proofctl 0.1.8__tar.gz → 0.1.10__tar.gz

{proofctl-0.1.8 → proofctl-0.1.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.1.8
+Version: 0.1.10
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.1.8 → proofctl-0.1.10}/proofctl/checkers/hcl_utils.py

@@ -77,12 +77,29 @@ def parse_blocks(source: str) -> list[HclBlock]:
     return _parse(source.splitlines(), base=1, skip_outer=False)
 
 
+def _is_escaped(line: str, idx: int) -> bool:
+    """True if `line[idx]` is preceded by an odd run of backslashes.
+
+    Counting the run is the only correct way to tell `\\"` (escaped backslash
+    followed by an unescaped quote) from `\"` (escaped quote). The previous
+    one-character lookback `line[i-1] == '\\\\'` got this wrong: in
+    `password = "my\\\\\\"secret"`, it treated the closing quote as escaped
+    and tokenisation silently broke for every rule that walked block bodies.
+    """
+    n = 0
+    j = idx - 1
+    while j >= 0 and line[j] == "\\":
+        n += 1
+        j -= 1
+    return n % 2 == 1
+
+
 def _strip_comment(line: str) -> str:
     in_str = False
     i = 0
     while i < len(line):
         c = line[i]
-        if c == '"' and (i == 0 or line[i - 1] != '\\'):
+        if c == '"' and not _is_escaped(line, i):
             in_str = not in_str
         if not in_str:
             if c == '#':
@@ -137,7 +154,12 @@ def _parse(lines: list[str], base: int, skip_outer: bool) -> list[HclBlock]:
 
         # ── heredoc passthrough ──
         if heredoc_end:
-            if line.strip() == heredoc_end or line.strip().rstrip("-~") == heredoc_end:
+            # The end label must appear on a line of its own (whitespace either
+            # side allowed for `<<-` indented heredocs). The previous loose
+            # `rstrip("-~")` matched lines like `EOF~~~` as terminators, which
+            # could prematurely close a heredoc whose body legitimately ended
+            # with `~`. C-11 fix: strict whole-line match after .strip().
+            if line.strip() == heredoc_end:
                 heredoc_end = None
             continue
         hm = _HEREDOC_START_RE.search(line)

{proofctl-0.1.8 → proofctl-0.1.10}/proofctl/checkers/imports.py

@@ -70,6 +70,230 @@ def _parse_pyproject_deps(text: str) -> list[tuple[str, str | None, int]]:
                 results.append((name, spec, lineno))
     return results
 
