scanner (including unquoted .env values), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with recursive `-r` requirements scanning and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks` and deduplicated decorator detection), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Current (v0.2.0):** Diff-scoped AST mutation testing (with recursive `test/`/`tests/` discovery, AST column-offset snippet reconstruction, and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner (including unquoted .env values and prefix validation), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, 93 unit tests, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
 - **Next:** Multi-language mutation support and expanded ecosystem rule packs.
 
 ## Contributing

{deployproof-0.1.7 → deployproof-0.2.0}/README.md

@@ -2,9 +2,11 @@
 
 > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
 
-[![PyPI version](https://img.shields.io/pypi/v/deployproof.svg?color=007ec6)](https://pypi.org/project/deployproof/)
-[![Python versions](https://img.shields.io/pypi/pyversions/deployproof.svg?color=3776ab)](https://pypi.org/project/deployproof/)
-[![Tests](https://img.shields.io/badge/tests-79%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.2.0-007ec6.svg)](https://pypi.org/project/deployproof/)
+[![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
+[![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
+[![Tests](https://img.shields.io/badge/tests-93%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![Stress Tests](https://img.shields.io/badge/stress%20tests-11%2F11%20passed-2ea44f.svg)](stress_fixtures/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 ---
@@ -35,7 +37,100 @@ Run all verification checks against changes in the current session (git diff):
 deployproof check
 ```
 
-Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. Exit code is non-zero on any finding that should block a push.
+Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. 
+
+### Exit Codes:
+* `0` — **PASSED**: All verification checks passed and mutation score meets threshold.
+* `1` — **FAILED**: Code quality or security gate triggered (mutation score below threshold, untested files, hardcoded secrets, sandbox-escape symlinks, hallucinated packages, or strict flags).
+* `2` — **ERROR**: Test environment failure (test suite failed to collect or execute before mutation testing began due to missing dependencies or broken imports).
+
+### Example Walkthrough
+
+Given a newly written function `calculator.py`:
+
+```python
+def calculate_discount(price: float, rate: float) -> float:
+    if rate > 0.5:
+        return price * 0.5
+    return price * (1.0 - rate)
+```
+
+With an AI-generated test that achieves 100% line coverage by only asserting standard discounts (`rate = 0.2`):
+
+```python
+def test_calculate_discount_basic():
+    assert calculate_discount(100.0, 0.2) == 80.0
+```
+
+Running `deployproof check` mutates AST operators and detects that boundary conditions and threshold caps are untested:
+
+```
+$ deployproof check
+
+DeployProof - LOCAL PRE-CHECK (approximate) - not the verified score
+====================================================================
+
+Target Scope (1 file evaluated):
+  * calculator.py
+
+Symlink & Sandbox Escape Scan (CWE-61/CWE-451):
+  Clean: No symlinks or sandbox-escape traversal links detected across 1 session file.
+
+Secrets & Credentials Pre-Push Scan:
+  Clean: No hardcoded secrets or tracked .env files detected across 1 session file.
+
+Dependency & Slopsquatting Scan (PyPI Registry & Age Analysis):
+  Clean: No new external packages introduced across 1 session file.
+
+Mock Usage Introduced (flagged for review):
+  Clean: No modified test files in scope.
+
+Control Flow & Error Handling (flagged for review):
+  Clean: No bare excepts, swallowed exceptions, or unreachable code detected across 1 session file.
+
+Local Pre-Check Mutation Verification:
+  Score:  57.1% (4/7 mutants killed)
+  Status: FAILED (score 57.1% below 80.0%) (threshold: 80.0%)
+  Time:   2.27s
+
+Skipped Constructs: None (No known unsupported constructs detected)
+
+Surviving Mutants (3 unverified changes):
+
+  [1] calculator.py:2
+      Mutation: Replace numeric constant '0.5' with '1.5'
+      Original: if rate > 0.5:
+      Mutated:  if rate > 1.5:
+
+  [2] calculator.py:3
+      Mutation: Replace numeric constant '0.5' with '1.5'
+      Original: return price * 0.5
+      Mutated:  return price * 1.5
+
+  [3] calculator.py:3
+      Mutation: Replace binary operator '*' with '/'
+      Original: return price * 0.5
+      Mutated:  return price / 0.5
+
+====================================================================
+Notice: Local pre-check only. Full verified score runs in CI on push (via mutmut).
+Pre-check FAILED: Score 57.1% is below threshold 80.0% (3 surviving mutants).
+```
+
+Adding tests for threshold cap (`rate = 0.8`) and exact boundary (`rate = 0.5`) kills all mutants:
+
+```
+Local Pre-Check Mutation Verification:
+  Score:  100.0% (7/7 mutants killed)
+  Status: PASSED (threshold: 80.0%)
+  Time:   2.31s
+
+Surviving Mutants: None (All generated mutants caught by test suite)
+
+====================================================================
+Notice: Local pre-check only. Full verified score runs in CI on push (via mutmut).
+Pre-check clean: 100% of tested basic mutations caught.
+```
 
 ### CLI Options & Flags
 
@@ -50,6 +145,8 @@ Output includes a section for each check — symlink scan, secrets scan, depende
 | `deployproof check --base <ref>` | Base git ref (branch/commit/tag) to diff against. |
 | `deployproof check --wsl` | Delegate mutation testing to `mutmut` inside WSL (Windows only). |
 
+> **Note:** `deployproof check --wsl` (Windows only) is newer and less battle-tested than the core checks — [file an issue](https://github.com/SVSPraveen/DeployProof/issues) if you hit something.
+
 ### Machine-Readable Output (`--json`)
 
 DeployProof provides a stable structured JSON schema for CI/CD pipelines, IDEs, and automation:
@@ -62,7 +159,7 @@ deployproof check --json
 
