proofctl 0.5.6__tar.gz → 0.5.7__tar.gz

{proofctl-0.5.6/proofctl.egg-info → proofctl-0.5.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.6
+Version: 0.5.7
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **268 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -172,7 +172,7 @@ git commit -m "chore: add proofctl baseline"
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Python — Other | 11 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
 | Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
 | Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |

{proofctl-0.5.6 → proofctl-0.5.7}/README.md

@@ -1,6 +1,6 @@
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **268 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -144,7 +144,7 @@ git commit -m "chore: add proofctl baseline"
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Python — Other | 11 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
 | Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
 | Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |

{proofctl-0.5.6 → proofctl-0.5.7}/proofctl/checkers/imports.py

@@ -294,13 +294,6 @@ def _parse_setup_cfg(text: str) -> list[tuple[str, str | None, int]]:
                 results.append((m.group(1), m.group(3) or None, lineno))
     return results
 
-# mypy error patterns indicating phantom method calls
-_MYPY_ATTR_RE = re.compile(
-    r'^(.+):(\d+):\s+error:\s+(?:Item\s+"[^"]+"\s+of\s+)?"([^"]+)"\s+has\s+no\s+attribute\s+"([^"]+)"'
-    r'|^(.+):(\d+):\s+error:\s+Module\s+"[^"]+"\s+has\s+no\s+attribute\s+"([^"]+)"'
-)
-
-
 def _normalize_pkg_name(name: str) -> str:
     return re.sub(r"[-_.]+", "-", name).lower()
 
@@ -817,104 +810,3 @@ class DependencyChecker(DirectoryChecker):
         return findings
 
 
-class MethodChecker(DirectoryChecker):
-    """PROOFCTL-M-001: Phantom method calls detected by a single mypy invocation.
-
-    Running mypy once on all files is orders of magnitude faster than once per
-    file: mypy's startup and import-resolution cost is paid once, not N times.
-    """
-
-    def check(self, root: Path, py_files: list[Path]) -> list[Finding]:
-        if not py_files:
-            return []
-        if not shutil.which("mypy"):
-            # Surface the disabled state as a single INFO finding so CI users
-            # don't silently lose phantom-method coverage.
-            return [self._mypy_missing_finding(root)]
-        try:
-            return self._run_mypy(py_files)
-        except FileNotFoundError:
-            return [self._mypy_missing_finding(root)]
-
-    def _mypy_missing_finding(self, root: Path) -> Finding:
-        return Finding(
-            file=str(root),
-            line=None,
-            col=None,
-            rule_id="PROOFCTL-M-001",
-            rule_name="Phantom method check disabled",
-            severity=Severity.INFO,
-            message=(
-                "M-001 disabled — mypy not installed; install proofctl[dev] or "
-                "pip install mypy to enable phantom-method detection"
-            ),
-            hint="pip install mypy   # or: pip install proofctl[dev]",
-            authority="mypy attr-defined — AI calls methods that don't exist",
-            docs_url="https://mypy.readthedocs.io/en/stable/error_codes.html",
-        )
-
-    def _run_mypy(self, py_files: list[Path]) -> list[Finding]:
-        try:
-            result = subprocess.run(
-                [
-                    "mypy",
-                    "--ignore-missing-imports",
-                    "--no-error-summary",
-                    "--no-pretty",
-                    *[str(p) for p in py_files],
-                ],
-                capture_output=True,
-                text=True,
-                timeout=300,
-            )
-        except subprocess.TimeoutExpired:
-            return []
-        except FileNotFoundError:
-            raise
-        except OSError:
-            return []
-
-        # Index scoped files for quick membership check after path normalisation.
-        scoped = {str(p.resolve()) for p in py_files}
-
-        findings = []
-        for line in result.stdout.splitlines():
-            m = _MYPY_ATTR_RE.match(line)
-            if not m:
-                continue
-
-            if m.group(1):
-                file_path, lineno_str = m.group(1), m.group(2)
-                obj_type, attr = m.group(3), m.group(4)
-                msg = f"'{obj_type}' has no attribute '{attr}'"
-            else:
-                file_path, lineno_str = m.group(5), m.group(6)
-                attr = m.group(7)
-                msg = f"Module has no attribute '{attr}'"
-
-            # Skip findings for files outside the scan scope (e.g. installed libs).
-            try:
-                if str(Path(file_path).resolve()) not in scoped:
-                    continue
-            except OSError:
-                continue
-
-            try:
-                lineno = int(lineno_str)
-            except ValueError:
-                lineno = None
-
-            findings.append(Finding(
-                file=file_path,
-                line=lineno,
-                col=None,
-                rule_id="PROOFCTL-M-001",
-                rule_name="Phantom method call",
-                severity=Severity.ERROR,
-                message=msg,
-                hint="Check the library's documentation for the correct method name.",
-                authority="mypy attr-defined — AI calls methods that don't exist",
-                docs_url="https://mypy.readthedocs.io/en/stable/error_codes.html",
-            ))
-
-        return findings

{proofctl-0.5.6 → proofctl-0.5.7}/proofctl/engine.py

@@ -28,7 +28,7 @@ from .models import Finding, Severity
 from .checkers.placeholders import PlaceholderChecker
 from .checkers.leakage import LeakageChecker
 from .checkers.quality import QualityChecker, AbstractionChecker
-from .checkers.imports import ImportChecker, MethodChecker, DependencyChecker
+from .checkers.imports import ImportChecker, DependencyChecker
 from .checkers.variants import VariantChecker
 from .checkers.security import SecurityChecker
 from .checkers.llm_integration import LLMChecker
@@ -151,8 +151,6 @@ def _build_dir_checkers(config: ProofctlConfig, families: set[str] | None) -> li
         checkers.append(DependencyChecker(
             extra_high_risk=config.i002_extra_high_risk,
         ))
-    if _include("M"):
-        checkers.append(MethodChecker())
 
     return checkers
 

{proofctl-0.5.6 → proofctl-0.5.7}/proofctl/registry.py

@@ -31,7 +31,6 @@ FAMILY_LABELS: dict[str, str] = {
     "L":        "Cross-language leakage",
     "Q":        "Code quality",
     "I":        "Imports",
-    "M":        "Phantom methods (mypy)",
     "V":        "Variant files / near-duplicates",
     "S":        "Security (Python)",
     "LLM":      "LLM integration",

{proofctl-0.5.6 → proofctl-0.5.7/proofctl.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.6
+Version: 0.5.7
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **268 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -172,7 +172,7 @@ git commit -m "chore: add proofctl baseline"
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Python — Other | 11 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
 | Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
 | Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |

{proofctl-0.5.6 → proofctl-0.5.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.5.6"
+version = "0.5.7"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }