proofctl 0.1.11__tar.gz → 0.2.0__tar.gz

{proofctl-0.1.11 → proofctl-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.1.11
+Version: 0.2.0
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/checkers/dockerfile.py

@@ -9,7 +9,7 @@ from .base import DockerfileChecker
 
 # ── helpers ───────────────────────────────────────────────────────────────────
 
-_SHA_DIGEST_RE = re.compile(r"@sha256:[a-f0-9]{64}")
+_SHA_DIGEST_RE = re.compile(r"@sha(?:256:[a-f0-9]{64}|384:[a-f0-9]{96}|512:[a-f0-9]{128})")
 _HAS_TAG_RE = re.compile(r":[a-zA-Z0-9][\w.\-]*$")
 
 # DF-007: curl/wget piped to a shell
@@ -330,16 +330,26 @@ def _df008(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
         if "--checksum=sha256:" in args:
             continue
 
-        # Check the next 3 instructions for a verification RUN
-        window = instructions[idx + 1: idx + 4]
-        verified = any(
-            next_instr == "RUN" and (
+        # Walk the full continuation chain — inspect every subsequent RUN
+        # instruction (each already collapsed across `\` continuations by
+        # the parser) until we hit a non-RUN instruction. This catches
+        # `RUN wget && sha256sum -c && tar xz` chains and multi-RUN
+        # verification sequences that overflowed the old 3-instruction
+        # window.
+        verified = False
+        for _, next_instr, next_args in instructions[idx + 1:]:
+            if next_instr != "RUN":
+                break
+            if (
                 "sha256sum" in next_args
+                or "sha512sum" in next_args
                 or "shasum -a 256" in next_args
+                or "shasum -a 512" in next_args
                 or "gpg --verify" in next_args
-            )
-            for _, next_instr, next_args in window
-        )
+                or "gpg2 --verify" in next_args
+            ):
+                verified = True
+                break
         if verified:
             continue
 
@@ -359,18 +369,30 @@ def _df008(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
 
 
 def _df009(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding]:
-    """PROOFCTL-DF-009 — COPY . . before dependency installation."""
+    """PROOFCTL-DF-009 — COPY . . before dependency installation.
+
+    Multi-stage context: in a Dockerfile with multiple FROM stages,
+    early/builder stages routinely COPY . to compile or vendor
+    dependencies; the cache-invalidation antipattern only matters in
+    the final (runtime) stage. Skip the rule entirely for non-final
+    stages.
+    """
     findings: list[Finding] = []
 
-    # Broad COPY destinations that indicate a full source-tree copy
-    _broad_dests = {"/app", "/src", "/code", "/workspace", "."}
+    # Determine the line range of the FINAL build stage. Anything
+    # before that range belongs to an earlier (e.g. builder) stage.
+    from_linenos = [ln for ln, instr, _ in instructions if instr == "FROM"]
+    is_multistage = len(from_linenos) > 1
+    final_stage_start = from_linenos[-1] if from_linenos else 0
 
-    # Find the first broad COPY (source is bare ".")
+    # Find the first broad COPY (source is bare ".") in the FINAL stage.
     first_broad_copy: tuple[int, str, str] | None = None
     for item in instructions:
         lineno, instr, args = item
         if instr != "COPY":
             continue
+        if is_multistage and lineno < final_stage_start:
+            continue  # earlier stage — not subject to DF-009
         tokens = args.split()
         if not tokens:
             continue
@@ -384,10 +406,14 @@ def _df009(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
 
     copy_lineno = first_broad_copy[0]
 
-    # Find the first dependency-install RUN
+    # Find the first dependency-install RUN — only consider RUNs in
+    # the final stage (otherwise we'd cross-match a builder-stage RUN
+    # with a final-stage COPY).
     for lineno, instr, args in instructions:
         if instr != "RUN":
             continue
+        if is_multistage and lineno < final_stage_start:
+            continue
         if _DEP_INSTALL_RE.search(args):
             if copy_lineno < lineno:
                 findings.append(Finding(

