proofctl 0.1.7__tar.gz → 0.1.9__tar.gz

{proofctl-0.1.7 → proofctl-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.1.7
+Version: 0.1.9
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.1.7 → proofctl-0.1.9}/proofctl/checkers/hcl_utils.py

@@ -77,12 +77,29 @@ def parse_blocks(source: str) -> list[HclBlock]:
     return _parse(source.splitlines(), base=1, skip_outer=False)
 
 
+def _is_escaped(line: str, idx: int) -> bool:
+    """True if `line[idx]` is preceded by an odd run of backslashes.
+
+    Counting the run is the only correct way to tell `\\"` (escaped backslash
+    followed by an unescaped quote) from `\"` (escaped quote). The previous
+    one-character lookback `line[i-1] == '\\\\'` got this wrong: in
+    `password = "my\\\\\\"secret"`, it treated the closing quote as escaped
+    and tokenisation silently broke for every rule that walked block bodies.
+    """
+    n = 0
+    j = idx - 1
+    while j >= 0 and line[j] == "\\":
+        n += 1
+        j -= 1
+    return n % 2 == 1
+
+
 def _strip_comment(line: str) -> str:
     in_str = False
     i = 0
     while i < len(line):
         c = line[i]
-        if c == '"' and (i == 0 or line[i - 1] != '\\'):
+        if c == '"' and not _is_escaped(line, i):
             in_str = not in_str
         if not in_str:
             if c == '#':
@@ -137,7 +154,12 @@ def _parse(lines: list[str], base: int, skip_outer: bool) -> list[HclBlock]:
 
         # ── heredoc passthrough ──
         if heredoc_end:
-            if line.strip() == heredoc_end or line.strip().rstrip("-~") == heredoc_end:
+            # The end label must appear on a line of its own (whitespace either
+            # side allowed for `<<-` indented heredocs). The previous loose
+            # `rstrip("-~")` matched lines like `EOF~~~` as terminators, which
+            # could prematurely close a heredoc whose body legitimately ended
+            # with `~`. C-11 fix: strict whole-line match after .strip().
+            if line.strip() == heredoc_end:
                 heredoc_end = None
             continue
         hm = _HEREDOC_START_RE.search(line)

{proofctl-0.1.7 → proofctl-0.1.9}/proofctl/checkers/imports.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import ast
+import functools
 import json
 import re
 import shutil
@@ -237,26 +238,78 @@ def _stdlib_names() -> frozenset[str]:
     })
 
 
+# Directories never worth descending into when looking for local packages.
+# These are scanner / vendor / virtualenv folders, not first-party code.
+_PKG_SCAN_SKIP_DIRS: frozenset[str] = frozenset({
+    ".venv", "venv", ".env",
+    "node_modules",
+    ".git", ".hg", ".svn",
+    "__pycache__",
+    "dist", "build",
+    ".terraform", ".terragrunt-cache",
+    ".tox", ".nox",
+    ".pytest_cache", ".mypy_cache", ".ruff_cache",
+    "site-packages",
+})
+
+# Cap the recursion depth so a runaway symlink or pathological repo can't lock
+# the scanner. 8 is enough for monorepos (e.g. orchestration/dags/<pkg>/__init__.py
+# is depth 3).
+_PKG_SCAN_MAX_DEPTH = 8
+
+
+@functools.lru_cache(maxsize=32)
 def _local_packages(root: Path) -> frozenset[str]:
-    """Top-level importable names within the scanned project."""
+    """Importable Python package/module names anywhere in the project.
+
+    Walks the project subtree looking for `__init__.py` files; the parent
+    directory of every such file becomes a known local package. Also picks up
+    bare top-level `.py` files at the project root.
+
+    The previous root-only walk missed packages nested under sub-trees
+    (e.g. `orchestration/dags/airflow_ip_taskgroups/__init__.py`), generating
+    spurious PROOFCTL-I-001 hallucinated-import findings against private code.
+
+    The walk skips common vendor / cache / virtualenv directories, never
+    follows symlinks, and caps recursion at `_PKG_SCAN_MAX_DEPTH`.
+    Results are cached per-root so a 500-file scan walks the tree once.
+    """
     names: set[str] = set()
-    try:
-        children = list(root.iterdir())
-    except (OSError, PermissionError):
-        return frozenset()
-    for child in children:
-        if child.is_dir() and (child / "__init__.py").exists():
-            names.add(child.name)
-        elif child.suffix == ".py" and child.name != "__init__.py":
-            names.add(child.stem)
-    # Also check src/ layout
-    src = root / "src"
-    if src.is_dir():
-        for child in src.iterdir():
-            if child.is_dir() and (child / "__init__.py").exists():
-                names.add(child.name)
-            elif child.suffix == ".py":
+    visited: set[Path] = set()
+
+    def _walk(path: Path, depth: int) -> None:
+        if depth > _PKG_SCAN_MAX_DEPTH:
+            return
+        try:
+            real = path.resolve()
+        except OSError:
+            return
+        if real in visited:
+            return  # symlink loop guard
+        visited.add(real)
+        try:
+            children = list(path.iterdir())
+        except (OSError, PermissionError):
+            return
+        for child in children:
+            if child.is_symlink():
+                continue
+            if child.is_dir():
+                if child.name in _PKG_SCAN_SKIP_DIRS:
+                    continue
+                if child.name.endswith(".egg-info"):
+                    continue
+                if child.name.startswith(".") and child.name not in {".github"}:
+                    # Skip hidden directories — they're caches, IDE state, etc.
+                    continue
+                if (child / "__init__.py").exists():
+                    names.add(child.name)
+                _walk(child, depth + 1)
+            elif depth == 0 and child.suffix == ".py" and child.name != "__init__.py":
+                # Bare top-level modules (e.g. `setup.py`-adjacent scripts).
                 names.add(child.stem)
+
+    _walk(root, 0)
     return frozenset(names)
 
