slopgate-cli 0.1.0__tar.gz → 0.1.1__tar.gz

slopgate_cli-0.1.1/CHANGELOG.md

@@ -0,0 +1,80 @@
+# Changelog
+
+All notable changes to this project are documented here.
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.1] - 2026-10-28
+
+Correctness release: two tamper classes that v0.1.0 reported as warnings now block.
+
+### Fixed
+
+- **Deleting a whole test file now blocks** (`SG-TEST_FILE_DELETED`) instead of
+  only emitting the missing-repro warning.
+- **`assert True` / `x is not None` weakening now blocks.** `ASSERT_WEAKENED` is
+  part of the blocked set, so the default `fail-on: blocked` catches it.
+- Local package detection walks the repo to depth 3 and no longer needs
+  `__init__.py`, so PEP 420 namespace packages, `src/` and `python/` layouts stop
+  reading as hallucinated imports. Virtualenv, `node_modules`, and build
+  directories are skipped.
+- Dependency manifests are read from subproject directories too (monorepos).
+- `setup.py` `extras_require` entries count as dependencies, not just
+  `install_requires`.
+- Import/distribution aliases for `rest_framework`, `django_filters`, `github`,
+  `MySQLdb`, `python-jose`, `grpcio`, and friends.
+- Django-style test files (`myapp/tests.py`, `conftest.py`, `*_spec.py`, `spec/`)
+  are treated as tests, so tampering there is detected.
+- `from conftest import ...` and sibling helper modules resolve as local modules.
+- A saved diff in UTF-16 (PowerShell `git diff > pr.diff`) is decoded instead of
+  parsing to zero files and reporting a pass.
+- An unparseable or unreadable diff exits 2 instead of being reported as clean.
+- Missing `--diff` file prints one line and exits 2 instead of a traceback.
+- Imports under `if TYPE_CHECKING:` are not treated as runtime dependencies.
+- A UTF-8 BOM no longer hides findings on line 1.
+- `@pytest.mark.xfail`, `unittest.expectedFailure`, and `pytest.importorskip` are
+  detected as skips; the line fallback now always runs alongside the AST pass.
+- Shallow checkouts suggest `fetch-depth: 0` instead of only "no diff detected".
+
+### Changed
+
+- Assert deletions are counted per file rather than per hunk, so splitting a test
+  or moving assertions between hunks is not a false block; a net loss still is.
+- `slopgate install` pins `@v0` (patch/minor updates) instead of the exact tag.
+- The dogfood workflow no longer requests unused `pull-requests: write`.
+- The Release job waits for the PyPI publish job, so a failed upload no longer
+  produces a GitHub Release.
+- Added the Python 3.14 classifier.
+
+## [0.1.0] - 2026-10-28
+
+First public release. Python 3.10+, zero runtime dependencies.
+
+### Added
+
+- `slopgate check` — audits a unified git diff from a file, stdin, or the current
+  PR (`GITHUB_BASE_REF`), with `terminal`, `json`, and `github` output formats and
+  `--fail-on blocked|warning|never`.
+- Test tamper detection: deleted assertions (per hunk), tautology/weakening swaps,
+  `try: ... except: pass` suppression, and newly added `pytest` skips — parsed
+  with `ast`, so `skipif` and comments do not trip it.
+- Phantom symbol detection: imports missing from the stdlib, declared dependencies
+  (`pyproject.toml`, `requirements*.txt` incl. `-r` includes, `setup.py`,
+  `setup.cfg`, `Pipfile`, `environment.yml`, Poetry) and local modules; plus a
+  table of hallucinated stdlib methods.
+- Reproduction gate: flags production changes that ship without a test change,
+  and only counts the reproduction as verified when the test change is untampered.
+- Slop ratio: docstring/comment bloat versus executable statements added.
+- `slopgate demo` — offline interactive simulation of three real PR scenarios.
+- `slopgate install` — writes a pinned `.github/workflows/slopgate.yml` into a repo.
+- `slopgate badge` — Markdown and HTML README badges.
+- Composite GitHub Action with Step Summary output and `::error` annotations.
+- GitHub Actions workflows: CI matrix (Python 3.10–3.13 on Linux/macOS/Windows),
+  package-integrity job (build + `twine check` + wheel smoke test), and a release
+  pipeline (build → PyPI via Trusted Publishing or `PYPI_API_TOKEN` → GitHub
+  Release) with SHA-pinned actions.
+
+[Unreleased]: https://github.com/Shinraya-Tech-Labs/slopgate/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/Shinraya-Tech-Labs/slopgate/releases/tag/v0.1.0