 ```json
 {
-  "version": "0.1.7",
+  "version": "0.2.0",
   "status": "passed",
   "summary": {
     "target_files_count": 1,
@@ -135,7 +232,7 @@ deployproof check --json
 
 ## What It Checks
 
-- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage.
+- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage. Features atomic file restoration protected by `SIGINT`/`SIGTERM`/`SIGBREAK` signal handlers to ensure interrupted runs never leave mutated code on disk.
 - **Secrets and Credentials** — Scans modified files for hardcoded API keys (OpenAI, Anthropic, AWS, GitHub, Stripe, private keys) and tracked `.env` files using pattern matching and entropy analysis.
 - **Symlink and Sandbox Escape** — Resolves symbolic links and flags any whose target escapes the repository root (CWE-61 / CWE-451). Catches the class of path-traversal trick used in the GhostApproval disclosure (Wiz Research, July 2026).
 - **Dependency and Slopsquatting** — For each new import, dynamic import (`importlib.import_module`, `__import__`), or manifest entry (including recursive `-r` includes) introduced in the diff, queries the PyPI JSON API and checks registration age. Packages that don't exist (HTTP 404) are flagged HIGH RISK; packages registered within the last 30 days are flagged MEDIUM RISK.
@@ -151,17 +248,17 @@ deployproof check --json
 
 ## See It Catch Real Bugs
 
-Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 7 planted edge cases:
+Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 11 planted edge cases:
 
 ```bash
 python stress_fixtures/run_stress_tests.py
 ```
 
-Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, and GhostApproval sandbox-escape traps.
+Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, GhostApproval sandbox-escape traps, swallowed exceptions/dead code, and mock-masked broken implementations.
 
 ## Status & Roadmap
 
-- **Current (v0.1.7):** Diff-scoped AST mutation testing, secrets scanner (including unquoted .env values), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with recursive `-r` requirements scanning and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks` and deduplicated decorator detection), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Current (v0.2.0):** Diff-scoped AST mutation testing (with recursive `test/`/`tests/` discovery, AST column-offset snippet reconstruction, and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner (including unquoted .env values and prefix validation), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, 93 unit tests, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
 - **Next:** Multi-language mutation support and expanded ecosystem rule packs.
 
