deployproof 1.1.0__tar.gz → 1.1.1__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (40) hide show
  1. {deployproof-1.1.0/src/deployproof.egg-info → deployproof-1.1.1}/PKG-INFO +30 -10
  2. {deployproof-1.1.0 → deployproof-1.1.1}/README.md +27 -7
  3. {deployproof-1.1.0 → deployproof-1.1.1}/pyproject.toml +7 -5
  4. deployproof-1.1.1/src/deployproof/__init__.py +2 -0
  5. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/dependencies.py +1 -1
  6. {deployproof-1.1.0 → deployproof-1.1.1/src/deployproof.egg-info}/PKG-INFO +30 -10
  7. deployproof-1.1.0/src/deployproof/__init__.py +0 -2
  8. {deployproof-1.1.0 → deployproof-1.1.1}/LICENSE +0 -0
  9. {deployproof-1.1.0 → deployproof-1.1.1}/setup.cfg +0 -0
  10. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/cli.py +0 -0
  11. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/control_flow.py +0 -0
  12. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/coverage_plugin.py +0 -0
  13. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/diff.py +0 -0
  14. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/mocks.py +0 -0
  15. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/mutator.py +0 -0
  16. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/reporter.py +0 -0
  17. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/secrets.py +0 -0
  18. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/symlinks.py +0 -0
  19. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/wsl.py +0 -0
  20. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof.egg-info/SOURCES.txt +0 -0
  21. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof.egg-info/dependency_links.txt +0 -0
  22. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof.egg-info/entry_points.txt +0 -0
  23. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof.egg-info/requires.txt +0 -0
  24. {deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof.egg-info/top_level.txt +0 -0
  25. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_baseline_collection_error.py +0 -0
  26. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_cli.py +0 -0
  27. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_cli_dependency_scan.py +0 -0
  28. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_control_flow.py +0 -0
  29. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_dependencies_extractor.py +0 -0
  30. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_dependencies_pypi.py +0 -0
  31. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_diff.py +0 -0
  32. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_edge_cases_validation.py +0 -0
  33. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_import_graph_discovery.py +0 -0
  34. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_mocks.py +0 -0
  35. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_mutation_suites.py +0 -0
  36. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_mutator.py +0 -0
  37. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_secrets.py +0 -0
  38. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_stress_regressions.py +0 -0
  39. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_symlinks.py +0 -0
  40. {deployproof-1.1.0 → deployproof-1.1.1}/tests/test_wsl.py +0 -0
{deployproof-1.1.0/src/deployproof.egg-info → deployproof-1.1.1}/PKG-INFO RENAMED
@@ -1,14 +1,14 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: deployproof
3
- Version: 1.1.0
4
- Summary: A deterministic AI-code deployability checker that catches what coverage misses.
3
+ Version: 1.1.1
4
+ Summary: Deterministic pre-push quality & security verification gate for Python codebases that catches what coverage misses.
5
5
  Author-email: SVS Praveen <svspraveens@gmail.com>
6
6
  License-Expression: MIT
7
7
  Project-URL: Homepage, https://github.com/SVSPraveen/DeployProof
8
8
  Project-URL: Documentation, https://github.com/SVSPraveen/DeployProof#readme
9
9
  Project-URL: Repository, https://github.com/SVSPraveen/DeployProof.git
10
10
  Project-URL: Bug Tracker, https://github.com/SVSPraveen/DeployProof/issues
11
- Keywords: ai-code,mutation-testing,security-scanner,slopsquatting,ghostapproval,pre-push-verification,ast-analysis,dependency-security
11
+ Keywords: code-quality,mutation-testing,security-scanner,developer-tools,pre-push-verification,python-testing,ast-analysis,dependency-security,ai-code,slopsquatting
12
12
  Classifier: Development Status :: 3 - Alpha
13
13
  Classifier: Intended Audience :: Developers
14
14
  Classifier: Programming Language :: Python :: 3
@@ -31,9 +31,13 @@ Dynamic: license-file
31
31
 