+
+def _parse_pipfile(text: str) -> list[tuple[str, str | None, int]]:
+    """Parse a Pipfile (`[packages]` and `[dev-packages]`) for dep names.
+
+    Falls back to a line-based parser if `tomllib` rejects the file.  Best-effort
+    — line numbers are accurate for the line-based pass; the tomllib pass uses
+    section line numbers as a fallback.
+    """
+    results: list[tuple[str, str | None, int]] = []
+
+    # Line-based scan first (gives real line numbers, very forgiving).
+    section: str | None = None
+    for lineno, line in enumerate(text.splitlines(), start=1):
+        stripped = line.strip()
+        if not stripped or stripped.startswith("#"):
+            continue
+        if stripped.startswith("[") and stripped.endswith("]"):
+            section = stripped[1:-1].strip().lower()
+            continue
+        if section in ("packages", "dev-packages"):
+            # name = "*" / name = ">=1.0"  /  name = { version = "*", ... }
+            m = re.match(
+                r'^([A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?)\s*=\s*(.*)$',
+                stripped,
+            )
+            if not m:
+                continue
+            name = m.group(1)
+            rhs = m.group(3).strip()
+            spec: str | None = None
+            qm = re.match(r'^["\']([^"\']*)["\']', rhs)
+            if qm:
+                spec = qm.group(1).strip() or None
+                if spec == "*":
+                    spec = None
+            else:
+                # Inline table: { version = "1.2.3", ... } — pull version out.
+                vm = re.search(r'version\s*=\s*["\']([^"\']*)["\']', rhs)
+                if vm:
+                    spec = vm.group(1).strip() or None
+            results.append((name, spec, lineno))
+    return results
+
+
+def _parse_poetry_lock(text: str) -> list[tuple[str, str | None, int]]:
+    """Parse poetry.lock — `[[package]]` arrays each with a `name = "..."` field.
+
+    Line-based to preserve line numbers without a TOML parser dependency.
+    """
+    results: list[tuple[str, str | None, int]] = []
+    in_pkg = False
+    pkg_name: str | None = None
+    pkg_version: str | None = None
+    pkg_lineno = 0
+    for lineno, line in enumerate(text.splitlines(), start=1):
+        stripped = line.strip()
+        if stripped == "[[package]]":
+            # Flush previous package (if any) before starting a new one.
+            if pkg_name:
+                results.append((pkg_name, pkg_version, pkg_lineno))
+            in_pkg = True
+            pkg_name = None
+            pkg_version = None
+            pkg_lineno = lineno
+            continue
+        if stripped.startswith("[") and stripped != "[[package]]":
+            # Top-level / metadata sections terminate the current package.
+            if in_pkg and pkg_name:
+                results.append((pkg_name, pkg_version, pkg_lineno))
+            in_pkg = False
+            pkg_name = None
+            pkg_version = None
+            continue
+        if not in_pkg:
+            continue
+        m = re.match(r'^name\s*=\s*["\']([^"\']+)["\']', stripped)
+        if m:
+            pkg_name = m.group(1)
+            pkg_lineno = lineno
+            continue
+        m = re.match(r'^version\s*=\s*["\']([^"\']+)["\']', stripped)
+        if m:
+            pkg_version = "==" + m.group(1)
+    if in_pkg and pkg_name:
+        results.append((pkg_name, pkg_version, pkg_lineno))
+    return results
+
+
+def _parse_uv_lock(text: str) -> list[tuple[str, str | None, int]]:
+    """uv.lock uses the same `[[package]] / name = "..."` shape as poetry.lock."""
+    return _parse_poetry_lock(text)
+
+
+def _parse_environment_yml(text: str) -> list[tuple[str, str | None, int]]:
+    """Parse a conda environment.yml `dependencies:` list.
+
+    Recognises entries like `numpy=1.20`, `numpy==1.20`, `numpy>=1.20`, and
+    nested pip blocks (`- pip:`).  Best-effort, line-based — avoids a hard
+    dependency on PyYAML for this code path even though it's already a project
+    dep, because environment.yml may include conda-only constructs that PyYAML
+    treats as plain strings anyway.
+    """
+    results: list[tuple[str, str | None, int]] = []
+    in_deps = False
+    for lineno, raw in enumerate(text.splitlines(), start=1):
+        stripped = raw.strip()
+        if not stripped or stripped.startswith("#"):
+            continue
+        if re.match(r"^dependencies\s*:\s*$", stripped):
+            in_deps = True
+            continue
+        if in_deps and re.match(r"^[A-Za-z_][A-Za-z0-9_-]*\s*:\s*", stripped) and not raw.lstrip().startswith("-"):
+            # New top-level key — exit dependencies block.
+            in_deps = False
+            continue
+        if not in_deps:
+            continue
+        if not stripped.startswith("-"):
+            continue
+        item = stripped[1:].strip()
+        if not item or item.endswith(":"):
+            # Sub-key like `pip:` — keep walking inside it.
+            continue
+        # Strip surrounding quotes.
+        if (item.startswith('"') and item.endswith('"')) or (
+            item.startswith("'") and item.endswith("'")
+        ):
+            item = item[1:-1]
+        m = re.match(
+            r"^([A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?)\s*([=<>!~][^\s]*)?",
+            item,
+        )
+        if m:
+            name = m.group(1)
+            spec = m.group(3) or None
+            results.append((name, spec, lineno))
+    return results
+
+
+def _parse_setup_py(text: str) -> list[tuple[str, str | None, int]]:
+    """Best-effort: walk an AST looking for `install_requires=[...]` literal lists.
+
+    Skips dynamic constructions; never crashes on malformed input.
+    """
+    results: list[tuple[str, str | None, int]] = []
+    try:
+        tree = ast.parse(text)
+    except SyntaxError:
+        return results
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.keyword):
+            continue
+        if node.arg not in ("install_requires", "tests_require", "extras_require"):
+            continue
+        value = node.value
+        if isinstance(value, ast.List):
+            for elt in value.elts:
+                if isinstance(elt, ast.Constant) and isinstance(elt.value, str):
+                    parsed = _parse_requirements(elt.value)
+                    for name, spec, _ in parsed:
+                        results.append((name, spec, getattr(elt, "lineno", 0)))
+        elif isinstance(value, ast.Dict):
+            # extras_require={"dev": ["pytest", ...]}
+            for v in value.values:
+                if isinstance(v, ast.List):
+                    for elt in v.elts:
+                        if isinstance(elt, ast.Constant) and isinstance(elt.value, str):
+                            parsed = _parse_requirements(elt.value)
+                            for name, spec, _ in parsed:
+                                results.append((name, spec, getattr(elt, "lineno", 0)))
+    return results
+
+
+def _parse_setup_cfg(text: str) -> list[tuple[str, str | None, int]]:
+    """Parse `[options] install_requires` block of a setup.cfg.
+
+    Line-based — preserves line numbers and avoids configparser quirks around
+    multi-line indented values.
+    """
+    results: list[tuple[str, str | None, int]] = []
+    section: str | None = None
+    in_install = False
+    base_indent: int | None = None
+    for lineno, raw in enumerate(text.splitlines(), start=1):
+        stripped = raw.strip()
+        if not stripped or stripped.startswith("#") or stripped.startswith(";"):
+            continue
+        sec = re.match(r"^\[([^\]]+)\]\s*$", stripped)
+        if sec:
+            section = sec.group(1).strip().lower()
+            in_install = False
+            base_indent = None
+            continue
+        if section == "options" and re.match(r"^install_requires\s*=", stripped):
+            in_install = True
+            base_indent = None
+            # Same-line value: `install_requires = pkg1; pkg2`
+            after = stripped.split("=", 1)[1].strip()
+            if after:
+                m = re.match(
+                    r"^([A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?)\s*([~<>=!][^\s;#]*)?",
+                    after,
+                )
+                if m:
+                    results.append((m.group(1), m.group(3) or None, lineno))
+            continue
+        if in_install:
+            indent = len(raw) - len(raw.lstrip())
+            if indent == 0:
+                in_install = False
+                continue
+            if base_indent is None:
+                base_indent = indent
+            if indent < base_indent:
+                in_install = False
+                continue
+            m = re.match(
+                r"^([A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?)\s*([~<>=!][^\s;#]*)?",
+                stripped,
+            )
+            if m:
+                results.append((m.group(1), m.group(3) or None, lineno))
+    return results
+
 # mypy error patterns indicating phantom method calls
 _MYPY_ATTR_RE = re.compile(
     r'^(.+):(\d+):\s+error:\s+(?:Item\s+"[^"]+"\s+of\s+)?"([^"]+)"\s+has\s+no\s+attribute\s+"([^"]+)"'
@@ -412,11 +636,64 @@ class DependencyChecker(DirectoryChecker):
 