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/checkers/placeholders.py

@@ -2,8 +2,6 @@ from __future__ import annotations
 
 import ast
 import re
-import tokenize
-import io
 from pathlib import Path
 
 from ..models import Finding, Severity

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/checkers/quality.py

@@ -489,9 +489,13 @@ class _Q009Visitor(ast.NodeVisitor):
             return False
         left, right = test.left, test.comparators[0]
         # Match either side: `__name__ == "__main__"` or `"__main__" == __name__`.
-        is_dunder = lambda n: isinstance(n, ast.Name) and n.id == "__name__"
-        is_main = lambda n: isinstance(n, ast.Constant) and n.value == "__main__"
-        return (is_dunder(left) and is_main(right)) or (is_main(left) and is_dunder(right))
+        def _is_dunder(n: ast.expr) -> bool:
+            return isinstance(n, ast.Name) and n.id == "__name__"
+
+        def _is_main(n: ast.expr) -> bool:
+            return isinstance(n, ast.Constant) and n.value == "__main__"
+
+        return (_is_dunder(left) and _is_main(right)) or (_is_main(left) and _is_dunder(right))
 
     def visit_If(self, node: ast.If) -> None:
         if self._is_main_guard(node):

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/checkers/shell_checker.py

@@ -9,8 +9,12 @@ from .base import ShellFileChecker
 
 # ── patterns ──────────────────────────────────────────────────────────────────
 
-_SHEBANG_RE = re.compile(r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?(?:bash|sh|zsh|ksh)\b")
-_BASH_SHEBANG_RE = re.compile(r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?bash\b")
+_SHEBANG_RE = re.compile(
+    r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?(?:bash|sh|zsh|ksh)\b(?:\s.*)?$"
+)
+_BASH_SHEBANG_RE = re.compile(
+    r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?bash\b(?:\s.*)?$"
+)
 
 _SET_E_RE = re.compile(
     r"(?:^|\s)set\s+(?:-[a-zA-Z]*e[a-zA-Z]*|-o\s+errexit)", re.MULTILINE
@@ -21,7 +25,24 @@ _PIPE_RE = re.compile(r"[^|]\|[^|]")
 _CURL_BASH_RE = re.compile(
     r"(?:curl|wget)\s+[^\n|]+\|\s*(?:sudo\s+)?(?:bash|sh|zsh)\b", re.MULTILINE
 )
-_RM_RF_VAR_RE = re.compile(r"\brm\s+-rf\s+/\$[{]?[A-Za-z_]", re.MULTILINE)
+_RM_RF_VAR_RE = re.compile(
+    r"\brm\s+-rf\s+\"?/\$\{?(?P<var>[A-Za-z_][A-Za-z0-9_]*)\}?",
+    re.MULTILINE,
+)
+
+# Detect a guarding non-empty test of $VAR on the same line or up to
+# 5 lines above. Matches both [[ -n "$VAR" ]] and [ -n "$VAR" ] forms,
+# with optional braces around the variable name.
+def _has_guard(lines: list[str], line_idx: int, var: str) -> bool:
+    """Return True if a non-empty guard for `var` precedes line_idx."""
+    pattern = re.compile(
+        r"\[\[?\s*-n\s+\"?\$\{?" + re.escape(var) + r"\}?\"?\s*\]\]?"
+    )
+    start = max(0, line_idx - 5)
+    for i in range(start, line_idx + 1):
+        if pattern.search(lines[i]):
+            return True
+    return False
 
 # Placeholder variable assignments
 _PLACEHOLDER_VAR_RE = re.compile(
@@ -152,7 +173,7 @@ def _sh004_curl_bash(path: Path, source: str, lines: list[str]) -> list[Finding]
             path, lineno,
             "PROOFCTL-SH-004", "Remote code execution via curl|bash",
             Severity.ERROR,
-            f"curl/wget piped directly to bash — executes unverified remote code",
+            "curl/wget piped directly to bash — executes unverified remote code",
             hint="Download to a temp file, verify its SHA256 checksum, then execute.",
             authority="Google Shell Style Guide / CWE-78",
             docs_url="https://cwe.mitre.org/data/definitions/78.html",
@@ -161,10 +182,21 @@ def _sh004_curl_bash(path: Path, source: str, lines: list[str]) -> list[Finding]
 