32
32
  # DeployProof
33
33
 
34
- > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
34
+ <p align="center">
35
+ <img src="assets/deployproof-hero.png" alt="DeployProof Hero Banner" width="100%" />
36
+ </p>
35
37
 
36
- [![PyPI version](https://img.shields.io/badge/pypi-v1.1.0-007ec6.svg)](https://pypi.org/project/deployproof/)
38
+ > Deterministic pre-push quality & security gate for modern Python codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense. Built for human engineering teams and AI-assisted workflows alike.
39
+
40
+ [![PyPI version](https://img.shields.io/badge/pypi-v1.1.1-007ec6.svg)](https://pypi.org/project/deployproof/)
37
41
  [![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
38
42
  [![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
39
43
  [![Tests](https://img.shields.io/badge/tests-111%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
@@ -44,17 +48,29 @@ Dynamic: license-file
44
48
 
45
49
  ## Why This Exists
46
50
 
47
- AI-assisted development introduces subtle failure modes that standard linters and coverage tools miss: test suites with high line coverage but near-zero mutation scores, hardcoded credentials generated in passing, symlinks that deceive approval prompts into escaping the repository sandbox, silently swallowed exceptions, and package names hallucinated by LLMs that don't exist on PyPI. DeployProof catches these at the pre-push stage, before they reach CI or production.
51
+ Modern software development — whether crafted by human engineering teams or generated through AI coding assistants — introduces subtle failure modes that standard linters and line-coverage metrics completely miss:
52
+
53
+ * **Deceptive Test Suites**: Test suites boasting 90%+ line coverage that never assert true correctness, masking near-zero mutation scores.
54
+ * **Accidental Credential Exposure**: Hardcoded API keys, bearer tokens, or service credentials generated in passing or pasted into tests.
55
+ * **Sandbox Escape Risks**: Symlinks that deceive tool approval prompts into breaking outside the repository sandbox.
56
+ * **Silently Swallowed Exceptions**: Blanket `except Exception: pass` anti-patterns that hide critical runtime bugs.
57
+ * **Dependency Hallucinations & Slopsquatting**: Package names invented by LLMs or mistyped dependencies that don't exist on public PyPI.
58
+
59
+ DeployProof serves as an uncompromising, deterministic pre-push gate that validates code quality, test integrity, and security locally before any commit reaches CI or production.
48
60
 
49
61
  > **Privacy & Security Guarantee**: DeployProof runs 100% locally on your machine. It makes zero outbound network calls, except for querying the official PyPI registry (JSON API) to verify that newly introduced dependencies exist and are not hallucinated. DeployProof sends no source code, telemetry, test results, or secret findings to any external server.
50
62
 
51
63
  ## Install
52
64
 
53
65
  ```bash
66
+ # Recommended — installs into an isolated environment, exposes the CLI globally
67
+ pipx install deployproof
68
+
69
+ # Or via pip into your current environment
54
70
  pip install deployproof
55
71
  ```
56
72
 
57
- Requires Python 3.10+.
73
+ Requires Python 3.10+. If you don't have `pipx`, install it with `pip install pipx` then run `pipx ensurepath`.
58
74
 
