deployproof 1.1.0__tar.gz → 1.1.11__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (40) hide show
  1. {deployproof-1.1.0/src/deployproof.egg-info → deployproof-1.1.11}/PKG-INFO +26 -10
  2. {deployproof-1.1.0 → deployproof-1.1.11}/README.md +23 -7
  3. {deployproof-1.1.0 → deployproof-1.1.11}/pyproject.toml +7 -5
  4. deployproof-1.1.11/src/deployproof/__init__.py +2 -0
  5. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/dependencies.py +1 -1
  6. {deployproof-1.1.0 → deployproof-1.1.11/src/deployproof.egg-info}/PKG-INFO +26 -10
  7. deployproof-1.1.0/src/deployproof/__init__.py +0 -2
  8. {deployproof-1.1.0 → deployproof-1.1.11}/LICENSE +0 -0
  9. {deployproof-1.1.0 → deployproof-1.1.11}/setup.cfg +0 -0
  10. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/cli.py +0 -0
  11. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/control_flow.py +0 -0
  12. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/coverage_plugin.py +0 -0
  13. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/diff.py +0 -0
  14. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/mocks.py +0 -0
  15. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/mutator.py +0 -0
  16. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/reporter.py +0 -0
  17. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/secrets.py +0 -0
  18. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/symlinks.py +0 -0
  19. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/wsl.py +0 -0
  20. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof.egg-info/SOURCES.txt +0 -0
  21. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof.egg-info/dependency_links.txt +0 -0
  22. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof.egg-info/entry_points.txt +0 -0
  23. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof.egg-info/requires.txt +0 -0
  24. {deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof.egg-info/top_level.txt +0 -0
  25. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_baseline_collection_error.py +0 -0
  26. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_cli.py +0 -0
  27. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_cli_dependency_scan.py +0 -0
  28. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_control_flow.py +0 -0
  29. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_dependencies_extractor.py +0 -0
  30. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_dependencies_pypi.py +0 -0
  31. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_diff.py +0 -0
  32. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_edge_cases_validation.py +0 -0
  33. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_import_graph_discovery.py +0 -0
  34. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_mocks.py +0 -0
  35. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_mutation_suites.py +0 -0
  36. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_mutator.py +0 -0
  37. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_secrets.py +0 -0
  38. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_stress_regressions.py +0 -0
  39. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_symlinks.py +0 -0
  40. {deployproof-1.1.0 → deployproof-1.1.11}/tests/test_wsl.py +0 -0
{deployproof-1.1.0/src/deployproof.egg-info → deployproof-1.1.11}/PKG-INFO RENAMED
@@ -1,14 +1,14 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: deployproof
3
- Version: 1.1.0
4
- Summary: A deterministic AI-code deployability checker that catches what coverage misses.
3
+ Version: 1.1.11
4
+ Summary: Deterministic pre-push quality & security verification gate for Python codebases that catches what coverage misses.
5
5
  Author-email: SVS Praveen <svspraveens@gmail.com>
6
6
  License-Expression: MIT
7
7
  Project-URL: Homepage, https://github.com/SVSPraveen/DeployProof
8
8
  Project-URL: Documentation, https://github.com/SVSPraveen/DeployProof#readme
9
9
  Project-URL: Repository, https://github.com/SVSPraveen/DeployProof.git
10
10
  Project-URL: Bug Tracker, https://github.com/SVSPraveen/DeployProof/issues
11
- Keywords: ai-code,mutation-testing,security-scanner,slopsquatting,ghostapproval,pre-push-verification,ast-analysis,dependency-security
11
+ Keywords: code-quality,mutation-testing,security-scanner,developer-tools,pre-push-verification,python-testing,ast-analysis,dependency-security,ai-code,slopsquatting
12
12
  Classifier: Development Status :: 3 - Alpha
13
13
  Classifier: Intended Audience :: Developers
14
14
  Classifier: Programming Language :: Python :: 3
@@ -31,9 +31,9 @@ Dynamic: license-file
31
31
 
32
32
  # DeployProof
33
33
 
34
- > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
34
+ > Deterministic pre-push quality & security gate for modern Python codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense. Built for human engineering teams and AI-assisted workflows alike.
35
35
 
36
- [![PyPI version](https://img.shields.io/badge/pypi-v1.1.0-007ec6.svg)](https://pypi.org/project/deployproof/)
36
+ [![PyPI version](https://img.shields.io/badge/pypi-v1.1.11-007ec6.svg)](https://pypi.org/project/deployproof/)
37
37
  [![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
38
38
  [![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
39
39
  [![Tests](https://img.shields.io/badge/tests-111%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
@@ -44,17 +44,29 @@ Dynamic: license-file
44
44
 