 

{proofctl-0.1.7 → proofctl-0.1.9}/proofctl/checkers/terraform.py

@@ -266,21 +266,28 @@ class TerraformChecker(HclFileChecker):
 
     @staticmethod
     def _has_lifecycle_attr(block: HclBlock, attr: str) -> bool:
-        """True if the block contains lifecycle { <attr> = true }."""
+        """True if the block contains lifecycle { <attr> = true }.
+
+        Strips inline comments before counting braces so a comment containing
+        `}` (e.g. ``# closing the lifecycle block }``) doesn't prematurely end
+        the lifecycle scope. The same rule applies for `{`.
+        """
+        from .hcl_utils import _strip_comment
         lc_re = re.compile(r'lifecycle\s*\{')
         attr_re = re.compile(rf'{re.escape(attr)}\s*=\s*true')
         in_lifecycle = False
         depth = 0
         for line in block.raw_lines:
-            if not in_lifecycle and lc_re.search(line):
+            stripped = _strip_comment(line)
+            if not in_lifecycle and lc_re.search(stripped):
                 in_lifecycle = True
                 depth = 1
-                if attr_re.search(line):
+                if attr_re.search(stripped):
                     return True
                 continue
             if in_lifecycle:
-                depth += line.count('{') - line.count('}')
-                if attr_re.search(line):
+                depth += stripped.count('{') - stripped.count('}')
+                if attr_re.search(stripped):
                     return True
                 if depth <= 0:
                     in_lifecycle = False
@@ -699,9 +706,15 @@ class TerraformChecker(HclFileChecker):
                     hint='Pin to a commit SHA or semver tag: source = "git::https://…?ref=v1.2.3"',
                 ))
             else:
-                # Extract the ref value (stop at / & or end)
+                # Extract the ref value (stop at & or end of query string).
+                # URL-decode so percent-encoded chars (`v1%2E0` → `v1.0`,
+                # `release%2Fv1` → `release/v1`) are evaluated as the user
+                # intended; without this, `?ref=v1%2E0` failed both the SHA
+                # and semver patterns and reported as a mutable ref.
+                from urllib.parse import unquote
                 ref_part = src.split("?ref=", 1)[1]
-                ref = re.split(r'[/&?]', ref_part)[0]
+                ref_raw = re.split(r'[&?]', ref_part)[0]
+                ref = unquote(ref_raw)
                 if _GIT_SHA_RE.match(ref) or _SEMVER_TAG_RE.match(ref):
                     continue  # immutable SHA or semver tag — clean
                 out.append(self._f(
@@ -788,24 +801,43 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _g004(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
-        """G-004 — Default service account with cloud-platform scope."""
-        out = []
+        """G-004 — Default service account with cloud-platform scope.
+
+        The real default Compute SA email format is
+        ``<PROJECT_NUMBER>-compute@developer.gserviceaccount.com``. The
+        previous regex looked for ``compute@developer`` which only matched
+        the suffix in isolation; legitimate user-typed default-SA emails
+        like ``123456-compute@developer.gserviceaccount.com`` were missed.
+        Match the canonical suffix instead.
+        """
+        out = []
+        # Canonical default-SA suffix (project-scoped Compute Engine default SA).
+        default_sa_re = re.compile(
+            r'email\s*=\s*"(?:"|[\d]+-compute@developer\.gserviceaccount\.com)',
+        )
+        empty_email_re = re.compile(r'email\s*=\s*""')
+        any_email_re = re.compile(r'email\s*=')
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_compute_instance":
                 continue
-            # Detect: service_account block with empty email + cloud-platform scope
-            if b.contains(r'service_account') and b.contains(r'cloud-platform'):
-                # Check email is empty or uses the default SA pattern
-                if b.contains(r'email\s*=\s*(?:""|compute@developer)') or not b.contains(r'email\s*='):
-                    out.append(self._f(
-                        path, b.any_line_matches(r'cloud-platform') or b.start_line,
-                        "PROOFCTL-TF-G004", "Default SA with cloud-platform scope",
-                        Severity.ERROR,
-                        f'Instance "{b.label2}" uses the default service account with cloud-platform scope',
-                        hint="Create a dedicated SA with only required roles and use granular scopes.",
-                        authority="CIS GCP Benchmark 4.1",
-                        docs_url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform",
-                    ))
+            block_src = "\n".join(b.raw_lines)
+            if not (b.contains(r'service_account') and b.contains(r'cloud-platform')):
+                continue
+            uses_default_sa = (
+                default_sa_re.search(block_src) is not None
+                or empty_email_re.search(block_src) is not None
+                or any_email_re.search(block_src) is None  # implicit default
+            )
+            if uses_default_sa:
+                out.append(self._f(
+                    path, b.any_line_matches(r'cloud-platform') or b.start_line,
+                    "PROOFCTL-TF-G004", "Default SA with cloud-platform scope",
+                    Severity.ERROR,
+                    f'Instance "{b.label2}" uses the default service account with cloud-platform scope',
+                    hint="Create a dedicated SA with only required roles and use granular scopes.",
+                    authority="CIS GCP Benchmark 4.1",
+                    docs_url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform",
+                ))
         return out
 