 
 def _sh005_rm_rf_var(path: Path, source: str, lines: list[str]) -> list[Finding]:
-    """PROOFCTL-SH-005 — rm -rf /$VARIABLE (root wipe if var is empty)."""
+    """PROOFCTL-SH-005 — rm -rf /$VARIABLE (root wipe if var is empty).
+
+    Skip the finding when a non-empty guard for the same variable
+    appears on the same logical line or within a few lines above —
+    e.g. ``[[ -n "$VAR" ]] && rm -rf "/$VAR"`` or an enclosing
+    ``if [ -n "$VAR" ]; then rm -rf "/$VAR"; fi`` block.
+    """
     findings: list[Finding] = []
     for m in _RM_RF_VAR_RE.finditer(source):
         lineno = source[: m.start()].count("\n") + 1
+        var = m.group("var")
+        # 0-based index for `lines`
+        idx = lineno - 1
+        if 0 <= idx < len(lines) and _has_guard(lines, idx, var):
+            continue
         findings.append(_f(
             path, lineno,
             "PROOFCTL-SH-005", "Dangerous rm -rf on variable path",

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/checkers/terraform.py

@@ -304,7 +304,7 @@ class TerraformChecker(HclFileChecker):
             if b.kind != "resource":
                 continue
             inner = b.raw_lines[1:-1] if len(b.raw_lines) > 2 else []
-            content = [l for l in inner if l.strip() and not l.strip().startswith("#")]
+            content = [line for line in inner if line.strip() and not line.strip().startswith("#")]
             if not content:
                 out.append(self._f(
                     path, b.start_line,
@@ -394,7 +394,6 @@ class TerraformChecker(HclFileChecker):
     def _t004(self, path: Path, blocks: list[HclBlock], lines: list[str]) -> list[Finding]:
         """T-004 — Open ingress on sensitive ports (0.0.0.0/0)."""
         out = []
-        any_cidr = re.compile(r'(?:cidr_blocks|cidr_ranges|source_ranges)\s*=\s*\[.*"0\.0\.0\.0/0"')
         port_re = re.compile(r'(?:from_port|to_port|port)\s*=\s*(\d+)')
         all_traffic_re = re.compile(r'(?:protocol|ip_protocol)\s*=\s*"-1"|all\s*=\s*true')
 
@@ -653,9 +652,6 @@ class TerraformChecker(HclFileChecker):
     def _v001(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """V-001 — force_destroy / deletion_protection=false on prod-named resource."""
         out = []
-        dangerous = re.compile(
-            r'(?:force_destroy\s*=\s*true|deletion_protection\s*=\s*false)', re.IGNORECASE
-        )
         for b in blocks:
             if b.kind != "resource":
                 continue

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/checkers/yaml_checker.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 
 import re
 from pathlib import Path
-from typing import Any, Iterator
+from typing import Iterator
 
 import yaml
 
@@ -1400,67 +1400,76 @@ class _YamlCheckerImpl(YamlFileChecker):
     def check(self, path: Path, source: str) -> list[Finding]:
         findings: list[Finding] = []
 
-        # ── duplicate key detection ───────────────────────────────────────────
-        loader = _DupKeyLoader(source)
-        loader._dup_findings = []  # type: ignore[attr-defined]
+        # ── duplicate key detection (multi-doc aware) ─────────────────────────
+        # Use a fresh loader per document so _dup_findings does not leak
+        # from doc N into doc N+1 in a `---` separated stream.
+        all_dup_findings: list[tuple[str, int]] = []
         try:
-            loader.get_single_data()
+            loader = _DupKeyLoader(source)
+            loader._dup_findings = []  # type: ignore[attr-defined]
+            try:
+                while loader.check_data():
+                    loader.get_data()
+                    all_dup_findings.extend(loader._dup_findings)  # type: ignore[attr-defined]
+                    # Reset between documents — findings already harvested.
+                    loader._dup_findings = []  # type: ignore[attr-defined]
+            finally:
+                loader.dispose()
         except yaml.YAMLError:
             pass
-        finally:
-            loader.dispose()
-        findings.extend(_yaml002_findings(loader._dup_findings, path))  # type: ignore[attr-defined]
+        findings.extend(_yaml002_findings(all_dup_findings, path))
 
-        # ── node-based checks ─────────────────────────────────────────────────
+        # ── node-based checks (multi-doc aware) ───────────────────────────────
         try:
-            root = yaml.compose(source, Loader=yaml.SafeLoader)
+            roots = list(yaml.compose_all(source, Loader=yaml.SafeLoader))
         except yaml.YAMLError:
             return findings  # unparseable — dup findings are still valid
 