59
75
  ## How to Use DeployProof
60
76
 
@@ -86,7 +102,11 @@ deployproof check --full-repo --workers 8
86
102
  ```
87
103
 
88
104
  #### Real-World Timing Expectations:
89
- | Scan Mode | Target Scope | Typical Duration | Intended Use Case |
105
+
106
+ > [!NOTE]
107
+ > **Estimated Timings Disclaimer**: The durations below are empirical estimates based on benchmark runs across various open-source projects (such as `requests`, `click`, and `colorama`). Actual execution time may be **higher or lower** depending on your specific test suite execution speed (e.g., pure unit tests vs. heavy integration/database tests), test runner timeout settings (`--timeout`), hardware profile (CPU core clock speed, available RAM), and codebase complexity.
108
+
109
+ | Scan Mode | Target Scope | Estimated Duration* | Intended Use Case |
90
110
  | :--- | :--- | :--- | :--- |
91
111
  | **`deployproof check`** | Git Diff (1–3 modified files) | **2 – 5 seconds** | Local pre-commit, active AI IDE coding loops, pre-push sanity checks. |
92
112
  | **`deployproof check --workers 8`** | Large Multi-File Diff (100+ mutants) | **1 – 3 minutes** | Large feature branch reviews, refactors. |
@@ -289,7 +309,7 @@ deployproof check --json
289
309
 
290
310
  ```json
291
311
  {
292
- "version": "1.1.0",
312
+ "version": "1.1.1",
293
313
  "status": "passed",
294
314
  "summary": {
295
315
  "target_files_count": 1,
@@ -389,7 +409,7 @@ Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS cr
389
409
 
390
410
  ## Status & Roadmap
391
411
 
392
- - **Current (v1.1.0):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
412
+ - **Current (v1.1.1):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
393
413
  - **Next:** Reverse test-to-source dependency mapping (see `FUTURE_SCOPE.md`), SARIF 2.1.0 PR annotations, and multi-language mutation rule packs.
394
414
 
395
415
  ## Contributing
{deployproof-1.1.0 → deployproof-1.1.1}/README.md RENAMED
@@ -1,8 +1,12 @@
1
1
  # DeployProof
2
2
 
3
- > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
3
+ <p align="center">
4
+ <img src="assets/deployproof-hero.png" alt="DeployProof Hero Banner" width="100%" />
5
+ </p>
4
6
 
5
- [![PyPI version](https://img.shields.io/badge/pypi-v1.1.0-007ec6.svg)](https://pypi.org/project/deployproof/)
7
+ > Deterministic pre-push quality & security gate for modern Python codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense. Built for human engineering teams and AI-assisted workflows alike.
8
+
9
+ [![PyPI version](https://img.shields.io/badge/pypi-v1.1.1-007ec6.svg)](https://pypi.org/project/deployproof/)
6
10
  [![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
7
11
  [![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
8
12
  [![Tests](https://img.shields.io/badge/tests-111%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
@@ -13,17 +17,29 @@
13
17
 
14
18
  ## Why This Exists
15
19
 
16
- AI-assisted development introduces subtle failure modes that standard linters and coverage tools miss: test suites with high line coverage but near-zero mutation scores, hardcoded credentials generated in passing, symlinks that deceive approval prompts into escaping the repository sandbox, silently swallowed exceptions, and package names hallucinated by LLMs that don't exist on PyPI. DeployProof catches these at the pre-push stage, before they reach CI or production.
20
+ Modern software development — whether crafted by human engineering teams or generated through AI coding assistants — introduces subtle failure modes that standard linters and line-coverage metrics completely miss:
21
+
22
+ * **Deceptive Test Suites**: Test suites boasting 90%+ line coverage that never assert true correctness, masking near-zero mutation scores.
23
+ * **Accidental Credential Exposure**: Hardcoded API keys, bearer tokens, or service credentials generated in passing or pasted into tests.
24
+ * **Sandbox Escape Risks**: Symlinks that deceive tool approval prompts into breaking outside the repository sandbox.
25
+ * **Silently Swallowed Exceptions**: Blanket `except Exception: pass` anti-patterns that hide critical runtime bugs.
26
+ * **Dependency Hallucinations & Slopsquatting**: Package names invented by LLMs or mistyped dependencies that don't exist on public PyPI.
27
+
28
+ DeployProof serves as an uncompromising, deterministic pre-push gate that validates code quality, test integrity, and security locally before any commit reaches CI or production.
17
29
 
18
30
  > **Privacy & Security Guarantee**: DeployProof runs 100% locally on your machine. It makes zero outbound network calls, except for querying the official PyPI registry (JSON API) to verify that newly introduced dependencies exist and are not hallucinated. DeployProof sends no source code, telemetry, test results, or secret findings to any external server.
19
31
 