45
45
  ## Why This Exists
46
46
 
47
- AI-assisted development introduces subtle failure modes that standard linters and coverage tools miss: test suites with high line coverage but near-zero mutation scores, hardcoded credentials generated in passing, symlinks that deceive approval prompts into escaping the repository sandbox, silently swallowed exceptions, and package names hallucinated by LLMs that don't exist on PyPI. DeployProof catches these at the pre-push stage, before they reach CI or production.
47
+ Modern software development — whether crafted by human engineering teams or generated through AI coding assistants — introduces subtle failure modes that standard linters and line-coverage metrics completely miss:
48
+
49
+ * **Deceptive Test Suites**: Test suites boasting 90%+ line coverage that never assert true correctness, masking near-zero mutation scores.
50
+ * **Accidental Credential Exposure**: Hardcoded API keys, bearer tokens, or service credentials generated in passing or pasted into tests.
51
+ * **Sandbox Escape Risks**: Symlinks that deceive tool approval prompts into breaking outside the repository sandbox.
52
+ * **Silently Swallowed Exceptions**: Blanket `except Exception: pass` anti-patterns that hide critical runtime bugs.
53
+ * **Dependency Hallucinations & Slopsquatting**: Package names invented by LLMs or mistyped dependencies that don't exist on public PyPI.
54
+
55
+ DeployProof serves as an uncompromising, deterministic pre-push gate that validates code quality, test integrity, and security locally before any commit reaches CI or production.
48
56
 
49
57
  > **Privacy & Security Guarantee**: DeployProof runs 100% locally on your machine. It makes zero outbound network calls, except for querying the official PyPI registry (JSON API) to verify that newly introduced dependencies exist and are not hallucinated. DeployProof sends no source code, telemetry, test results, or secret findings to any external server.
50
58
 
51
59
  ## Install
52
60
 
53
61
  ```bash
62
+ # Recommended — installs into an isolated environment, exposes the CLI globally
63
+ pipx install deployproof
64
+
65
+ # Or via pip into your current environment
54
66
  pip install deployproof
55
67
  ```
56
68
 
57
- Requires Python 3.10+.
69
+ Requires Python 3.10+. If you don't have `pipx`, install it with `pip install pipx` then run `pipx ensurepath`.
58
70
 
59
71
  ## How to Use DeployProof
60
72
 
@@ -86,7 +98,11 @@ deployproof check --full-repo --workers 8
86
98
  ```
87
99
 
88
100
  #### Real-World Timing Expectations:
89
- | Scan Mode | Target Scope | Typical Duration | Intended Use Case |
101
+
102
+ > [!NOTE]
103
+ > **Estimated Timings Disclaimer**: The durations below are empirical estimates based on benchmark runs across various open-source projects (such as `requests`, `click`, and `colorama`). Actual execution time may be **higher or lower** depending on your specific test suite execution speed (e.g., pure unit tests vs. heavy integration/database tests), test runner timeout settings (`--timeout`), hardware profile (CPU core clock speed, available RAM), and codebase complexity.
104
+
105
+ | Scan Mode | Target Scope | Estimated Duration* | Intended Use Case |
90
106
  | :--- | :--- | :--- | :--- |
91
107
  | **`deployproof check`** | Git Diff (1–3 modified files) | **2 – 5 seconds** | Local pre-commit, active AI IDE coding loops, pre-push sanity checks. |
92
108
  | **`deployproof check --workers 8`** | Large Multi-File Diff (100+ mutants) | **1 – 3 minutes** | Large feature branch reviews, refactors. |
@@ -289,7 +305,7 @@ deployproof check --json
289
305
 
290
306
  ```json
291
307
  {
292
- "version": "1.1.0",
308
+ "version": "1.1.11",
293
309
  "status": "passed",
294
310
  "summary": {
295
311
  "target_files_count": 1,
@@ -389,7 +405,7 @@ Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS cr
389
405
 
390
406
  ## Status & Roadmap
391
407
 
392
- - **Current (v1.1.0):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
408
+ - **Current (v1.1.11):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
393
409
  - **Next:** Reverse test-to-source dependency mapping (see `FUTURE_SCOPE.md`), SARIF 2.1.0 PR annotations, and multi-language mutation rule packs.
394
410
 
395
411
  ## Contributing
{deployproof-1.1.0 → deployproof-1.1.11}/README.md RENAMED
@@ -1,8 +1,8 @@
1
1
  # DeployProof
2
2
 
3
- > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
3
+ > Deterministic pre-push quality & security gate for modern Python codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense. Built for human engineering teams and AI-assisted workflows alike.
4
4
 