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: slopgate-cli
-Version: 0.1.0
+Version: 0.1.1
 Summary: AST-based code integrity, test tamper detection, and phantom symbol interception for GitHub Pull Requests.
 Author-email: Shinraya Tech Labs <labs@shinraya.com>
 License-Expression: Apache-2.0
@@ -18,6 +18,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
@@ -196,7 +197,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run SlopGate Shield
-        uses: Shinraya-Tech-Labs/slopgate@v0.1.0
+        uses: Shinraya-Tech-Labs/slopgate@v0
         with:
           fail-on: blocked   # 'blocked' (fails on tamper/hallucinations) or 'warning'
 ```

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/README.md

@@ -168,7 +168,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run SlopGate Shield
-        uses: Shinraya-Tech-Labs/slopgate@v0.1.0
+        uses: Shinraya-Tech-Labs/slopgate@v0
         with:
           fail-on: blocked   # 'blocked' (fails on tamper/hallucinations) or 'warning'
 ```

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "slopgate-cli"
-version = "0.1.0"
+version = "0.1.1"
 description = "AST-based code integrity, test tamper detection, and phantom symbol interception for GitHub Pull Requests."
 readme = "README.md"
 keywords = [
@@ -30,6 +30,7 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
 ]
 requires-python = ">=3.10"
 dependencies = []

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/slopgate/__init__.py

@@ -3,7 +3,7 @@ SlopGate: AST-based Code Integrity & PR Integrity Shield for Open Source Maintai
 Zero-dependency, deterministic detection of test tampering, phantom symbols, and slop bloat.
 """
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"
 __author__ = "Shinraya Tech Labs"
 
 from slopgate.engine import AuditEngine, AuditReport, Severity, Violation

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/slopgate/ast_tamper.py

@@ -10,7 +10,7 @@ from dataclasses import dataclass
 from enum import Enum
 from typing import List, Optional, Tuple
 
-from slopgate.diff_parser import FileDiff, Hunk
+from slopgate.diff_parser import FileDiff
 from slopgate.fragment import Fragment
 
 
@@ -32,9 +32,17 @@ class TamperIncident:
 
 # Exact attribute chains that neuter a test. Substring matching is not enough:
 # '@pytest.mark.skipif' starts with '@pytest.mark.skip' but is legitimate.
-SKIP_SYMBOLS = {"pytest.skip", "pytest.mark.skip", "unittest.skip"}
+SKIP_SYMBOLS = {
+    "pytest.skip",
+    "pytest.mark.skip",
+    "pytest.mark.xfail",
+    "pytest.importorskip",
+    "unittest.skip",
+    "unittest.expectedFailure",
+}
 SKIP_FALLBACK_RE = re.compile(
-    r"^\s*@?(?:pytest\.mark\.skip|unittest\.skip|pytest\.skip)\b"
+    r"^\s*@?(?:pytest\.mark\.(?:skip|xfail)|unittest\.(?:skip|expectedFailure)"
+    r"|pytest\.(?:skip|importorskip))\b"
 )
 
 
@@ -88,33 +96,29 @@ class AstTamperAnalyzer:
     def _check_assert_deletions(
         cls, file_diff: FileDiff, incidents: List[TamperIncident]
     ):
-        """A hunk that drops assertions without replacing them is a tamper signal.
+        """Net assertion loss across the file is a tamper signal.
 
-        Comparing per hunk (not per file) stops an unrelated new assertion in a
-        different test from masking a deletion.
+        Counted per file (not per hunk) so splitting a test or converting it to
+        parametrize does not look like a deletion; a net drop still counts.
         """
         if file_diff.is_deleted:
             return
+        removed_asserts: List[Tuple[int, str]] = []
+        added_count = 0
         for hunk in file_diff.hunks:
-            cls._check_hunk_assertions(file_diff, hunk, incidents)
+            removed_asserts.extend(cls._assert_lines(hunk.removed))
+            added_count += len(cls._assert_lines(hunk.added))
 