     def _g005(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
@@ -2018,13 +2050,26 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _ai002(self, path: Path, lines: list[str], blocks: list[HclBlock]) -> list[Finding]:
-        """AI-002 — AWS region format in a GCP-context file."""
+        """AI-002 — AWS region format in a GCP-context file.
+
+        Ignores matches that fall on comment lines (``#`` or ``//``) so legitimate
+        migration notes like ``# was us-east-1, now us-east1`` don't false-positive.
+        """
         source = "\n".join(lines)
         if not _GCP_RESOURCE_RE.search(source):
             return []
         out = []
+        from .hcl_utils import _strip_comment
         for m in _AWS_REGION_RE.finditer(source):
             lineno = source[: m.start()].count("\n") + 1
+            full_line = lines[lineno - 1] if lineno <= len(lines) else ""
+            # Compute the column where the match starts within the line.
+            line_start = source.rfind("\n", 0, m.start()) + 1
+            col = m.start() - line_start
+            # If the match falls inside a comment portion of the line, skip it.
+            non_comment = _strip_comment(full_line)
+            if col >= len(non_comment):
+                continue
             out.append(self._f(
                 path, lineno,
                 "PROOFCTL-TF-AI-002", "AWS region format in GCP context",

{proofctl-0.1.7 → proofctl-0.1.9}/proofctl/cli.py

@@ -8,7 +8,7 @@ import typer
 
 from .config import load_config
 from .engine import run_check
-from .registry import RULES, families_help_string
+from .registry import RULES, families_help_string, is_hidden_family
 
 app = typer.Typer(
     name="proofctl",
@@ -240,7 +240,11 @@ def rules(
     # Sort by (family, rule_id) so related rules cluster.
     specs = sorted(RULES.values(), key=lambda s: (s.family, s.rule_id))
     if fam_filter:
+        # Explicit filter — show even hidden families like INTERNAL for debugging.
         specs = [s for s in specs if s.family == fam_filter]
+    else:
+        # Default listing — hide engine-internal plumbing families.
+        specs = [s for s in specs if not is_hidden_family(s.family)]
 
     if not specs:
         typer.echo(f"No rules found for family '{family}'.", err=True)