20
32
  ## Install
21
33
 
22
34
  ```bash
35
+ # Recommended — installs into an isolated environment, exposes the CLI globally
36
+ pipx install deployproof
37
+
38
+ # Or via pip into your current environment
23
39
  pip install deployproof
24
40
  ```
25
41
 
26
- Requires Python 3.10+.
42
+ Requires Python 3.10+. If you don't have `pipx`, install it with `pip install pipx` then run `pipx ensurepath`.
27
43
 
28
44
  ## How to Use DeployProof
29
45
 
@@ -55,7 +71,11 @@ deployproof check --full-repo --workers 8
55
71
  ```
56
72
 
57
73
  #### Real-World Timing Expectations:
58
- | Scan Mode | Target Scope | Typical Duration | Intended Use Case |
74
+
75
+ > [!NOTE]
76
+ > **Estimated Timings Disclaimer**: The durations below are empirical estimates based on benchmark runs across various open-source projects (such as `requests`, `click`, and `colorama`). Actual execution time may be **higher or lower** depending on your specific test suite execution speed (e.g., pure unit tests vs. heavy integration/database tests), test runner timeout settings (`--timeout`), hardware profile (CPU core clock speed, available RAM), and codebase complexity.
77
+
78
+ | Scan Mode | Target Scope | Estimated Duration* | Intended Use Case |
59
79
  | :--- | :--- | :--- | :--- |
60
80
  | **`deployproof check`** | Git Diff (1–3 modified files) | **2 – 5 seconds** | Local pre-commit, active AI IDE coding loops, pre-push sanity checks. |
61
81
  | **`deployproof check --workers 8`** | Large Multi-File Diff (100+ mutants) | **1 – 3 minutes** | Large feature branch reviews, refactors. |
@@ -258,7 +278,7 @@ deployproof check --json
258
278
 
259
279
  ```json
260
280
  {
261
- "version": "1.1.0",
281
+ "version": "1.1.1",
262
282
  "status": "passed",
263
283
  "summary": {
264
284
  "target_files_count": 1,
@@ -358,7 +378,7 @@ Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS cr
358
378
 
359
379
  ## Status & Roadmap
360
380
 
361
- - **Current (v1.1.0):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
381
+ - **Current (v1.1.1):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
362
382
  - **Next:** Reverse test-to-source dependency mapping (see `FUTURE_SCOPE.md`), SARIF 2.1.0 PR annotations, and multi-language mutation rule packs.
363
383
 
364
384
  ## Contributing
{deployproof-1.1.0 → deployproof-1.1.1}/pyproject.toml RENAMED
@@ -4,8 +4,8 @@ build-backend = "setuptools.build_meta"
4
4
 
5
5
  [project]
6
6
  name = "deployproof"
7
- version = "1.1.0"
8
- description = "A deterministic AI-code deployability checker that catches what coverage misses."
7
+ version = "1.1.1"
8
+ description = "Deterministic pre-push quality & security verification gate for Python codebases that catches what coverage misses."
9
9
  readme = "README.md"
10
10
  requires-python = ">=3.10"
11
11
  license = "MIT"
@@ -13,14 +13,16 @@ authors = [
13
13
  { name = "SVS Praveen", email = "svspraveens@gmail.com" }
14
14
  ]
15
15
  keywords = [
16
- "ai-code",
16
+ "code-quality",
17
17
  "mutation-testing",
18
18
  "security-scanner",
19
- "slopsquatting",
20
- "ghostapproval",
19
+ "developer-tools",
21
20
  "pre-push-verification",
21
+ "python-testing",
22
22
  "ast-analysis",
23
23
  "dependency-security",
24
+ "ai-code",
25
+ "slopsquatting",
24
26
  ]
25
27
  classifiers = [
26
28
  "Development Status :: 3 - Alpha",
deployproof-1.1.1/src/deployproof/__init__.py ADDED
@@ -0,0 +1,2 @@
1
+ """DeployProof: Deterministic quality & security gate for modern Python codebases."""
2
+ __version__ = "1.1.1"
{deployproof-1.1.0 → deployproof-1.1.1}/src/deployproof/dependencies.py RENAMED
@@ -1050,7 +1050,7 @@ def query_pypi_registry(
1050
1050
  try:
1051
1051
  from deployproof import __version__
1052
1052
  except ImportError:
1053
- __version__ = "1.1.0"
1053
+ __version__ = "1.1.1"
1054
1054
 
