proofctl 0.1.10__tar.gz → 0.2.0__tar.gz

{proofctl-0.1.10 → proofctl-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.1.10
+Version: 0.2.0
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/checkers/dockerfile.py

@@ -9,7 +9,7 @@ from .base import DockerfileChecker
 
 # ── helpers ───────────────────────────────────────────────────────────────────
 
-_SHA_DIGEST_RE = re.compile(r"@sha256:[a-f0-9]{64}")
+_SHA_DIGEST_RE = re.compile(r"@sha(?:256:[a-f0-9]{64}|384:[a-f0-9]{96}|512:[a-f0-9]{128})")
 _HAS_TAG_RE = re.compile(r":[a-zA-Z0-9][\w.\-]*$")
 
 # DF-007: curl/wget piped to a shell
@@ -330,16 +330,26 @@ def _df008(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
         if "--checksum=sha256:" in args:
             continue
 
-        # Check the next 3 instructions for a verification RUN
-        window = instructions[idx + 1: idx + 4]
-        verified = any(
-            next_instr == "RUN" and (
+        # Walk the full continuation chain — inspect every subsequent RUN
+        # instruction (each already collapsed across `\` continuations by
+        # the parser) until we hit a non-RUN instruction. This catches
+        # `RUN wget && sha256sum -c && tar xz` chains and multi-RUN
+        # verification sequences that overflowed the old 3-instruction
+        # window.
+        verified = False
+        for _, next_instr, next_args in instructions[idx + 1:]:
+            if next_instr != "RUN":
+                break
+            if (
                 "sha256sum" in next_args
+                or "sha512sum" in next_args
                 or "shasum -a 256" in next_args
+                or "shasum -a 512" in next_args
                 or "gpg --verify" in next_args
-            )
-            for _, next_instr, next_args in window
-        )
+                or "gpg2 --verify" in next_args
+            ):
+                verified = True
+                break
         if verified:
             continue
 
@@ -359,18 +369,30 @@ def _df008(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
 
 
 def _df009(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding]:
-    """PROOFCTL-DF-009 — COPY . . before dependency installation."""
+    """PROOFCTL-DF-009 — COPY . . before dependency installation.
+
+    Multi-stage context: in a Dockerfile with multiple FROM stages,
+    early/builder stages routinely COPY . to compile or vendor
+    dependencies; the cache-invalidation antipattern only matters in
+    the final (runtime) stage. Skip the rule entirely for non-final
+    stages.
+    """
     findings: list[Finding] = []
 
-    # Broad COPY destinations that indicate a full source-tree copy
-    _broad_dests = {"/app", "/src", "/code", "/workspace", "."}
+    # Determine the line range of the FINAL build stage. Anything
+    # before that range belongs to an earlier (e.g. builder) stage.
+    from_linenos = [ln for ln, instr, _ in instructions if instr == "FROM"]
+    is_multistage = len(from_linenos) > 1
+    final_stage_start = from_linenos[-1] if from_linenos else 0
 
-    # Find the first broad COPY (source is bare ".")
+    # Find the first broad COPY (source is bare ".") in the FINAL stage.
     first_broad_copy: tuple[int, str, str] | None = None
     for item in instructions:
         lineno, instr, args = item
         if instr != "COPY":
             continue
+        if is_multistage and lineno < final_stage_start:
+            continue  # earlier stage — not subject to DF-009
         tokens = args.split()
         if not tokens:
             continue
@@ -384,10 +406,14 @@ def _df009(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
 
     copy_lineno = first_broad_copy[0]
 
-    # Find the first dependency-install RUN
+    # Find the first dependency-install RUN — only consider RUNs in
+    # the final stage (otherwise we'd cross-match a builder-stage RUN
+    # with a final-stage COPY).
     for lineno, instr, args in instructions:
         if instr != "RUN":
             continue
+        if is_multistage and lineno < final_stage_start:
+            continue
         if _DEP_INSTALL_RE.search(args):
             if copy_lineno < lineno:
                 findings.append(Finding(

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/checkers/imports.py

@@ -481,26 +481,65 @@ _PKG_SCAN_SKIP_DIRS: frozenset[str] = frozenset({
 # is depth 3).
 _PKG_SCAN_MAX_DEPTH = 8
 
+# Files / directories that mark a project root for `_i001` local-package
+# discovery. Kept broad on purpose: a monorepo with Airflow DAGs frequently has
+# none of pyproject.toml / setup.py at the repo root, but always has `.git/`.
+_PROJECT_ROOT_MARKERS: tuple[str, ...] = (
+    "pyproject.toml", "setup.py", "setup.cfg",
+    ".git",
+    "Pipfile", "Pipfile.lock",
+    "poetry.lock", "uv.lock",
+    "requirements.txt", "requirements-dev.txt",
+    "tox.ini",
+    "environment.yml",
+    ".proofctl.yaml",   # the user's own marker
+)
+
 
 @functools.lru_cache(maxsize=32)
 def _local_packages(root: Path) -> frozenset[str]:
     """Importable Python package/module names anywhere in the project.
 