{proofctl-0.1.7 → proofctl-0.1.9}/proofctl/registry.py

@@ -43,6 +43,10 @@ FAMILY_LABELS: dict[str, str] = {
     "INTERNAL": "Engine internal",
 }
 
+# Families that exist for plumbing reasons but shouldn't clutter user-facing
+# lists. `proofctl rules --family INTERNAL` still works for debugging.
+_HIDDEN_FAMILIES: frozenset[str] = frozenset({"INTERNAL"})
+
 # Default severities for rules whose Finding(...) construction uses a computed
 # expression rather than a literal Severity.X. Listed as the worst case the rule
 # can fire at, since that is what `proofctl rules` should communicate.
@@ -221,12 +225,24 @@ def _build_registry() -> dict[str, RuleSpec]:
 RULES: dict[str, RuleSpec] = _build_registry()
 
 
-def family_tokens() -> list[str]:
-    """All family tokens that have at least one rule, in alphabetical order."""
-    return sorted({spec.family for spec in RULES.values()})
+def family_tokens(*, include_hidden: bool = False) -> list[str]:
+    """All family tokens that have at least one rule, in alphabetical order.
+
+    Hidden families (currently: INTERNAL) are omitted unless explicitly
+    requested. They still resolve through `RULES[…]` so explicit filtering
+    by `proofctl rules --family INTERNAL` continues to work.
+    """
+    toks = {spec.family for spec in RULES.values()}
+    if not include_hidden:
+        toks -= _HIDDEN_FAMILIES
+    return sorted(toks)
+
+
+def is_hidden_family(token: str) -> bool:
+    return token in _HIDDEN_FAMILIES
 
 
 def families_help_string() -> str:
-    """Human-readable list of families for `--families` help text."""
+    """Human-readable list of user-facing families for `--families` help."""
     parts = [f"{tok} ({FAMILY_LABELS[tok]})" for tok in family_tokens() if tok in FAMILY_LABELS]
     return "Comma-separated rule families: " + ", ".join(parts) + ". Default: all."

{proofctl-0.1.7 → proofctl-0.1.9}/proofctl.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.1.7
+Version: 0.1.9
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.1.7 → proofctl-0.1.9}/proofctl.egg-info/SOURCES.txt

@@ -43,8 +43,10 @@ tests/test_fixer.py
 tests/test_imports.py
 tests/test_leakage.py
 tests/test_llm.py
+tests/test_local_packages.py
 tests/test_phase1_audit_fixes.py
 tests/test_phase2_audit_fixes.py
+tests/test_phase3_audit_fixes.py
 tests/test_placeholders.py
 tests/test_quality.py
 tests/test_quality_ext.py

{proofctl-0.1.7 → proofctl-0.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.1.7"
+version = "0.1.9"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }

proofctl-0.1.9/tests/test_local_packages.py

@@ -0,0 +1,175 @@
+"""Tests for `_local_packages` — deep-tree discovery of importable packages.
+
+The original implementation only walked the project root and `src/`, which
+caused PROOFCTL-I-001 to fire on legitimate private packages nested under
+sub-trees (e.g. Airflow monorepos with `orchestration/dags/<pkg>/__init__.py`).
+
+These tests pin down the new subtree-walking behaviour and the safety rails
+(skip dirs, depth cap, symlink loop protection).
+"""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+import pytest
+
+from proofctl.checkers.imports import _local_packages, _PKG_SCAN_MAX_DEPTH
+
+
+def _mkpkg(root: Path, *parts: str) -> Path:
+    """Create a Python package directory at root/parts/__init__.py."""
+    pkg_dir = root.joinpath(*parts)
+    pkg_dir.mkdir(parents=True, exist_ok=True)
+    (pkg_dir / "__init__.py").write_text("")
+    return pkg_dir
+
+
+def _clear_cache():
+    """The function is lru_cache-wrapped; clear between tests so tmp_path
+    isolation isn't defeated by accidental cache hits across runs."""
+    _local_packages.cache_clear()
+
+
+def test_top_level_package_discovered(tmp_path):
+    _clear_cache()
+    _mkpkg(tmp_path, "myapp")
+    assert "myapp" in _local_packages(tmp_path)
+
+
+def test_src_layout_package_discovered(tmp_path):
+    _clear_cache()
+    _mkpkg(tmp_path, "src", "myapp")
+    assert "myapp" in _local_packages(tmp_path)
+
+
+def test_deeply_nested_package_discovered(tmp_path):
+    """Regression: data_team layout — orchestration/dags/<pkg>/__init__.py."""
+    _clear_cache()
+    _mkpkg(tmp_path, "orchestration", "dags", "airflow_ip_taskgroups")
+    _mkpkg(tmp_path, "orchestration", "dags", "reports_delivery")
+    _mkpkg(tmp_path, "orchestration", "dags", "ip_run_output")
+    pkgs = _local_packages(tmp_path)
+    assert "airflow_ip_taskgroups" in pkgs
+    assert "reports_delivery" in pkgs
+    assert "ip_run_output" in pkgs
+
+
+def test_top_level_module_discovered(tmp_path):
+    _clear_cache()
+    (tmp_path / "myscript.py").write_text("x = 1\n")
+    assert "myscript" in _local_packages(tmp_path)
+
+
+def test_init_only_counts_at_top_level(tmp_path):
+    """A bare .py at depth>0 is a module, not a package — don't add its name.
+    The previous code also followed this rule; preserving it."""
+    _clear_cache()
+    sub = tmp_path / "subdir"
+    sub.mkdir()
+    (sub / "helper.py").write_text("x = 1\n")
+    assert "helper" not in _local_packages(tmp_path)
+
+
+# ── safety rails ──────────────────────────────────────────────────────────────
+
+def test_venv_packages_ignored(tmp_path):
+    """A package vendored under .venv must not be treated as first-party."""
+    _clear_cache()
+    _mkpkg(tmp_path, ".venv", "lib", "python3.11", "site-packages", "requests")
+    assert "requests" not in _local_packages(tmp_path)
+
+
+def test_node_modules_ignored(tmp_path):
+    _clear_cache()
+    _mkpkg(tmp_path, "node_modules", "some_python_pkg")
+    assert "some_python_pkg" not in _local_packages(tmp_path)
+
+
+def test_pycache_ignored(tmp_path):
+    _clear_cache()
+    _mkpkg(tmp_path, "__pycache__", "fakepkg")
+    assert "fakepkg" not in _local_packages(tmp_path)