5
- [![PyPI version](https://img.shields.io/badge/pypi-v1.1.0-007ec6.svg)](https://pypi.org/project/deployproof/)
5
+ [![PyPI version](https://img.shields.io/badge/pypi-v1.1.11-007ec6.svg)](https://pypi.org/project/deployproof/)
6
6
  [![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
7
7
  [![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
8
8
  [![Tests](https://img.shields.io/badge/tests-111%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
@@ -13,17 +13,29 @@
13
13
 
14
14
  ## Why This Exists
15
15
 
16
- AI-assisted development introduces subtle failure modes that standard linters and coverage tools miss: test suites with high line coverage but near-zero mutation scores, hardcoded credentials generated in passing, symlinks that deceive approval prompts into escaping the repository sandbox, silently swallowed exceptions, and package names hallucinated by LLMs that don't exist on PyPI. DeployProof catches these at the pre-push stage, before they reach CI or production.
16
+ Modern software development — whether crafted by human engineering teams or generated through AI coding assistants — introduces subtle failure modes that standard linters and line-coverage metrics completely miss:
17
+
18
+ * **Deceptive Test Suites**: Test suites boasting 90%+ line coverage that never assert true correctness, masking near-zero mutation scores.
19
+ * **Accidental Credential Exposure**: Hardcoded API keys, bearer tokens, or service credentials generated in passing or pasted into tests.
20
+ * **Sandbox Escape Risks**: Symlinks that deceive tool approval prompts into breaking outside the repository sandbox.
21
+ * **Silently Swallowed Exceptions**: Blanket `except Exception: pass` anti-patterns that hide critical runtime bugs.
22
+ * **Dependency Hallucinations & Slopsquatting**: Package names invented by LLMs or mistyped dependencies that don't exist on public PyPI.
23
+
24
+ DeployProof serves as an uncompromising, deterministic pre-push gate that validates code quality, test integrity, and security locally before any commit reaches CI or production.
17
25
 
18
26
  > **Privacy & Security Guarantee**: DeployProof runs 100% locally on your machine. It makes zero outbound network calls, except for querying the official PyPI registry (JSON API) to verify that newly introduced dependencies exist and are not hallucinated. DeployProof sends no source code, telemetry, test results, or secret findings to any external server.
19
27
 
20
28
  ## Install
21
29
 
22
30
  ```bash
31
+ # Recommended — installs into an isolated environment, exposes the CLI globally
32
+ pipx install deployproof
33
+
34
+ # Or via pip into your current environment
23
35
  pip install deployproof
24
36
  ```
25
37
 
26
- Requires Python 3.10+.
38
+ Requires Python 3.10+. If you don't have `pipx`, install it with `pip install pipx` then run `pipx ensurepath`.
27
39
 
28
40
  ## How to Use DeployProof
29
41
 
@@ -55,7 +67,11 @@ deployproof check --full-repo --workers 8
55
67
  ```
56
68
 
57
69
  #### Real-World Timing Expectations:
58
- | Scan Mode | Target Scope | Typical Duration | Intended Use Case |
70
+
71
+ > [!NOTE]
72
+ > **Estimated Timings Disclaimer**: The durations below are empirical estimates based on benchmark runs across various open-source projects (such as `requests`, `click`, and `colorama`). Actual execution time may be **higher or lower** depending on your specific test suite execution speed (e.g., pure unit tests vs. heavy integration/database tests), test runner timeout settings (`--timeout`), hardware profile (CPU core clock speed, available RAM), and codebase complexity.
73
+
74
+ | Scan Mode | Target Scope | Estimated Duration* | Intended Use Case |
59
75
  | :--- | :--- | :--- | :--- |
60
76
  | **`deployproof check`** | Git Diff (1–3 modified files) | **2 – 5 seconds** | Local pre-commit, active AI IDE coding loops, pre-push sanity checks. |
61
77
  | **`deployproof check --workers 8`** | Large Multi-File Diff (100+ mutants) | **1 – 3 minutes** | Large feature branch reviews, refactors. |
@@ -258,7 +274,7 @@ deployproof check --json
258
274
 
259
275
  ```json
260
276
  {
261
- "version": "1.1.0",
277
+ "version": "1.1.11",
262
278
  "status": "passed",
263
279
  "summary": {
264
280
  "target_files_count": 1,
@@ -358,7 +374,7 @@ Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS cr
358
374
 