-        if root is None:
-            return findings
+        for root in roots:
+            if root is None:
+                continue
 
-        findings.extend(_yaml001(root, path))
-
-        if _is_k8s(root):
-            assert isinstance(root, yaml.MappingNode)
-            findings.extend(_yaml003_k8s(root, path))
-            findings.extend(_yaml004_k8s(root, path))
-            findings.extend(_yaml005_k8s(root, path))
-            findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
-            findings.extend(_yaml009_k8s(root, path))
-            findings.extend(_yaml010_k8s(root, path))
-            findings.extend(_yaml011_k8s(root, path))
-            findings.extend(_yaml012_k8s(root, path))
-            findings.extend(_yaml013_k8s(root, path))
-            findings.extend(_yaml014_k8s(root, path))
-            findings.extend(_yaml015_k8s(root, path))
-            findings.extend(_yaml016_017_k8s(root, path))
-            findings.extend(_yaml018_k8s(root, path))
-            findings.extend(_yaml020_k8s(root, path))
-            findings.extend(_yaml021_k8s(root, path))
-            # AI-slop: removed apiVersions, PSP, explicit root, deprecated annotations
-            findings.extend(_yaml_ai001_k8s_removed_api(root, path))
-            findings.extend(_yaml_ai002_pod_security_policy(root, path))
-            findings.extend(_yaml_ai003_run_as_user_root(root, path))
-            findings.extend(_yaml_ai006_ingress_class_annotation(root, path))
-
-        elif _is_compose(root):
-            findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
-            findings.extend(_yaml008_compose_privileged(root, path))
-
-        if _is_gha(path) or _is_gha_content(root):
-            findings.extend(_yaml007_gha(root, path))
-            if isinstance(root, yaml.MappingNode):
-                findings.extend(_yaml_gha001(root, path))
-                findings.extend(_yaml_gha002(root, path))
-                findings.extend(_yaml_gha003(root, path))
-                findings.extend(_yaml_gha004(root, path))
-                findings.extend(_yaml_gha005(root, path))
-                findings.extend(_yaml_gha006(root, path))
-                # AI-slop: deprecated workflow commands, stale action versions
-                findings.extend(_yaml_ai004_gha_deprecated_commands(root, path))
-                findings.extend(_yaml_ai005_old_action_versions(root, path))
+            findings.extend(_yaml001(root, path))
+
+            if _is_k8s(root):
+                assert isinstance(root, yaml.MappingNode)
+                findings.extend(_yaml003_k8s(root, path))
+                findings.extend(_yaml004_k8s(root, path))
+                findings.extend(_yaml005_k8s(root, path))
+                findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
+                findings.extend(_yaml009_k8s(root, path))
+                findings.extend(_yaml010_k8s(root, path))
+                findings.extend(_yaml011_k8s(root, path))
+                findings.extend(_yaml012_k8s(root, path))
+                findings.extend(_yaml013_k8s(root, path))
+                findings.extend(_yaml014_k8s(root, path))
+                findings.extend(_yaml015_k8s(root, path))
+                findings.extend(_yaml016_017_k8s(root, path))
+                findings.extend(_yaml018_k8s(root, path))
+                findings.extend(_yaml020_k8s(root, path))
+                findings.extend(_yaml021_k8s(root, path))
+                # AI-slop: removed apiVersions, PSP, explicit root, deprecated annotations
+                findings.extend(_yaml_ai001_k8s_removed_api(root, path))
+                findings.extend(_yaml_ai002_pod_security_policy(root, path))
+                findings.extend(_yaml_ai003_run_as_user_root(root, path))
+                findings.extend(_yaml_ai006_ingress_class_annotation(root, path))
+
+            elif _is_compose(root):
+                findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
+                findings.extend(_yaml008_compose_privileged(root, path))
+
+            if _is_gha(path) or _is_gha_content(root):
+                findings.extend(_yaml007_gha(root, path))
+                if isinstance(root, yaml.MappingNode):
+                    findings.extend(_yaml_gha001(root, path))
+                    findings.extend(_yaml_gha002(root, path))
+                    findings.extend(_yaml_gha003(root, path))
+                    findings.extend(_yaml_gha004(root, path))
+                    findings.extend(_yaml_gha005(root, path))
+                    findings.extend(_yaml_gha006(root, path))
+                    # AI-slop: deprecated workflow commands, stale action versions
+                    findings.extend(_yaml_ai004_gha_deprecated_commands(root, path))
+                    findings.extend(_yaml_ai005_old_action_versions(root, path))
 
         return findings
 

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/cli.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 
+import sys
 from enum import Enum
 from pathlib import Path
-from typing import List, Optional
+from typing import Optional
 
 import typer
 
@@ -10,6 +11,29 @@ from .config import load_config
 from .engine import run_check
 from .registry import RULES, families_help_string, is_hidden_family
 