 ## Contributing

{deployproof-0.1.7 → deployproof-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "deployproof"
-version = "0.1.7"
+version = "0.2.0"
 description = "A deterministic AI-code deployability checker that catches what coverage misses."
 readme = "README.md"
 requires-python = ">=3.10"

deployproof-0.2.0/src/deployproof/__init__.py

@@ -0,0 +1,2 @@
+"""DeployProof - Deterministic AI-Code Deployability Checker."""
+__version__ = "0.2.0"

deployproof-0.2.0/src/deployproof/cli.py

@@ -0,0 +1,179 @@
+"""Command-line interface for DeployProof."""
+import argparse
+import sys
+from pathlib import Path
+from typing import List, Optional
+from deployproof import __version__
+from deployproof.dependencies import extract_all_new_dependencies, scan_dependencies
+from deployproof.control_flow import scan_session_files_for_control_flow
+from deployproof.diff import DiffScopeError, InvalidBaseRefError, NotAGitRepositoryError, get_git_root, is_test_file, resolve_changed_python_files, resolve_changed_session_files
+from deployproof.mocks import scan_session_files_for_mocks
+from deployproof.mutator import run_mutation_tests
+from deployproof.reporter import LARGE_FILE_LOC_THRESHOLD, format_json_report, format_report
+from deployproof.secrets import scan_session_files_for_secrets
+from deployproof.symlinks import scan_session_files_for_symlinks
+from deployproof.wsl import check_wsl_readiness, run_wsl_mutmut
+
+def create_parser() -> argparse.ArgumentParser:
+    """Create and configure the command-line argument parser."""
+    parser = argparse.ArgumentParser(prog='deployproof', description='DeployProof: A deterministic AI-code deployability checker.')
+    parser.add_argument('-v', '--version', action='version', version=f'%(prog)s {__version__}', help="Show program's version number and exit.")
+    subparsers = parser.add_subparsers(dest='command', help='Available commands')
+    check_parser = subparsers.add_parser('check', help='Run deployability verification checks against session changes.')
+    check_parser.add_argument('--base', type=str, default=None, help='Base git ref (branch/commit/tag) to diff against.')
+    check_parser.add_argument('--files', nargs='+', type=str, default=None, help='Explicit files to evaluate (bypasses git diff).')
+    check_parser.add_argument('--tests', nargs='+', type=str, default=None, help='Specific test file(s) or directories to execute.')
+    check_parser.add_argument('--threshold', type=float, default=80.0, help='Minimum mutation score percentage to pass (default: 80.0).')
+    check_parser.add_argument('--timeout', type=float, default=10.0, help='Test runner timeout in seconds per mutant (default: 10.0).')
+    check_parser.add_argument('--wsl', action='store_true', default=False, help='Delegate mutation testing to mutmut inside WSL (Windows only).')
+    check_parser.add_argument('--strict-mocks', action='store_true', default=False, help='Fail the verification gate if new mock or monkeypatch usage is introduced in test files.')
+    check_parser.add_argument('--strict-error-handling', action='store_true', default=False, help='Fail the verification gate if bare excepts, swallowed exceptions, or unreachable code are detected.')
+    check_parser.add_argument('--json', action='store_true', default=False, help='Output check results as a structured JSON object.')
+    subparsers.add_parser('init', help='Initialize DeployProof configuration in the current repository.')
+    return parser
+
+def handle_check(args: argparse.Namespace) -> int:
+    """Handle the 'check' subcommand."""
+    cwd = Path.cwd().resolve()
+    repo_root: Optional[Path] = None
+    try:
+        if args.files:
+            session_files = [Path(f).resolve() for f in args.files]
+            if session_files:
+                try:
+                    repo_root = get_git_root(session_files[0].parent)
+                except DiffScopeError:
+                    repo_root = session_files[0].parent
+            else:
+                repo_root = cwd
+        else:
+            repo_root = get_git_root(cwd)
+            session_files = resolve_changed_session_files(cwd=cwd, base=args.base)