359
375
  ## Status & Roadmap
360
376
 
361
- - **Current (v1.1.0):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
377
+ - **Current (v1.1.11):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
362
378
  - **Next:** Reverse test-to-source dependency mapping (see `FUTURE_SCOPE.md`), SARIF 2.1.0 PR annotations, and multi-language mutation rule packs.
363
379
 
364
380
  ## Contributing
{deployproof-1.1.0 → deployproof-1.1.11}/pyproject.toml RENAMED
@@ -4,8 +4,8 @@ build-backend = "setuptools.build_meta"
4
4
 
5
5
  [project]
6
6
  name = "deployproof"
7
- version = "1.1.0"
8
- description = "A deterministic AI-code deployability checker that catches what coverage misses."
7
+ version = "1.1.11"
8
+ description = "Deterministic pre-push quality & security verification gate for Python codebases that catches what coverage misses."
9
9
  readme = "README.md"
10
10
  requires-python = ">=3.10"
11
11
  license = "MIT"
@@ -13,14 +13,16 @@ authors = [
13
13
  { name = "SVS Praveen", email = "svspraveens@gmail.com" }
14
14
  ]
15
15
  keywords = [
16
- "ai-code",
16
+ "code-quality",
17
17
  "mutation-testing",
18
18
  "security-scanner",
19
- "slopsquatting",
20
- "ghostapproval",
19
+ "developer-tools",
21
20
  "pre-push-verification",
21
+ "python-testing",
22
22
  "ast-analysis",
23
23
  "dependency-security",
24
+ "ai-code",
25
+ "slopsquatting",
24
26
  ]
25
27
  classifiers = [
26
28
  "Development Status :: 3 - Alpha",
deployproof-1.1.11/src/deployproof/__init__.py ADDED
@@ -0,0 +1,2 @@
1
+ """DeployProof: Deterministic quality & security gate for modern Python codebases."""
2
+ __version__ = "1.1.11"
{deployproof-1.1.0 → deployproof-1.1.11}/src/deployproof/dependencies.py RENAMED
@@ -1050,7 +1050,7 @@ def query_pypi_registry(
1050
1050
  try:
1051
1051
  from deployproof import __version__
1052
1052
  except ImportError:
1053
- __version__ = "1.1.0"
1053
+ __version__ = "1.1.11"
1054
1054
 
1055
1055
  url = f"https://pypi.org/pypi/{canonical_pkg}/json"
1056
1056
  req = urllib.request.Request(
{deployproof-1.1.0 → deployproof-1.1.11/src/deployproof.egg-info}/PKG-INFO RENAMED
@@ -1,14 +1,14 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: deployproof
3
- Version: 1.1.0
4
- Summary: A deterministic AI-code deployability checker that catches what coverage misses.
3
+ Version: 1.1.11
4
+ Summary: Deterministic pre-push quality & security verification gate for Python codebases that catches what coverage misses.
5
5
  Author-email: SVS Praveen <svspraveens@gmail.com>
6
6
  License-Expression: MIT
7
7
  Project-URL: Homepage, https://github.com/SVSPraveen/DeployProof
8
8
  Project-URL: Documentation, https://github.com/SVSPraveen/DeployProof#readme
9
9
  Project-URL: Repository, https://github.com/SVSPraveen/DeployProof.git
10
10
  Project-URL: Bug Tracker, https://github.com/SVSPraveen/DeployProof/issues
11
- Keywords: ai-code,mutation-testing,security-scanner,slopsquatting,ghostapproval,pre-push-verification,ast-analysis,dependency-security
11
+ Keywords: code-quality,mutation-testing,security-scanner,developer-tools,pre-push-verification,python-testing,ast-analysis,dependency-security,ai-code,slopsquatting
12
12
  Classifier: Development Status :: 3 - Alpha
13
13
  Classifier: Intended Audience :: Developers
14
14
  Classifier: Programming Language :: Python :: 3
@@ -31,9 +31,9 @@ Dynamic: license-file
31
31
 
32
32
  # DeployProof
33
33
 
34
- > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
34
+ > Deterministic pre-push quality & security gate for modern Python codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense. Built for human engineering teams and AI-assisted workflows alike.
35
35
 
36
- [![PyPI version](https://img.shields.io/badge/pypi-v1.1.0-007ec6.svg)](https://pypi.org/project/deployproof/)
36
+ [![PyPI version](https://img.shields.io/badge/pypi-v1.1.11-007ec6.svg)](https://pypi.org/project/deployproof/)
37
37
  [![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
38
38
  [![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
39
39
  [![Tests](https://img.shields.io/badge/tests-111%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
@@ -44,17 +44,29 @@ Dynamic: license-file
44
44
 