-    Walks the project subtree looking for `__init__.py` files; the parent
-    directory of every such file becomes a known local package. Also picks up
-    bare top-level `.py` files at the project root.
+    A directory under `root` is treated as a local package when **all** of:
+      - its name is a valid Python identifier (filters out `schema-migrations`
+        and similar that can never appear as an import),
+      - it is not in the vendor / cache / virtualenv skip set,
+      - it either contains an `__init__.py` (regular package) **or** at least
+        one direct `.py` file (PEP 420 namespace package — common in Airflow
+        projects where `dags_folder` is on `sys.path` and DAG sub-directories
+        are imported without `__init__.py`).
 
-    The previous root-only walk missed packages nested under sub-trees
-    (e.g. `orchestration/dags/airflow_ip_taskgroups/__init__.py`), generating
-    spurious PROOFCTL-I-001 hallucinated-import findings against private code.
+    Bare top-level `.py` files at the project root are also recorded as
+    importable modules.
 
     The walk skips common vendor / cache / virtualenv directories, never
     follows symlinks, and caps recursion at `_PKG_SCAN_MAX_DEPTH`.
     Results are cached per-root so a 500-file scan walks the tree once.
+
+    Why we add namespace packages even without an `__init__.py`:
+    Airflow's standard layout has `<dags_folder>/<pkg>/<module>.py` with
+    `<dags_folder>` on `sys.path`; `from <pkg> import …` resolves at runtime
+    even though `<pkg>` is just a plain directory. Without this branch every
+    such directory triggered a false PROOFCTL-I-001.
+
+    Trade-off: a directory whose name matches a real PyPI package will now
+    shadow that package in the hallucination check (false-negative rather
+    than false-positive). We accept that — the previous noise made the rule
+    unusable on namespace-package layouts, and the identifier + py-file
+    filters keep the false-negative surface narrow.
     """
     names: set[str] = set()
     visited: set[Path] = set()
 
+    def _has_direct_py_file(p: Path) -> bool:
+        try:
+            for c in p.iterdir():
+                if c.is_file() and not c.is_symlink() and c.suffix == ".py":
+                    return True
+        except (OSError, PermissionError):
+            return False
+        return False
+
     def _walk(path: Path, depth: int) -> None:
         if depth > _PKG_SCAN_MAX_DEPTH:
             return
@@ -526,8 +565,9 @@ def _local_packages(root: Path) -> frozenset[str]:
                 if child.name.startswith(".") and child.name not in {".github"}:
                     # Skip hidden directories — they're caches, IDE state, etc.
                     continue
-                if (child / "__init__.py").exists():
-                    names.add(child.name)
+                if child.name.isidentifier():
+                    if (child / "__init__.py").exists() or _has_direct_py_file(child):
+                        names.add(child.name)
                 _walk(child, depth + 1)
             elif depth == 0 and child.suffix == ".py" and child.name != "__init__.py":
                 # Bare top-level modules (e.g. `setup.py`-adjacent scripts).
@@ -558,10 +598,14 @@ class ImportChecker(FileChecker):
         local_namespaces: list[str] | None = None,
         extra_indexes: list[str] | None = None,
         check_pypi: bool = True,
+        scan_root: Path | None = None,
     ) -> None:
         self._local_namespaces = tuple(local_namespaces or [])
         self._check_pypi = check_pypi
         self._stdlib = _stdlib_names()
+        # Engine plumbs its own scan root in; falls back to walking-up
+        # heuristic when used standalone (e.g. unit tests).
+        self._scan_root = scan_root
 
     def check(self, path: Path, source: str, tree: ast.Module | None) -> list[Finding]:
         findings: list[Finding] = []
@@ -570,17 +614,27 @@ class ImportChecker(FileChecker):
         return findings
 