+
+
+def test_egg_info_ignored(tmp_path):
+    _clear_cache()
+    pkg = tmp_path / "proofctl.egg-info"
+    pkg.mkdir()
+    (pkg / "__init__.py").write_text("")
+    assert "proofctl.egg-info" not in _local_packages(tmp_path)
+
+
+def test_hidden_directories_skipped(tmp_path):
+    """Hidden dirs other than .github are caches/IDE state — skip."""
+    _clear_cache()
+    _mkpkg(tmp_path, ".idea", "fakepkg")
+    _mkpkg(tmp_path, ".vscode", "fakepkg2")
+    pkgs = _local_packages(tmp_path)
+    assert "fakepkg" not in pkgs
+    assert "fakepkg2" not in pkgs
+
+
+def test_symlink_loop_does_not_hang(tmp_path):
+    """A symlink that points back into the tree must not trigger infinite recursion."""
+    _clear_cache()
+    _mkpkg(tmp_path, "real_pkg")
+    # Create a symlink: tmp_path/loop -> tmp_path
+    loop = tmp_path / "loop"
+    try:
+        os.symlink(tmp_path, loop)
+    except (OSError, NotImplementedError):
+        pytest.skip("symlinks not supported on this platform")
+    # Should complete without recursion error.
+    pkgs = _local_packages(tmp_path)
+    assert "real_pkg" in pkgs
+
+
+def test_depth_cap_does_not_explode(tmp_path):
+    """Going deeper than _PKG_SCAN_MAX_DEPTH is silently truncated, not crashed."""
+    _clear_cache()
+    deep = tmp_path
+    for i in range(_PKG_SCAN_MAX_DEPTH + 4):
+        deep = deep / f"d{i}"
+    deep.mkdir(parents=True)
+    (deep / "__init__.py").write_text("")
+    # Doesn't crash. Package at exactly depth N may or may not be found
+    # (since it's beyond the cap), but the call must return.
+    pkgs = _local_packages(tmp_path)
+    assert isinstance(pkgs, frozenset)
+
+
+def test_cache_avoids_repeated_walks(tmp_path):
+    """Calling twice with the same root must hit the lru_cache."""
+    _clear_cache()
+    _mkpkg(tmp_path, "myapp")
+    pkgs1 = _local_packages(tmp_path)
+    pkgs2 = _local_packages(tmp_path)
+    assert pkgs1 is pkgs2  # identity, not just equality — confirms cache hit
+
+
+# ── integration with PROOFCTL-I-001 ───────────────────────────────────────────
+
+def test_i001_no_false_positive_on_nested_local_package(tmp_path):
+    """End-to-end: a file importing a deeply-nested local package must not
+    trigger PROOFCTL-I-001 even with PyPI lookups disabled."""
+    _clear_cache()
+    # Layout mirrors data_team:
+    #   tmp_path/pyproject.toml
+    #   tmp_path/orchestration/dags/airflow_ip_taskgroups/__init__.py
+    #   tmp_path/orchestration/dags/hdm.py   (imports airflow_ip_taskgroups)
+    (tmp_path / "pyproject.toml").write_text("[project]\nname='x'\n")
+    _mkpkg(tmp_path, "orchestration", "dags", "airflow_ip_taskgroups")
+    importer = tmp_path / "orchestration" / "dags" / "hdm.py"
+    importer.write_text("from airflow_ip_taskgroups import build\n")
+
+    from proofctl.engine import run_check
+    from proofctl.config import ProofctlConfig
+
+    cfg = ProofctlConfig()
+    cfg.check_pypi = False  # don't even try PyPI; relying on local discovery
+    findings = run_check(tmp_path, cfg, families=["I"])
+    rule_ids = [f.rule_id for f in findings]
+    assert "PROOFCTL-I-001" not in rule_ids, (
+        f"Expected I-001 NOT to fire on local nested package; got: {rule_ids}"
+    )