+    except NotAGitRepositoryError:
+        print('Error: Not a git repository. Initialize git or specify files with --files.', file=sys.stderr)
+        return 1
+    except InvalidBaseRefError as e:
+        print(f'Error: {e}', file=sys.stderr)
+        return 1
+    except DiffScopeError as e:
+        print(f'Error: {e}', file=sys.stderr)
+        return 1
+    if not session_files:
+        if getattr(args, 'json', False):
+            import json
+            print(json.dumps({'version': __version__, 'status': 'passed', 'message': 'No modified files detected in current session.', 'scope': {'target_files': []}, 'summary': {'target_files_count': 0, 'mutation_score': 100.0, 'threshold': args.threshold, 'secrets_found': 0, 'symlink_escapes_found': 0, 'dependency_findings': {'high_risk': 0, 'medium_risk': 0, 'ok': 0, 'unknown': 0, 'unscanned': 0}, 'mock_usages_found': 0, 'control_flow_findings': 0, 'strict_mocks_active': getattr(args, 'strict_mocks', False), 'strict_mocks_triggered': False, 'strict_error_handling_active': getattr(args, 'strict_error_handling', False), 'strict_error_handling_triggered': False}, 'control_flow': {'clean': True, 'strict_gate_triggered': False, 'findings': []}}, indent=2))
+            return 0
+        else:
+            print('DeployProof: No modified files detected in current session.')
+            print('Working tree is clean. Use --base <ref> or --files <path...> to evaluate specific files.')
+            return 0
+    symlink_result = scan_session_files_for_symlinks(session_files, repo_root=repo_root or cwd)
+    secrets_result = scan_session_files_for_secrets(session_files)
+    extracted_deps = extract_all_new_dependencies(session_files, root=repo_root or cwd, base=args.base)
+    dependency_result = scan_dependencies(extracted_deps)
+    mock_result = scan_session_files_for_mocks(session_files=session_files, root=repo_root or cwd, base=args.base)
+    control_flow_result = scan_session_files_for_control_flow(session_files=session_files, root=repo_root or cwd, base=args.base)
+    if args.files:
+        non_test_files = [f for f in session_files if f.is_file() and f.suffix == '.py' and (not is_test_file(f))]
+        target_files = non_test_files if non_test_files else [f for f in session_files if f.is_file() and f.suffix == '.py']
+    else:
+        target_files = [f for f in session_files if f.is_file() and f.suffix == '.py' and (not is_test_file(f))]
+    if not getattr(args, 'json', False):
+        for f in target_files:
+            try:
+                loc = len(f.read_text(encoding='utf-8', errors='replace').splitlines())
+                if loc < LARGE_FILE_LOC_THRESHOLD:
+                    try:
+                        rel = f.relative_to(repo_root or cwd)
+                    except ValueError:
+                        rel = f
+                    print(f"Notice: Large file '{rel}' ({loc} LOC) detected - mutation testing may take several minutes.")
+            except Exception:
+                pass
+    if getattr(args, 'wsl', False):
+        wsl_ready, wsl_msg = check_wsl_readiness()
+        if wsl_ready:
+            if not getattr(args, 'json', False):
+                print('DeployProof - Delegating to mutmut in WSL...')
+            wsl_res = run_wsl_mutmut(repo_root or cwd, target_files)
+            if wsl_res.get('success'):
+                if not getattr(args, 'json', False):
+                    print(wsl_res.get('stdout', ''))
+                has_security_issue = bool(secrets_result.findings or symlink_result.escape_findings or dependency_result.high_risk_count > 0 or (getattr(args, 'strict_mocks', False) and mock_result.total_findings > 0) or (getattr(args, 'strict_error_handling', False) and control_flow_result.total_findings > 0))
+                return 1 if has_security_issue else 0
+            elif not getattr(args, 'json', False):
+                print(f"WSL execution error: {wsl_res.get('error') or wsl_res.get('stderr')}", file=sys.stderr)
+                print('Falling back to Tier 1 local pre-check...')
+        elif not getattr(args, 'json', False):
+            print(wsl_msg)