     def _i001(self, path: Path, tree: ast.Module) -> list[Finding]:
-        # Infer project root by walking up to the nearest pyproject.toml / setup.py.
-        # Stop at the filesystem root to avoid scanning /. Default to parent dir.
-        root = path.parent
-        candidate = root
-        for _ in range(8):  # max 8 levels up
-            if (candidate / "pyproject.toml").exists() or (candidate / "setup.py").exists():
-                root = candidate
-                break
-            if candidate.parent == candidate:
-                break
-            candidate = candidate.parent
+        # Determine the project root for local-package discovery. Priority order:
+        #   1. The engine's scan root, if plumbed in (`self._scan_root`).
+        #   2. Walk up looking for any standard project marker. We accept a wide
+        #      set so monorepos without pyproject.toml (e.g. Airflow data
+        #      pipelines, data-team monorepos) still resolve correctly.
+        #   3. Fall back to the file's parent directory.
+        if self._scan_root is not None:
+            root = self._scan_root
+        else:
+            root = path.parent
+            candidate = root
+            for _ in range(8):  # max 8 levels up
+                if any(
+                    (candidate / marker).exists()
+                    for marker in _PROJECT_ROOT_MARKERS
+                ):
+                    root = candidate
+                    break
+                if candidate.parent == candidate:
+                    break
+                candidate = candidate.parent
         local = _local_packages(root)
 
         findings = []

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/checkers/placeholders.py

@@ -2,8 +2,6 @@ from __future__ import annotations
 
 import ast
 import re
-import tokenize
-import io
 from pathlib import Path
 
 from ..models import Finding, Severity

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/checkers/quality.py

@@ -489,9 +489,13 @@ class _Q009Visitor(ast.NodeVisitor):
             return False
         left, right = test.left, test.comparators[0]
         # Match either side: `__name__ == "__main__"` or `"__main__" == __name__`.
-        is_dunder = lambda n: isinstance(n, ast.Name) and n.id == "__name__"
-        is_main = lambda n: isinstance(n, ast.Constant) and n.value == "__main__"
-        return (is_dunder(left) and is_main(right)) or (is_main(left) and is_dunder(right))
+        def _is_dunder(n: ast.expr) -> bool:
+            return isinstance(n, ast.Name) and n.id == "__name__"
+
+        def _is_main(n: ast.expr) -> bool:
+            return isinstance(n, ast.Constant) and n.value == "__main__"
+
+        return (_is_dunder(left) and _is_main(right)) or (_is_main(left) and _is_dunder(right))
 
     def visit_If(self, node: ast.If) -> None:
         if self._is_main_guard(node):

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/checkers/shell_checker.py

@@ -9,8 +9,12 @@ from .base import ShellFileChecker
 
 # ── patterns ──────────────────────────────────────────────────────────────────
 
-_SHEBANG_RE = re.compile(r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?(?:bash|sh|zsh|ksh)\b")
-_BASH_SHEBANG_RE = re.compile(r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?bash\b")
+_SHEBANG_RE = re.compile(
+    r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?(?:bash|sh|zsh|ksh)\b(?:\s.*)?$"
+)
+_BASH_SHEBANG_RE = re.compile(
+    r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?bash\b(?:\s.*)?$"
+)
 
 _SET_E_RE = re.compile(
     r"(?:^|\s)set\s+(?:-[a-zA-Z]*e[a-zA-Z]*|-o\s+errexit)", re.MULTILINE
@@ -21,7 +25,24 @@ _PIPE_RE = re.compile(r"[^|]\|[^|]")
 _CURL_BASH_RE = re.compile(
     r"(?:curl|wget)\s+[^\n|]+\|\s*(?:sudo\s+)?(?:bash|sh|zsh)\b", re.MULTILINE
 )
-_RM_RF_VAR_RE = re.compile(r"\brm\s+-rf\s+/\$[{]?[A-Za-z_]", re.MULTILINE)
+_RM_RF_VAR_RE = re.compile(
+    r"\brm\s+-rf\s+\"?/\$\{?(?P<var>[A-Za-z_][A-Za-z0-9_]*)\}?",
+    re.MULTILINE,
+)
+
+# Detect a guarding non-empty test of $VAR on the same line or up to
+# 5 lines above. Matches both [[ -n "$VAR" ]] and [ -n "$VAR" ] forms,
+# with optional braces around the variable name.
+def _has_guard(lines: list[str], line_idx: int, var: str) -> bool:
+    """Return True if a non-empty guard for `var` precedes line_idx."""
+    pattern = re.compile(
+        r"\[\[?\s*-n\s+\"?\$\{?" + re.escape(var) + r"\}?\"?\s*\]\]?"
+    )
+    start = max(0, line_idx - 5)
+    for i in range(start, line_idx + 1):
+        if pattern.search(lines[i]):
+            return True
+    return False
 