1055
1055
  url = f"https://pypi.org/pypi/{canonical_pkg}/json"
1056
1056
  req = urllib.request.Request(
{deployproof-1.1.0 → deployproof-1.1.1/src/deployproof.egg-info}/PKG-INFO RENAMED
@@ -1,14 +1,14 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: deployproof
3
- Version: 1.1.0
4
- Summary: A deterministic AI-code deployability checker that catches what coverage misses.
3
+ Version: 1.1.1
4
+ Summary: Deterministic pre-push quality & security verification gate for Python codebases that catches what coverage misses.
5
5
  Author-email: SVS Praveen <svspraveens@gmail.com>
6
6
  License-Expression: MIT
7
7
  Project-URL: Homepage, https://github.com/SVSPraveen/DeployProof
8
8
  Project-URL: Documentation, https://github.com/SVSPraveen/DeployProof#readme
9
9
  Project-URL: Repository, https://github.com/SVSPraveen/DeployProof.git
10
10
  Project-URL: Bug Tracker, https://github.com/SVSPraveen/DeployProof/issues
11
- Keywords: ai-code,mutation-testing,security-scanner,slopsquatting,ghostapproval,pre-push-verification,ast-analysis,dependency-security
11
+ Keywords: code-quality,mutation-testing,security-scanner,developer-tools,pre-push-verification,python-testing,ast-analysis,dependency-security,ai-code,slopsquatting
12
12
  Classifier: Development Status :: 3 - Alpha
13
13
  Classifier: Intended Audience :: Developers
14
14
  Classifier: Programming Language :: Python :: 3
@@ -31,9 +31,13 @@ Dynamic: license-file
31
31
 
32
32
  # DeployProof
33
33
 
34
- > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
34
+ <p align="center">
35
+ <img src="assets/deployproof-hero.png" alt="DeployProof Hero Banner" width="100%" />
36
+ </p>
35
37
 
36
- [![PyPI version](https://img.shields.io/badge/pypi-v1.1.0-007ec6.svg)](https://pypi.org/project/deployproof/)
38
+ > Deterministic pre-push quality & security gate for modern Python codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense. Built for human engineering teams and AI-assisted workflows alike.
39
+
40
+ [![PyPI version](https://img.shields.io/badge/pypi-v1.1.1-007ec6.svg)](https://pypi.org/project/deployproof/)
37
41
  [![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
38
42
  [![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
39
43
  [![Tests](https://img.shields.io/badge/tests-111%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
@@ -44,17 +48,29 @@ Dynamic: license-file
44
48
 
45
49
  ## Why This Exists
46
50
 
47
- AI-assisted development introduces subtle failure modes that standard linters and coverage tools miss: test suites with high line coverage but near-zero mutation scores, hardcoded credentials generated in passing, symlinks that deceive approval prompts into escaping the repository sandbox, silently swallowed exceptions, and package names hallucinated by LLMs that don't exist on PyPI. DeployProof catches these at the pre-push stage, before they reach CI or production.
51
+ Modern software development — whether crafted by human engineering teams or generated through AI coding assistants — introduces subtle failure modes that standard linters and line-coverage metrics completely miss:
52
+
53
+ * **Deceptive Test Suites**: Test suites boasting 90%+ line coverage that never assert true correctness, masking near-zero mutation scores.
54
+ * **Accidental Credential Exposure**: Hardcoded API keys, bearer tokens, or service credentials generated in passing or pasted into tests.
55
+ * **Sandbox Escape Risks**: Symlinks that deceive tool approval prompts into breaking outside the repository sandbox.
56
+ * **Silently Swallowed Exceptions**: Blanket `except Exception: pass` anti-patterns that hide critical runtime bugs.
57
+ * **Dependency Hallucinations & Slopsquatting**: Package names invented by LLMs or mistyped dependencies that don't exist on public PyPI.
58
+
59
+ DeployProof serves as an uncompromising, deterministic pre-push gate that validates code quality, test integrity, and security locally before any commit reaches CI or production.
48
60
 