     def _find_dep_files(self, root: Path) -> list[Path]:
         files: list[Path] = []
+        # Top-level (cheap, always included).
         files.extend(root.glob("requirements*.txt"))
         files.extend(root.glob("requirements/*.txt"))
-        pyproject = root / "pyproject.toml"
-        if pyproject.exists():
-            files.append(pyproject)
+
+        # Walk the subtree for every supported manifest type. Reuses the same
+        # skip-set as the local-package walker so we don't descend into venvs,
+        # caches, or vendored deps. Cap at the same depth.
+        manifest_names: frozenset[str] = frozenset({
+            "pyproject.toml", "Pipfile", "poetry.lock", "uv.lock",
+            "environment.yml", "environment.yaml",
+            "setup.py", "setup.cfg",
+        })
+        # Names matched as glob patterns within each visited directory.
+        manifest_globs: tuple[str, ...] = ("requirements*.txt",)
+
+        seen: set[Path] = set()
+
+        def _add(p: Path) -> None:
+            try:
+                key = p.resolve()
+            except OSError:
+                return
+            if key in seen:
+                return
+            seen.add(key)
+            files.append(p)
+
+        for f in list(files):
+            _add(f)
+
+        def _walk(path: Path, depth: int) -> None:
+            if depth > _PKG_SCAN_MAX_DEPTH:
+                return
+            try:
+                children = list(path.iterdir())
+            except (OSError, PermissionError):
+                return
+            for child in children:
+                if child.is_symlink():
+                    continue
+                if child.is_dir():
+                    if child.name in _PKG_SCAN_SKIP_DIRS:
+                        continue
+                    if child.name.endswith(".egg-info"):
+                        continue
+                    if child.name.startswith(".") and child.name not in {".github"}:
+                        continue
+                    _walk(child, depth + 1)
+                else:
+                    if child.name in manifest_names:
+                        _add(child)
+                    else:
+                        for pat in manifest_globs:
+                            if child.match(pat):
+                                _add(child)
+                                break
+
+        _walk(root, 0)
         return files
 
     def _check_dep_file(self, path: Path) -> list[Finding]:
@@ -425,10 +702,30 @@ class DependencyChecker(DirectoryChecker):
         except OSError:
             return []
 