+
+def _ensure_utf8_io() -> None:
+    """Force stdout/stderr to UTF-8.
+
+    Rich-rendered tables embed box-drawing characters (─ │ ╭),
+    arrows (→), and emoji (📖 ✓) that can't be encoded under
+    Windows' default cp1252 locale — proofctl crashes mid-render with
+    UnicodeEncodeError. Reconfiguring at startup makes output portable
+    regardless of host locale; `errors="replace"` is a defensive fallback
+    so a misconfigured stream never aborts the run.
+    """
+    for stream_name in ("stdout", "stderr"):
+        stream = getattr(sys, stream_name, None)
+        if stream is None or not hasattr(stream, "reconfigure"):
+            continue
+        try:
+            stream.reconfigure(encoding="utf-8", errors="replace")
+        except (OSError, ValueError):
+            pass
+
+
+_ensure_utf8_io()
+
 app = typer.Typer(
     name="proofctl",
     help="Detects AI-generated slop: hallucinated imports, phantom methods, placeholder code, cross-language leakage, and variant file debris.",

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/engine.py

@@ -17,7 +17,6 @@ import ast
 import dataclasses
 import re
 import subprocess
-import traceback
 from pathlib import Path
 from typing import Iterable
 

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/models.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 from enum import IntEnum
 
 

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/reporters/html_reporter.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import html
-import json
 from collections import Counter
 from datetime import datetime, timezone
 
@@ -160,6 +159,7 @@ class HtmlReporter:
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="proofctl:schema_version" content="1">
 <title>proofctl report</title>
 <style>{_CSS}</style>
 </head>

proofctl-0.2.0/proofctl/reporters/json_reporter.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import json
+from collections import Counter
+
+from ..models import Finding, Severity
+
+# Bumped in lockstep with documented JSON schema changes. Consumers can branch
+# on this field. Start at 1 since this is the first formally-stable schema.
+SCHEMA_VERSION = 1
+
+# Stable field order for each finding object. Matches the order documented in
+# the README and used by external tooling.
+_FINDING_FIELDS = (
+    "file",
+    "line",
+    "col",
+    "rule_id",
+    "rule_name",
+    "severity",
+    "message",
+    "hint",
+    "authority",
+    "docs_url",
+    "fixable",
+)
+
+
+class JsonReporter:
+    def render(self, findings: list[Finding]) -> str:
+        counts = Counter(f.severity for f in findings)
+
+        # Stable summary order: total, ERROR, WARNING, INFO (matches README).
+        summary = {
+            "total": len(findings),
+            "ERROR": counts[Severity.ERROR],
+            "WARNING": counts[Severity.WARNING],
+            "INFO": counts[Severity.INFO],
+        }
+
+        serialisable = []
+        for f in findings:
+            d = {
+                "file": f.file,
+                "line": f.line,
+                "col": f.col,
+                "rule_id": f.rule_id,
+                "rule_name": f.rule_name,
+                "severity": f.severity.label(),
+                "message": f.message,
+                "hint": f.hint,
+                "authority": f.authority,
+                "docs_url": f.docs_url,
+                "fixable": f.fixable,
+            }
+            serialisable.append(d)
+
+        payload = {
+            "schema_version": SCHEMA_VERSION,
+            "summary": summary,
+            "findings": serialisable,
+        }
+        return json.dumps(payload, indent=2)

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl/reporters/terminal.py

@@ -24,6 +24,10 @@ _SEV_STYLE: dict[Severity, str] = {
     Severity.INFO:    "dim",
 }
 
+# Default stdout console used when no console is injected. Retained as a
+# module-level default for backward compatibility, but engine/CLI code should
+# pass a Console explicitly to keep ordering deterministic in piped scenarios
+# (see AUDIT 1.6 — Reporters: console unification).
 console = Console(highlight=False)
 
 
@@ -34,19 +38,28 @@ def _location(f: Finding) -> str:
 
 
 class TerminalReporter:
-    def render(self, findings: list[Finding], output: Path | None = None) -> str:
+    def render(
+        self,
+        findings: list[Finding],
+        output: Path | None = None,
+        console_: Console | None = None,
+    ) -> str:
         """Render findings to the terminal, or capture to a string when `output` is set.
 