-    @classmethod
-    def _check_hunk_assertions(
-        cls, file_diff: FileDiff, hunk: Hunk, incidents: List[TamperIncident]
-    ):
-        removed_asserts = cls._assert_lines(hunk.removed)
-        added_asserts = cls._assert_lines(hunk.added)
-
-        net_loss = len(removed_asserts) - len(added_asserts)
+        net_loss = len(removed_asserts) - added_count
         if net_loss <= 0:
             return
-        for ln, line in removed_asserts[:net_loss]:
+        for ln, line in removed_asserts[-net_loss:]:
             incidents.append(
                 TamperIncident(
                     kind=TamperKind.ASSERT_DELETED,
                     file_path=file_diff.target_path,
                     line_number=ln,
-                    message=f"Removed {net_loss} assertion(s) in this hunk without equivalent replacement.",
+                    message=f"Removed {net_loss} assertion(s) without equivalent replacement.",
                     snippet=line.strip(),
                 )
             )
@@ -237,31 +241,22 @@ class AstTamperAnalyzer:
                         fragment.real_line(getattr(node, "lineno", 1), offset)
                     )
 
-        if found_lines:
-            for ln in sorted(found_lines):
-                incidents.append(
-                    TamperIncident(
-                        kind=TamperKind.TEST_SKIPPED,
-                        file_path=file_diff.target_path,
-                        line_number=ln,
-                        message="Test explicitly skipped with pytest.skip / @mark.skip in PR.",
-                        snippet="skip",
-                    )
-                )
-            return
-
-        # Fallback for fragments the parser cannot handle (e.g. mixed indentation)
+        # Always scan lines too: the AST path sees one node per decorator chain,
+        # the regex catches what a partially parseable fragment hides.
         for idx, (ln, line) in enumerate(file_diff.added_lines, start=1):
-            if idx in covered:
+            if idx in covered or ln in found_lines:
                 continue
             stripped = line.strip()
             if SKIP_FALLBACK_RE.match(stripped):
-                incidents.append(
-                    TamperIncident(
-                        kind=TamperKind.TEST_SKIPPED,
-                        file_path=file_diff.target_path,
-                        line_number=ln,
-                        message="Test explicitly skipped with pytest.skip / @mark.skip in PR.",
-                        snippet=stripped,
-                    )
+                found_lines.add(ln)
+
+        for ln in sorted(found_lines):
+            incidents.append(
+                TamperIncident(
+                    kind=TamperKind.TEST_SKIPPED,
+                    file_path=file_diff.target_path,
+                    line_number=ln,
+                    message="Test explicitly skipped with skip/xfail/expectedFailure in PR.",
+                    snippet="skip",
                 )
+            )

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/slopgate/cli.py

@@ -9,23 +9,22 @@ import subprocess
 import sys
 from pathlib import Path
 
-# Ensure UTF-8 output on Windows consoles
-if sys.stdout and hasattr(sys.stdout, "reconfigure"):
-    try:
-        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
-    except Exception:
-        pass
-if sys.stderr and hasattr(sys.stderr, "reconfigure"):
-    try:
-        sys.stderr.reconfigure(encoding="utf-8", errors="replace")
-    except Exception:
-        pass
-
 from slopgate import __version__
 from slopgate.engine import AuditEngine, Severity
 from slopgate.reporter import AnsiColor, Reporter
 
-GITHUB_WORKFLOW_TEMPLATE = f"""name: SlopGate PR Integrity Check
+
+def _configure_stdio() -> None:
+    """Ensure UTF-8 output on Windows consoles (only when running as a CLI)."""
+    for stream in (sys.stdout, sys.stderr):
+        if stream and hasattr(stream, "reconfigure"):
+            try:
+                stream.reconfigure(encoding="utf-8", errors="replace")
+            except Exception:
+                pass
+
+
+GITHUB_WORKFLOW_TEMPLATE = """name: SlopGate PR Integrity Check
 
 on:
   pull_request:
@@ -45,7 +44,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run SlopGate Integrity Check
-        uses: Shinraya-Tech-Labs/slopgate@v{__version__}
+        uses: Shinraya-Tech-Labs/slopgate@v0
         with:
           fail-on: blocked
 """
@@ -131,9 +130,11 @@ def get_git_diff() -> str:
             ["git", "diff", "main...HEAD"],
             ["git", "diff", "origin/master...HEAD"],
             ["git", "diff", "master...HEAD"],
-            ["git", "diff", "HEAD~1"],
+            # Local runs audit the work in progress first: HEAD~1 last, so a
+            # plain `slopgate check` never reports an already-merged commit.
             ["git", "diff", "--cached"],
             ["git", "diff"],
+            ["git", "diff", "HEAD~1"],
         ]
     )
     for cmd in cmds:
@@ -146,25 +147,64 @@ def get_git_diff() -> str:
     return ""
 