proofctl-0.1.9/tests/test_phase3_audit_fixes.py

@@ -0,0 +1,277 @@
+"""Regression tests for AUDIT_AND_ROADMAP Phase 3 (HCL parser hardening).
+
+Covers:
+  C-10: even-backslash check for escaped-quote handling in `_strip_comment`
+  C-11: strict heredoc end-marker matching (no `rstrip("-~")`)
+  C-12: brace counter respects string state and `${}` interpolations
+  C-13: `_t004` port parse handles variable references without crashing
+  HCL HIGH: `_v004` URL-decode, `_g004` canonical default-SA, `_ai002` skips comments
+  HCL MEDIUM: `_has_lifecycle_attr` strips comments
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from proofctl.checkers.hcl_utils import (
+    HclBlock,
+    _brace_delta,
+    _is_escaped,
+    _strip_comment,
+    parse_blocks,
+)
+from proofctl.checkers.terraform import TerraformChecker
+from proofctl.config import ProofctlConfig
+from proofctl.engine import run_check
+
+
+# ── C-10: escaped-quote handling ──────────────────────────────────────────────
+
+def test_c10_is_escaped_recognises_odd_run():
+    # \" — single backslash before quote → escaped
+    assert _is_escaped(r'"\""', 2) is True
+
+
+def test_c10_is_escaped_recognises_even_run():
+    # \\" — escaped backslash followed by an unescaped quote → not escaped
+    line = r'"\\""'  # opens, escaped backslash, closes, opens again
+    # Index 3 is the quote that closes the string after the escaped backslash
+    assert _is_escaped(line, 3) is False
+
+
+def test_c10_strip_comment_does_not_eat_string_with_escaped_backslash():
+    """The previous one-char lookback treated the closing quote in
+    `password = "my\\\\\\"secret#actualpassword"` as escaped, so `#` looked
+    like the start of a comment and tokenisation broke. The fix counts the
+    run of backslashes."""
+    line = 'password = "my\\\\\\"secret#actualpassword"  # real comment'
+    stripped = _strip_comment(line)
+    # The `#` inside the string must NOT be treated as a comment start.
+    assert "secret#actualpassword" in stripped
+    # The trailing real comment IS stripped.
+    assert "real comment" not in stripped
+
+
+def test_c10_strip_comment_simple_escaped_quote_still_works():
+    """Sanity: a single `\\"` inside a string keeps the string open."""
+    line = 'msg = "say \\"hi\\" please"  # comment'
+    stripped = _strip_comment(line)
+    assert "comment" not in stripped
+    assert 'say \\"hi\\"' in stripped
+
+
+# ── C-11: heredoc end-marker matching ─────────────────────────────────────────
+
+def test_c11_heredoc_strict_end_only_label_alone_terminates():
+    """A line `EOF~~~` must NOT terminate a heredoc opened with `<<EOF`.
+    The previous `rstrip("-~")` accepted any line whose stripped suffix
+    matched the label."""
+    src = '''locals {
+  policy = <<EOF
+{
+  "trailing_tilde_in_body": "EOF~~~"
+}
+EOF
+}
+resource "aws_s3_bucket" "after" {
+  bucket = "test"
+}
+'''
+    blocks = parse_blocks(src)
+    # If the heredoc was prematurely closed at `EOF~~~`, the brace counter
+    # would have desynced and we'd lose either the `locals` or the
+    # `aws_s3_bucket` block.
+    kinds = sorted((b.kind, b.label1) for b in blocks)
+    assert ("locals", "") in kinds
+    assert ("resource", "aws_s3_bucket") in kinds
+
+
+def test_c11_indented_heredoc_end_with_leading_whitespace_works():
+    """`<<-EOF` form allows the end label to be indented; we must still close it."""
+    src = '''locals {
+  policy = <<-EOF
+    {"hello": "world"}
+    EOF
+}
+resource "aws_s3_bucket" "after" {
+  bucket = "x"
+}
+'''
+    blocks = parse_blocks(src)
+    kinds = sorted((b.kind, b.label1) for b in blocks)
+    assert ("resource", "aws_s3_bucket") in kinds
+
+
+# ── C-12: brace counter handles ${} interpolations ────────────────────────────
+
+@pytest.mark.parametrize("line,expected", [
+    ('a = "x${count.index}y"', 0),         # interpolation inside string
+    ('tags = { Name = "x${i}" }', 0),       # block with interpolation
+    ('description = "value with } brace"', 0),
+    ('foo = bar', 0),
+    ('resource "x" "y" {', 1),
+    ('}', -1),
+    ('resource "x" "y" { foo = "bar" }', 0),  # single-line block
+])
+def test_c12_brace_delta(line: str, expected: int):
+    assert _brace_delta(line) == expected
+
+
+def test_c12_block_parser_handles_interpolation_in_tags():
+    """A nested map with string interpolations was the audit's worry case."""
+    src = '''resource "aws_instance" "x" {
+  tags = {
+    Name = "ec2-${var.env}-app"
+    Env  = var.env
+  }
+}
+'''
+    blocks = parse_blocks(src)
+    assert len(blocks) == 1
+    assert blocks[0].kind == "resource"
+    assert blocks[0].label2 == "x"
+
+
+# ── C-13: _t004 port parse stays defensive on variable refs ───────────────────
+
+def test_c13_t004_no_crash_on_variable_port(tmp_path):
+    """`from_port = var.ssh_port` must not crash _t004; the rule should
+    silently skip blocks where ports aren't literal."""
+    (tmp_path / "main.tf").write_text(
+        'resource "aws_security_group_rule" "open" {\n'
+        '  type        = "ingress"\n'
+        '  from_port   = var.ssh_port\n'