 # Placeholder variable assignments
 _PLACEHOLDER_VAR_RE = re.compile(
@@ -152,7 +173,7 @@ def _sh004_curl_bash(path: Path, source: str, lines: list[str]) -> list[Finding]
             path, lineno,
             "PROOFCTL-SH-004", "Remote code execution via curl|bash",
             Severity.ERROR,
-            f"curl/wget piped directly to bash — executes unverified remote code",
+            "curl/wget piped directly to bash — executes unverified remote code",
             hint="Download to a temp file, verify its SHA256 checksum, then execute.",
             authority="Google Shell Style Guide / CWE-78",
             docs_url="https://cwe.mitre.org/data/definitions/78.html",
@@ -161,10 +182,21 @@ def _sh004_curl_bash(path: Path, source: str, lines: list[str]) -> list[Finding]
 
 
 def _sh005_rm_rf_var(path: Path, source: str, lines: list[str]) -> list[Finding]:
-    """PROOFCTL-SH-005 — rm -rf /$VARIABLE (root wipe if var is empty)."""
+    """PROOFCTL-SH-005 — rm -rf /$VARIABLE (root wipe if var is empty).
+
+    Skip the finding when a non-empty guard for the same variable
+    appears on the same logical line or within a few lines above —
+    e.g. ``[[ -n "$VAR" ]] && rm -rf "/$VAR"`` or an enclosing
+    ``if [ -n "$VAR" ]; then rm -rf "/$VAR"; fi`` block.
+    """
     findings: list[Finding] = []
     for m in _RM_RF_VAR_RE.finditer(source):
         lineno = source[: m.start()].count("\n") + 1
+        var = m.group("var")
+        # 0-based index for `lines`
+        idx = lineno - 1
+        if 0 <= idx < len(lines) and _has_guard(lines, idx, var):
+            continue
         findings.append(_f(
             path, lineno,
             "PROOFCTL-SH-005", "Dangerous rm -rf on variable path",

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/checkers/terraform.py

@@ -304,7 +304,7 @@ class TerraformChecker(HclFileChecker):
             if b.kind != "resource":
                 continue
             inner = b.raw_lines[1:-1] if len(b.raw_lines) > 2 else []
-            content = [l for l in inner if l.strip() and not l.strip().startswith("#")]
+            content = [line for line in inner if line.strip() and not line.strip().startswith("#")]
             if not content:
                 out.append(self._f(
                     path, b.start_line,
@@ -394,7 +394,6 @@ class TerraformChecker(HclFileChecker):
     def _t004(self, path: Path, blocks: list[HclBlock], lines: list[str]) -> list[Finding]:
         """T-004 — Open ingress on sensitive ports (0.0.0.0/0)."""
         out = []
-        any_cidr = re.compile(r'(?:cidr_blocks|cidr_ranges|source_ranges)\s*=\s*\[.*"0\.0\.0\.0/0"')
         port_re = re.compile(r'(?:from_port|to_port|port)\s*=\s*(\d+)')
         all_traffic_re = re.compile(r'(?:protocol|ip_protocol)\s*=\s*"-1"|all\s*=\s*true')
 
@@ -653,9 +652,6 @@ class TerraformChecker(HclFileChecker):
     def _v001(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """V-001 — force_destroy / deletion_protection=false on prod-named resource."""
         out = []
-        dangerous = re.compile(
-            r'(?:force_destroy\s*=\s*true|deletion_protection\s*=\s*false)', re.IGNORECASE
-        )
         for b in blocks:
             if b.kind != "resource":
                 continue

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/checkers/yaml_checker.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 
 import re
 from pathlib import Path
-from typing import Any, Iterator
+from typing import Iterator
 
 import yaml
 
@@ -1400,67 +1400,76 @@ class _YamlCheckerImpl(YamlFileChecker):
     def check(self, path: Path, source: str) -> list[Finding]:
         findings: list[Finding] = []
 