         When `output` is provided, the reporter renders into an in-memory Console
         and returns the captured text (with ANSI styling stripped) so the caller
-        can write it to disk. Otherwise, prints to the module-level stdout console
-        and returns "".
+        can write it to disk. Otherwise, prints via the supplied `console_`
+        (or the module-level default) and returns "".
+
+        Passing an explicit `console_` lets callers share a single Console with
+        the engine so stdout/stderr ordering stays deterministic when output is
+        piped — the audit identified non-deterministic ordering as a defect.
         """
         if output is not None:
             buf = io.StringIO()
             target = Console(file=buf, force_terminal=False, no_color=True, width=120, highlight=False)
         else:
-            target = console
+            target = console_ if console_ is not None else console
 
         if not findings:
             target.print(Padding("[bold green]✓  No findings.[/bold green]", (1, 2)))

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.1.11
+Version: 0.2.0
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.1.11 → proofctl-0.2.0}/proofctl.egg-info/SOURCES.txt

@@ -51,6 +51,8 @@ tests/test_phase4_audit_fixes.py
 tests/test_phase5_llm_imports_fixes.py
 tests/test_phase5_p_l_v_fixes.py
 tests/test_phase5_quality_fixes.py
+tests/test_phase6_audit_fixes.py
+tests/test_phase8_audit_fixes.py
 tests/test_placeholders.py
 tests/test_quality.py
 tests/test_quality_ext.py

{proofctl-0.1.11 → proofctl-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.1.11"
+version = "0.2.0"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }

{proofctl-0.1.11 → proofctl-0.2.0}/tests/test_dockerfile.py

@@ -326,7 +326,11 @@ def test_df008_add_local_file_not_flagged():
 
 
 def test_df008_verify_outside_window_flags():
-    """sha256sum more than 3 instructions away should still flag."""
+    """Phase 6 fix: walking the full RUN continuation chain (until a
+    non-RUN instruction) means sha256sum verification any number of
+    RUN steps after the ADD now suppresses the finding. The OLD
+    behaviour capped the lookahead at 3 instructions and therefore
+    flagged this — that was the bug fixed in Phase 6 of the audit."""
     src = (
         "FROM ubuntu:22.04\n"
         "ADD https://example.com/tool.tar.gz /tmp/tool.tar.gz\n"
@@ -336,8 +340,7 @@ def test_df008_verify_outside_window_flags():
         "RUN sha256sum -c /tmp/tool.tar.gz.sha256\n"
         "USER app\nCMD bash\n"
     )
-    f = _find(_check(src), "PROOFCTL-DF-008")
-    assert len(f) == 1
+    assert "PROOFCTL-DF-008" not in _ids(_check(src))
 
 
 # ══════════════════════════════════════════════════════════════════════════════

{proofctl-0.1.11 → proofctl-0.2.0}/tests/test_phase1_audit_fixes.py

@@ -109,9 +109,13 @@ def test_c6_terminal_reporter_renders_to_string_when_output_set(tmp_path):
     reporter = TerminalReporter()
     content = reporter.render(findings, output=out_file)
     assert content, "render() with output= must return non-empty captured text"
-    out_file.write_text(content)
+    # Rich output contains box-drawing chars (│ ─), the 📖 emoji, and ✓ —
+    # Path.write_text defaults to the platform locale (cp1252 on Windows
+    # CI), which can't encode them. Force utf-8 to mirror what the CLI
+    # itself does in proofctl/cli.py.
+    out_file.write_text(content, encoding="utf-8")
     assert out_file.stat().st_size > 0
-    assert "PROOFCTL-Q-001" in out_file.read_text()
+    assert "PROOFCTL-Q-001" in out_file.read_text(encoding="utf-8")
 
 
 def test_c6_terminal_reporter_returns_empty_string_for_no_findings_with_output(tmp_path):