49
61
  > **Privacy & Security Guarantee**: DeployProof runs 100% locally on your machine. It makes zero outbound network calls, except for querying the official PyPI registry (JSON API) to verify that newly introduced dependencies exist and are not hallucinated. DeployProof sends no source code, telemetry, test results, or secret findings to any external server.
50
62
 
51
63
  ## Install
52
64
 
53
65
  ```bash
66
+ # Recommended — installs into an isolated environment, exposes the CLI globally
67
+ pipx install deployproof
68
+
69
+ # Or via pip into your current environment
54
70
  pip install deployproof
55
71
  ```
56
72
 
57
- Requires Python 3.10+.
73
+ Requires Python 3.10+. If you don't have `pipx`, install it with `pip install pipx` then run `pipx ensurepath`.
58
74
 
59
75
  ## How to Use DeployProof
60
76
 
@@ -86,7 +102,11 @@ deployproof check --full-repo --workers 8
86
102
  ```
87
103
 
88
104
  #### Real-World Timing Expectations:
89
- | Scan Mode | Target Scope | Typical Duration | Intended Use Case |
105
+
106
+ > [!NOTE]
107
+ > **Estimated Timings Disclaimer**: The durations below are empirical estimates based on benchmark runs across various open-source projects (such as `requests`, `click`, and `colorama`). Actual execution time may be **higher or lower** depending on your specific test suite execution speed (e.g., pure unit tests vs. heavy integration/database tests), test runner timeout settings (`--timeout`), hardware profile (CPU core clock speed, available RAM), and codebase complexity.
108
+
109
+ | Scan Mode | Target Scope | Estimated Duration* | Intended Use Case |
90
110
  | :--- | :--- | :--- | :--- |
91
111
  | **`deployproof check`** | Git Diff (1–3 modified files) | **2 – 5 seconds** | Local pre-commit, active AI IDE coding loops, pre-push sanity checks. |
92
112
  | **`deployproof check --workers 8`** | Large Multi-File Diff (100+ mutants) | **1 – 3 minutes** | Large feature branch reviews, refactors. |
@@ -289,7 +309,7 @@ deployproof check --json
289
309
 
290
310
  ```json
291
311
  {
292
- "version": "1.1.0",
312
+ "version": "1.1.1",
293
313
  "status": "passed",
294
314
  "summary": {
295
315
  "target_files_count": 1,
@@ -389,7 +409,7 @@ Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS cr
389
409
 
390
410
  ## Status & Roadmap
391
411
 
392
- - **Current (v1.1.0):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
412
+ - **Current (v1.1.1):** Diff-scoped AST mutation testing (with recursive discovery and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), **Full Repository Audit Mode (`--full-repo`)** with isolated parallel multi-worker sandboxes and AST import-graph test discovery, baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner, GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, **111 unit tests**, live unbuffered progress streaming, and machine-readable `--json` output.
393
413
  - **Next:** Reverse test-to-source dependency mapping (see `FUTURE_SCOPE.md`), SARIF 2.1.0 PR annotations, and multi-language mutation rule packs.
394
414
 
395
415
  ## Contributing
deployproof-1.1.0/src/deployproof/__init__.py DELETED
@@ -1,2 +0,0 @@
1
- """DeployProof - Deterministic AI-Code Deployability Checker."""
2
- __version__ = "1.1.0"
{deployproof-1.1.0 → deployproof-1.1.1}/LICENSE RENAMED
File without changes
{deployproof-1.1.0 → deployproof-1.1.1}/setup.cfg RENAMED
File without changes