-        # ── duplicate key detection ───────────────────────────────────────────
-        loader = _DupKeyLoader(source)
-        loader._dup_findings = []  # type: ignore[attr-defined]
+        # ── duplicate key detection (multi-doc aware) ─────────────────────────
+        # Use a fresh loader per document so _dup_findings does not leak
+        # from doc N into doc N+1 in a `---` separated stream.
+        all_dup_findings: list[tuple[str, int]] = []
         try:
-            loader.get_single_data()
+            loader = _DupKeyLoader(source)
+            loader._dup_findings = []  # type: ignore[attr-defined]
+            try:
+                while loader.check_data():
+                    loader.get_data()
+                    all_dup_findings.extend(loader._dup_findings)  # type: ignore[attr-defined]
+                    # Reset between documents — findings already harvested.
+                    loader._dup_findings = []  # type: ignore[attr-defined]
+            finally:
+                loader.dispose()
         except yaml.YAMLError:
             pass
-        finally:
-            loader.dispose()
-        findings.extend(_yaml002_findings(loader._dup_findings, path))  # type: ignore[attr-defined]
+        findings.extend(_yaml002_findings(all_dup_findings, path))
 
-        # ── node-based checks ─────────────────────────────────────────────────
+        # ── node-based checks (multi-doc aware) ───────────────────────────────
         try:
-            root = yaml.compose(source, Loader=yaml.SafeLoader)
+            roots = list(yaml.compose_all(source, Loader=yaml.SafeLoader))
         except yaml.YAMLError:
             return findings  # unparseable — dup findings are still valid
 
-        if root is None:
-            return findings
+        for root in roots:
+            if root is None:
+                continue
 
-        findings.extend(_yaml001(root, path))
-
-        if _is_k8s(root):
-            assert isinstance(root, yaml.MappingNode)
-            findings.extend(_yaml003_k8s(root, path))
-            findings.extend(_yaml004_k8s(root, path))
-            findings.extend(_yaml005_k8s(root, path))
-            findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
-            findings.extend(_yaml009_k8s(root, path))
-            findings.extend(_yaml010_k8s(root, path))
-            findings.extend(_yaml011_k8s(root, path))
-            findings.extend(_yaml012_k8s(root, path))
-            findings.extend(_yaml013_k8s(root, path))
-            findings.extend(_yaml014_k8s(root, path))
-            findings.extend(_yaml015_k8s(root, path))
-            findings.extend(_yaml016_017_k8s(root, path))
-            findings.extend(_yaml018_k8s(root, path))
-            findings.extend(_yaml020_k8s(root, path))
-            findings.extend(_yaml021_k8s(root, path))
-            # AI-slop: removed apiVersions, PSP, explicit root, deprecated annotations
-            findings.extend(_yaml_ai001_k8s_removed_api(root, path))
-            findings.extend(_yaml_ai002_pod_security_policy(root, path))
-            findings.extend(_yaml_ai003_run_as_user_root(root, path))
-            findings.extend(_yaml_ai006_ingress_class_annotation(root, path))
-
-        elif _is_compose(root):
-            findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
-            findings.extend(_yaml008_compose_privileged(root, path))
-
-        if _is_gha(path) or _is_gha_content(root):
-            findings.extend(_yaml007_gha(root, path))
-            if isinstance(root, yaml.MappingNode):
-                findings.extend(_yaml_gha001(root, path))
-                findings.extend(_yaml_gha002(root, path))
-                findings.extend(_yaml_gha003(root, path))
-                findings.extend(_yaml_gha004(root, path))
-                findings.extend(_yaml_gha005(root, path))
-                findings.extend(_yaml_gha006(root, path))
-                # AI-slop: deprecated workflow commands, stale action versions
-                findings.extend(_yaml_ai004_gha_deprecated_commands(root, path))
-                findings.extend(_yaml_ai005_old_action_versions(root, path))
+            findings.extend(_yaml001(root, path))
+
+            if _is_k8s(root):
+                assert isinstance(root, yaml.MappingNode)
+                findings.extend(_yaml003_k8s(root, path))
+                findings.extend(_yaml004_k8s(root, path))
+                findings.extend(_yaml005_k8s(root, path))
+                findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
+                findings.extend(_yaml009_k8s(root, path))
+                findings.extend(_yaml010_k8s(root, path))
+                findings.extend(_yaml011_k8s(root, path))
+                findings.extend(_yaml012_k8s(root, path))
+                findings.extend(_yaml013_k8s(root, path))
+                findings.extend(_yaml014_k8s(root, path))
+                findings.extend(_yaml015_k8s(root, path))
+                findings.extend(_yaml016_017_k8s(root, path))
+                findings.extend(_yaml018_k8s(root, path))
+                findings.extend(_yaml020_k8s(root, path))
+                findings.extend(_yaml021_k8s(root, path))
+                # AI-slop: removed apiVersions, PSP, explicit root, deprecated annotations
+                findings.extend(_yaml_ai001_k8s_removed_api(root, path))
+                findings.extend(_yaml_ai002_pod_security_policy(root, path))
+                findings.extend(_yaml_ai003_run_as_user_root(root, path))
+                findings.extend(_yaml_ai006_ingress_class_annotation(root, path))
+
+            elif _is_compose(root):
+                findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
+                findings.extend(_yaml008_compose_privileged(root, path))
+
+            if _is_gha(path) or _is_gha_content(root):
+                findings.extend(_yaml007_gha(root, path))
+                if isinstance(root, yaml.MappingNode):
+                    findings.extend(_yaml_gha001(root, path))
+                    findings.extend(_yaml_gha002(root, path))
+                    findings.extend(_yaml_gha003(root, path))
+                    findings.extend(_yaml_gha004(root, path))
+                    findings.extend(_yaml_gha005(root, path))
+                    findings.extend(_yaml_gha006(root, path))
+                    # AI-slop: deprecated workflow commands, stale action versions
+                    findings.extend(_yaml_ai004_gha_deprecated_commands(root, path))
+                    findings.extend(_yaml_ai005_old_action_versions(root, path))
 