-        if path.suffix == ".toml":
-            deps = _parse_pyproject_deps(text)
-        else:
-            deps = _parse_requirements(text)
+        name = path.name
+        try:
+            if name == "pyproject.toml":
+                deps = _parse_pyproject_deps(text)
+            elif name == "Pipfile":
+                deps = _parse_pipfile(text)
+            elif name == "poetry.lock":
+                deps = _parse_poetry_lock(text)
+            elif name == "uv.lock":
+                deps = _parse_uv_lock(text)
+            elif name in ("environment.yml", "environment.yaml"):
+                deps = _parse_environment_yml(text)
+            elif name == "setup.py":
+                deps = _parse_setup_py(text)
+            elif name == "setup.cfg":
+                deps = _parse_setup_cfg(text)
+            elif path.suffix == ".toml":
+                # Other TOML manifests at non-standard names — try project deps.
+                deps = _parse_pyproject_deps(text)
+            else:
+                deps = _parse_requirements(text)
+        except Exception:
+            # Best-effort: never crash on a malformed manifest.
+            return []
 
         findings = []
         for name, spec, lineno in deps:
@@ -474,9 +771,33 @@ class MethodChecker(DirectoryChecker):
     """
 
     def check(self, root: Path, py_files: list[Path]) -> list[Finding]:
-        if not shutil.which("mypy") or not py_files:
+        if not py_files:
             return []
-        return self._run_mypy(py_files)
+        if not shutil.which("mypy"):
+            # Surface the disabled state as a single INFO finding so CI users
+            # don't silently lose phantom-method coverage.
+            return [self._mypy_missing_finding(root)]
+        try:
+            return self._run_mypy(py_files)
+        except FileNotFoundError:
+            return [self._mypy_missing_finding(root)]
+
+    def _mypy_missing_finding(self, root: Path) -> Finding:
+        return Finding(
+            file=str(root),
+            line=None,
+            col=None,
+            rule_id="PROOFCTL-M-001",
+            rule_name="Phantom method check disabled",
+            severity=Severity.INFO,
+            message=(
+                "M-001 disabled — mypy not installed; install proofctl[dev] or "
+                "pip install mypy to enable phantom-method detection"
+            ),
+            hint="pip install mypy   # or: pip install proofctl[dev]",
+            authority="mypy attr-defined — AI calls methods that don't exist",
+            docs_url="https://mypy.readthedocs.io/en/stable/error_codes.html",
+        )
 
     def _run_mypy(self, py_files: list[Path]) -> list[Finding]:
         try:
@@ -492,7 +813,11 @@ class MethodChecker(DirectoryChecker):
                 text=True,
                 timeout=300,
             )
-        except (subprocess.TimeoutExpired, OSError):
+        except subprocess.TimeoutExpired:
+            return []
+        except FileNotFoundError:
+            raise
+        except OSError:
             return []
 
         # Index scoped files for quick membership check after path normalisation.

{proofctl-0.1.8 → proofctl-0.1.10}/proofctl/checkers/leakage.py

@@ -41,11 +41,18 @@ _PRE_PARSE_PATTERNS: list[tuple[str, re.Pattern, str, str, str]] = [
     ),
 ]
 
-# AST-based: method/attribute names that indicate wrong-language idiom
+# AST-based: method/attribute names that indicate wrong-language idiom.
+# `.push()` and `.length` are noisy in Python codebases — many real Python
+# objects (queues, ORM cursors, PyMongo, Redis pipelines) expose them
+# legitimately. They are downgraded to INFO by default and can be promoted
+# back to ERROR via `LeakageChecker(l001_strict_idioms=True)`.
 _JS_ATTR_NAMES = {
     "push": ("Use list.append(x) instead of .push(x).", "PROOFCTL-L-001"),
     "length": ("Use len(x) instead of .length.", "PROOFCTL-L-001"),
 }
+# Sub-set of _JS_ATTR_NAMES whose severity is governed by the
+# `l001_strict_idioms` toggle (see H-20).
+_JS_FUZZY_ATTRS: frozenset[str] = frozenset({"push", "length"})
 _JS_CALL_NAMES = {
     "console": {"log", "warn", "error", "info", "debug"},
 }
@@ -63,18 +70,27 @@ _GO_FMT_CALLS = {"Println", "Printf", "Fprintf", "Sprintf", "Errorf", "Print"}
 
 
 class _LeakageVisitor(ast.NodeVisitor):
-    def __init__(self, path: Path):
+    def __init__(self, path: Path, strict_idioms: bool = False):
         self.path = path
+        self._strict_idioms = strict_idioms
         self.findings: list[Finding] = []
 