+        '  to_port     = var.ssh_port\n'
+        '  cidr_blocks = ["0.0.0.0/0"]\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    # No PROOFCTL-INTERNAL-001 (would mean a checker crashed).
+    assert all(f.rule_id != "PROOFCTL-INTERNAL-001" for f in findings), (
+        f"engine crashed: {[(f.rule_id, f.message) for f in findings if f.rule_id == 'PROOFCTL-INTERNAL-001']}"
+    )
+
+
+def test_c13_t004_still_fires_on_literal_sensitive_port(tmp_path):
+    """Sanity: a literal sensitive port + 0.0.0.0/0 still triggers T-004."""
+    (tmp_path / "main.tf").write_text(
+        'resource "aws_security_group_rule" "open" {\n'
+        '  type        = "ingress"\n'
+        '  from_port   = 22\n'
+        '  to_port     = 22\n'
+        '  cidr_blocks = ["0.0.0.0/0"]\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert any(f.rule_id == "PROOFCTL-TF-T004" for f in findings)
+
+
+# ── HCL HIGH: _v004 URL-decode ────────────────────────────────────────────────
+
+def test_v004_percent_encoded_semver_recognised_as_immutable(tmp_path):
+    """`?ref=v1%2E2%2E3` must decode to `v1.2.3` and pass the semver check."""
+    (tmp_path / "main.tf").write_text(
+        'module "x" {\n'
+        '  source = "git::https://github.com/foo/bar.git?ref=v1%2E2%2E3"\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert all(f.rule_id != "PROOFCTL-TF-V004" for f in findings), (
+        f"V-004 should accept percent-encoded semver; got: {[(f.rule_id, f.message) for f in findings]}"
+    )
+
+
+def test_v004_branch_ref_still_flagged(tmp_path):
+    """A branch ref (mutable) is still flagged."""
+    (tmp_path / "main.tf").write_text(
+        'module "x" {\n'
+        '  source = "git::https://github.com/foo/bar.git?ref=main"\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert any(f.rule_id == "PROOFCTL-TF-V004" for f in findings)
+
+
+# ── HCL HIGH: _g004 canonical default-SA suffix ───────────────────────────────
+
+def test_g004_canonical_default_sa_email_recognised(tmp_path):
+    """The fully-qualified default-SA email
+    `<projnum>-compute@developer.gserviceaccount.com` must trigger G-004
+    when paired with cloud-platform scope."""
+    (tmp_path / "main.tf").write_text(
+        'resource "google_compute_instance" "x" {\n'
+        '  service_account {\n'
+        '    email  = "123456-compute@developer.gserviceaccount.com"\n'
+        '    scopes = ["cloud-platform"]\n'
+        '  }\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert any(f.rule_id == "PROOFCTL-TF-G004" for f in findings)
+
+
+def test_g004_dedicated_sa_does_not_trigger(tmp_path):
+    """A non-default SA email must not fire G-004."""
+    (tmp_path / "main.tf").write_text(
+        'resource "google_compute_instance" "x" {\n'
+        '  service_account {\n'
+        '    email  = "my-app-sa@my-project.iam.gserviceaccount.com"\n'
+        '    scopes = ["cloud-platform"]\n'
+        '  }\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert all(f.rule_id != "PROOFCTL-TF-G004" for f in findings)
+
+
+# ── HCL HIGH: _ai002 ignores comment lines ────────────────────────────────────
+
+def test_ai002_ignores_aws_region_in_comment(tmp_path):
+    """A `# was us-east-1` migration note must not trigger AI-002 inside a
+    GCP-context file."""
+    (tmp_path / "main.tf").write_text(
+        '# Migrated from us-east-1 to us-central1 on 2026-01-15\n'
+        'resource "google_compute_instance" "x" {\n'
+        '  zone = "us-central1-a"\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert all(f.rule_id != "PROOFCTL-TF-AI-002" for f in findings), (
+        f"AI-002 should ignore comments; got: {[(f.rule_id, f.message) for f in findings]}"
+    )
+
+
+def test_ai002_still_fires_on_real_aws_region_in_gcp_file(tmp_path):
+    """Sanity: a non-comment AWS region in a GCP file still fires AI-002."""
+    (tmp_path / "main.tf").write_text(
+        'resource "google_compute_instance" "x" {\n'
+        '  zone = "us-east-1"\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert any(f.rule_id == "PROOFCTL-TF-AI-002" for f in findings)
+
+
+# ── HCL MEDIUM: _has_lifecycle_attr strips comments ───────────────────────────
+
+def test_has_lifecycle_attr_ignores_brace_in_comment(tmp_path):
+    """A `}` inside a comment must not be counted as ending the lifecycle block."""
+    (tmp_path / "main.tf").write_text(
+        'resource "aws_s3_bucket" "x" {\n'
+        '  bucket = "stateful"\n'
+        '  lifecycle {\n'
+        '    # the closing brace below is real, this comment has } in it\n'
+        '    prevent_destroy = true\n'
+        '  }\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    # If the lifecycle scope was prematurely ended by the `}` in the comment,
+    # `_has_lifecycle_attr(b, "prevent_destroy")` would have returned False
+    # and a "stateful resource without prevent_destroy" finding would surface.
+    # Confirm we DON'T see that finding.
+    msgs = [f.message for f in findings]
+    assert not any("prevent_destroy" in m and "stateful" in m.lower() for m in msgs), (
+        f"unexpected stateful finding: {msgs}"
+    )