45
45
  ## Why This Exists
46
46
 
47
- AI-assisted development introduces subtle failure modes that standard linters and coverage tools miss: test suites with high line coverage but near-zero mutation scores, hardcoded credentials generated in passing, symlinks that deceive approval prompts into escaping the repository sandbox, silently swallowed exceptions, and package names hallucinated by LLMs that don't exist on PyPI. DeployProof catches these at the pre-push stage, before they reach CI or production.
47
+ Modern software development — whether crafted by human engineering teams or generated through AI coding assistants — introduces subtle failure modes that standard linters and line-coverage metrics completely miss:
48
+
49
+ * **Deceptive Test Suites**: Test suites boasting 90%+ line coverage that never assert true correctness, masking near-zero mutation scores.
50
+ * **Accidental Credential Exposure**: Hardcoded API keys, bearer tokens, or service credentials generated in passing or pasted into tests.
51
+ * **Sandbox Escape Risks**: Symlinks that deceive tool approval prompts into breaking outside the repository sandbox.
52
+ * **Silently Swallowed Exceptions**: Blanket `except Exception: pass` anti-patterns that hide critical runtime bugs.
53
+ * **Dependency Hallucinations & Slopsquatting**: Package names invented by LLMs or mistyped dependencies that don't exist on public PyPI.
54
+
55
+ DeployProof serves as an uncompromising, deterministic pre-push gate that validates code quality, test integrity, and security locally before any commit reaches CI or production.
48
56
 
49
57
  > **Privacy & Security Guarantee**: DeployProof runs 100% locally on your machine. It makes zero outbound network calls, except for querying the official PyPI registry (JSON API) to verify that newly introduced dependencies exist and are not hallucinated. DeployProof sends no source code, telemetry, test results, or secret findings to any external server.
50
58
 
51
59
  ## Install
52
60
 
53
61
  ```bash
62
+ # Recommended — installs into an isolated environment, exposes the CLI globally
63
+ pipx install deployproof
64
+
65
+ # Or via pip into your current environment
54
66
  pip install deployproof
55
67
  ```
56
68
 
57
- Requires Python 3.10+.
69
+ Requires Python 3.10+. If you don't have `pipx`, install it with `pip install pipx` then run `pipx ensurepath`.
58
70
 
59
71
  ## How to Use DeployProof
60
72
 
@@ -86,7 +98,11 @@ deployproof check --full-repo --workers 8
86
98
  ```
87
99
 
88
100
  #### Real-World Timing Expectations:
89
- | Scan Mode | Target Scope | Typical Duration | Intended Use Case |
101
+
102
+ > [!NOTE]
103
+ > **Estimated Timings Disclaimer**: The durations below are empirical estimates based on benchmark runs across various open-source projects (such as `requests`, `click`, and `colorama`). Actual execution time may be **higher or lower** depending on your specific test suite execution speed (e.g., pure unit tests vs. heavy integration/database tests), test runner timeout settings (`--timeout`), hardware profile (CPU core clock speed, available RAM), and codebase complexity.
104
+
105
+ | Scan Mode | Target Scope | Estimated Duration* | Intended Use Case |
90
106
  | :--- | :--- | :--- | :--- |
91
107
  | **`deployproof check`** | Git Diff (1–3 modified files) | **2 – 5 seconds** | Local pre-commit, active AI IDE coding loops, pre-push sanity checks. |
92
108
  | **`deployproof check --workers 8`** | Large Multi-File Diff (100+ mutants) | **1 – 3 minutes** | Large feature branch reviews, refactors. |
@@ -289,7 +305,7 @@ deployproof check --json
289
305
 
290
306
  ```json
291
307
  {
292
- "version": "1.1.0",
308
+ "version": "1.1.11",
293
309
  "status": "passed",
294
310
  "summary": {
295
311
  "target_files_count": 1,
@@ -389,7 +405,7 @@ Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS cr
389
405
 
390
406
  ## Status & Roadmap
391
407
 
392
- - **Current (v1.1.0):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
408
+ - **Current (v1.1.11):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
393
409
  - **Next:** Reverse test-to-source dependency mapping (see `FUTURE_SCOPE.md`), SARIF 2.1.0 PR annotations, and multi-language mutation rule packs.
394
410
 
395
411
  ## Contributing
deployproof-1.1.0/src/deployproof/__init__.py DELETED
@@ -1,2 +0,0 @@
1
- """DeployProof - Deterministic AI-Code Deployability Checker."""
2
- __version__ = "1.1.0"
{deployproof-1.1.0 → deployproof-1.1.11}/LICENSE RENAMED
File without changes
{deployproof-1.1.0 → deployproof-1.1.11}/setup.cfg RENAMED
File without changes