-    def _find(self, node: ast.AST, rule_id: str, rule_name: str, msg: str, hint: str) -> None:
+    def _find(
+        self,
+        node: ast.AST,
+        rule_id: str,
+        rule_name: str,
+        msg: str,
+        hint: str,
+        severity: Severity = Severity.ERROR,
+    ) -> None:
         self.findings.append(Finding(
             file=str(self.path),
             line=getattr(node, "lineno", None),
             col=getattr(node, "col_offset", None),
             rule_id=rule_id,
             rule_name=rule_name,
-            severity=Severity.ERROR,
+            severity=severity,
             message=msg,
             hint=hint,
             authority="Cross-language leakage — AI conflated Python with another language",
@@ -101,10 +117,20 @@ class _LeakageVisitor(ast.NodeVisitor):
         # JS: .push(), .length
         if attr in _JS_ATTR_NAMES:
             hint, rule_id = _JS_ATTR_NAMES[attr]
+            # H-20: `.push()` / `.length` produced too many false positives
+            # against Python objects that legitimately expose those names
+            # (queues, ORM cursors, PyMongo). Demote to INFO unless the
+            # caller explicitly opts into strict cross-language idiom
+            # checking via `l001_strict_idioms`.
+            if attr in _JS_FUZZY_ATTRS and not self._strict_idioms:
+                sev = Severity.INFO
+            else:
+                sev = Severity.ERROR
             self._find(
                 node, rule_id, f"JS attribute '.{attr}' in Python",
                 f"'.{attr}' is a JavaScript idiom.",
                 hint,
+                severity=sev,
             )
 
         # JS: console.log / console.warn etc.
@@ -150,16 +176,32 @@ class _LeakageVisitor(ast.NodeVisitor):
         self.generic_visit(node)
 
     def visit_ClassDef(self, node: ast.ClassDef) -> None:
-        """PROOFCTL-L-002d: Java-style getter/setter pairs."""
+        """PROOFCTL-L-002d: Java-style getter/setter pairs.
+
+        H-21: Only flag when getX AND setX both exist for the same suffix X.
+        Two unrelated methods like `getInfo` + `setColor` are not a Java
+        pattern; only matched pairs (`getFoo` + `setFoo`) are.
+        """
         method_names = {
             n.name for n in ast.walk(node)
             if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef))
         }
+
+        def _suffix(name: str, prefix: str) -> str | None:
+            if name.startswith(prefix) and len(name) > 3 and name[3].isupper():
+                return name[3:]
+            return None
+
+        get_suffixes = {s for n in method_names if (s := _suffix(n, "get"))}
+        set_suffixes = {s for n in method_names if (s := _suffix(n, "set"))}
+        matched_suffixes = get_suffixes & set_suffixes
+
+        # Only flag method names that participate in a matched pair.
         java_getter_setters = {
-            name for name in method_names
-            if (name.startswith("get") or name.startswith("set"))
-            and len(name) > 3
-            and name[3].isupper()
+            f"{prefix}{suffix}"
+            for suffix in matched_suffixes
+            for prefix in ("get", "set")
+            if f"{prefix}{suffix}" in method_names
         }
         # Flag the class once if it has 2+ getter/setter pairs with no @property
         has_property = any(
@@ -190,6 +232,12 @@ class _LeakageVisitor(ast.NodeVisitor):
 
 
 class LeakageChecker(FileChecker):
+    def __init__(self, l001_strict_idioms: bool = False) -> None:
+        # H-20: When True, `.push()` / `.length` are reported as ERROR.
+        # Default False keeps them at INFO to avoid noise on Python objects
+        # that legitimately expose those names (queues, ORMs, etc.).
+        self._l001_strict_idioms = l001_strict_idioms
+
     def check(self, path: Path, source: str, tree: ast.Module | None) -> list[Finding]:
         findings: list[Finding] = []
         if tree is None:
@@ -203,7 +251,7 @@ class LeakageChecker(FileChecker):
             # they MUST be inside a string literal, not live code.  Skip to avoid
             # false positives on files that embed other languages as strings
             # (e.g. HTML reporters, template generators).
-            v = _LeakageVisitor(path)
+            v = _LeakageVisitor(path, strict_idioms=self._l001_strict_idioms)
             v.visit(tree)
             findings.extend(v.findings)
         return findings