         return findings
 

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/cli.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 
+import sys
 from enum import Enum
 from pathlib import Path
-from typing import List, Optional
+from typing import Optional
 
 import typer
 
@@ -10,6 +11,29 @@ from .config import load_config
 from .engine import run_check
 from .registry import RULES, families_help_string, is_hidden_family
 
+
+def _ensure_utf8_io() -> None:
+    """Force stdout/stderr to UTF-8.
+
+    Rich-rendered tables embed box-drawing characters (─ │ ╭),
+    arrows (→), and emoji (📖 ✓) that can't be encoded under
+    Windows' default cp1252 locale — proofctl crashes mid-render with
+    UnicodeEncodeError. Reconfiguring at startup makes output portable
+    regardless of host locale; `errors="replace"` is a defensive fallback
+    so a misconfigured stream never aborts the run.
+    """
+    for stream_name in ("stdout", "stderr"):
+        stream = getattr(sys, stream_name, None)
+        if stream is None or not hasattr(stream, "reconfigure"):
+            continue
+        try:
+            stream.reconfigure(encoding="utf-8", errors="replace")
+        except (OSError, ValueError):
+            pass
+
+
+_ensure_utf8_io()
+
 app = typer.Typer(
     name="proofctl",
     help="Detects AI-generated slop: hallucinated imports, phantom methods, placeholder code, cross-language leakage, and variant file debris.",

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/engine.py

@@ -17,7 +17,6 @@ import ast
 import dataclasses
 import re
 import subprocess
-import traceback
 from pathlib import Path
 from typing import Iterable
 
@@ -99,7 +98,11 @@ def _changed_files_all(root: Path) -> list[Path]:
     return []
 
 
-def _build_file_checkers(config: ProofctlConfig, families: set[str] | None) -> list:
+def _build_file_checkers(
+    config: ProofctlConfig,
+    families: set[str] | None,
+    scan_root: Path | None = None,
+) -> list:
     checkers = []
 
     def _include(family: str) -> bool:
@@ -121,6 +124,7 @@ def _build_file_checkers(config: ProofctlConfig, families: set[str] | None) -> l
             local_namespaces=config.local_namespaces,
             extra_indexes=config.pypi_extra_indexes,
             check_pypi=config.check_pypi,
+            scan_root=scan_root,
         ))
     if _include("S"):
         checkers.append(SecurityChecker())
@@ -281,7 +285,7 @@ def run_check(
             by_kind[kind].append(p)
 
     # ── 4. Build per-format checker lists. ───────────────────────────────────
-    file_checkers = _build_file_checkers(config, fam_set)
+    file_checkers = _build_file_checkers(config, fam_set, scan_root=root)
     dir_checkers = _build_dir_checkers(config, fam_set)
     hcl_file_checkers = _build_hcl_file_checkers(config, fam_set)
     hcl_dir_checkers = _build_hcl_dir_checkers(config, fam_set)

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/models.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 from enum import IntEnum
 
 

{proofctl-0.1.10 → proofctl-0.2.0}/proofctl/reporters/html_reporter.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import html
-import json
 from collections import Counter
 from datetime import datetime, timezone
 
@@ -160,6 +159,7 @@ class HtmlReporter:
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="proofctl:schema_version" content="1">
 <title>proofctl report</title>
 <style>{_CSS}</style>
 </head>