+            print('-' * 68)
+    result = run_mutation_tests(target_files=target_files, repo_root=repo_root or cwd, test_runner_timeout=args.timeout, extra_pytest_args=args.tests)
+    if getattr(args, 'json', False):
+        report_text = format_json_report(result=result, target_files=target_files, secrets_result=secrets_result, symlink_result=symlink_result, dependency_result=dependency_result, mock_result=mock_result, control_flow_result=control_flow_result, strict_mocks=getattr(args, 'strict_mocks', False), strict_error_handling=getattr(args, 'strict_error_handling', False), repo_root=repo_root or cwd, threshold=args.threshold, version=__version__)
+    else:
+        report_text = format_report(result=result, target_files=target_files, secrets_result=secrets_result, symlink_result=symlink_result, dependency_result=dependency_result, mock_result=mock_result, control_flow_result=control_flow_result, strict_mocks=getattr(args, 'strict_mocks', False), strict_error_handling=getattr(args, 'strict_error_handling', False), repo_root=repo_root or cwd, threshold=args.threshold)
+    print(report_text)
+    if result.collection_error:
+        return 2
+    strict_mocks_triggered = bool(getattr(args, 'strict_mocks', False) and mock_result.total_findings > 0)
+    strict_error_triggered = bool(getattr(args, 'strict_error_handling', True) and control_flow_result.total_findings > 0)
+    if result.mutation_score is not None and result.mutation_score < args.threshold or len(result.untested_files) > 0 or len(secrets_result.findings) > 0 or (len(symlink_result.escape_findings) > 0) or (dependency_result.high_risk_count > 0) or strict_mocks_triggered or strict_error_triggered:
+        return 1
+    return 0
+
+def handle_init(args: argparse.Namespace) -> int:
+    """Handle the 'init' subcommand to initialize configuration and git hooks."""
+    cwd = Path.cwd().resolve()
+    try:
+        repo_root = get_git_root(cwd)
+    except DiffScopeError:
+        repo_root = cwd
+    print(f'DeployProof: Initializing in {repo_root}...')
+    config_path = repo_root / '.deployproof.json'
+    if not config_path.exists():
+        import json
+        default_config = {'version': __version__, 'threshold': 80.0, 'timeout': 10.0, 'secrets_scanning': True, 'symlink_scanning': True, 'dependency_scanning': True}
+        config_path.write_text(json.dumps(default_config, indent=2) + '\n', encoding='utf-8')
+        print(f'  [+] Created configuration file: {config_path.name}')
+    else:
+        print(f'  [.] Configuration file already exists: {config_path.name}')
+    hooks_dir = repo_root / '.git' / 'hooks'
+    if hooks_dir.is_dir():
+        pre_push_hook = hooks_dir / 'pre-push'
+        hook_script = '#!/usr/bin/env sh\n# DeployProof deterministic pre-push verification gate\ndeployproof check\n'
+        pre_push_hook.write_text(hook_script, encoding='utf-8')
+        try:
+            import stat
+            pre_push_hook.chmod(pre_push_hook.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+        except Exception:
+            pass
+        print('  [+] Installed git pre-push hook: .git/hooks/pre-push')
+    else:
+        print('  [i] Note: .git/hooks directory not found. Initialize git to enable automatic pre-push gating.')
+    print("\nDeployProof initialization complete. Run 'deployproof check' to verify your session changes.")
+    return 0
+
+def main(argv: Optional[List[str]]=None) -> int:
+    """Entry point for the DeployProof CLI."""
+    if hasattr(sys.stdout, 'reconfigure'):
+        try:
+            sys.stdout.reconfigure(errors='replace')
+        except Exception:
+            pass
+    if hasattr(sys.stderr, 'reconfigure'):
+        try:
+            sys.stderr.reconfigure(errors='replace')
+        except Exception:
+            pass
+    parser = create_parser()
+    args = parser.parse_args(argv)
+    if not args.command:
+        parser.print_help()
+        return 0
+    if args.command == 'check':
+        return handle_check(args)
+    elif args.command == 'init':
+        return handle_init(args)
+    return 0
+if __name__ == '__main__':
+    sys.exit(main())