 
+def _decode_diff_bytes(data: bytes) -> str:
+    """Decodes a saved diff, honouring the UTF-16 that PowerShell redirection adds."""
+    if data.startswith((b"\xff\xfe", b"\xfe\xff")):
+        return data.decode("utf-16", errors="replace")
+    return data.decode("utf-8-sig", errors="replace")
+
+
+def _is_shallow_checkout() -> bool:
+    try:
+        res = subprocess.run(
+            ["git", "rev-parse", "--is-shallow-repository"],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        return res.stdout.strip() == "true"
+    except Exception:
+        return False
+
+
 def cmd_check(args: argparse.Namespace) -> int:
     """Audits diff text."""
-    if args.diff_file == "-":
-        diff_text = sys.stdin.read()
-    elif args.diff_file:
-        diff_text = Path(args.diff_file).read_text(encoding="utf-8", errors="ignore")
-    else:
-        diff_text = get_git_diff()
-        if not diff_text:
-            print(
-                "⚠️ No git diff detected. Provide a diff via --diff <file> or piped via stdin.",
-                file=sys.stderr,
-            )
-            # Failing open in CI would report success on a broken checkout
-            return 1 if os.environ.get("GITHUB_ACTIONS") == "true" else 0
+    try:
+        if args.diff_file == "-":
+            diff_text = _decode_diff_bytes(sys.stdin.buffer.read())
+        elif args.diff_file:
+            diff_text = _decode_diff_bytes(Path(args.diff_file).read_bytes())
+        else:
+            diff_text = get_git_diff()
+            if not diff_text:
+                hint = (
+                    " The checkout looks shallow; use actions/checkout with fetch-depth: 0."
+                    if _is_shallow_checkout()
+                    else ""
+                )
+                print(
+                    "⚠️ No git diff detected. Provide a diff via --diff <file> or piped via stdin."
+                    + hint,
+                    file=sys.stderr,
+                )
+                # Failing open in CI would report success on a broken checkout
+                return 1 if os.environ.get("GITHUB_ACTIONS") == "true" else 0
+    except OSError as exc:
+        print(f"⛔ Cannot read diff: {exc}", file=sys.stderr)
+        return 2
 
     engine = AuditEngine()
     report = engine.audit_diff(diff_text)
 
+    if diff_text.strip() and report.metrics.files_changed == 0:
+        # An unparsed diff must never look like a clean audit
+        print(
+            "⛔ No file changes could be parsed from the diff. "
+            "Is it a git unified diff (git diff --no-color)?",
+            file=sys.stderr,
+        )
+        return 2
+
     # Output formatting
     if args.format == "json":
         print(Reporter.render_json(report))
@@ -234,8 +274,10 @@ def cmd_demo(args: argparse.Namespace) -> int:
     rep3 = engine.audit_diff(SAMPLE_CLEAN_DIFF)
     print(Reporter.render_terminal(rep3))
 
+    intercepted = sum(1 for rep in (rep1, rep2) if rep.status == Severity.BLOCKED)
+    approved = sum(1 for rep in (rep1, rep2, rep3) if rep.status == Severity.INFO)
     print(
-        f"{AnsiColor.GREEN}{AnsiColor.BOLD}✓ Simulator completed: 2 rogue AI PRs intercepted, 1 clean bugfix approved.{AnsiColor.RESET}\n"
+        f"{AnsiColor.GREEN}{AnsiColor.BOLD}✓ Simulator completed: {intercepted} rogue AI PR(s) intercepted, {approved} clean bugfix approved.{AnsiColor.RESET}\n"
     )
     return 0
 
@@ -266,6 +308,7 @@ def cmd_badge(args: argparse.Namespace) -> int:
 
 
 def main():
+    _configure_stdio()
     parser = argparse.ArgumentParser(
         prog="slopgate",
         description="🛡️ SlopGate: AST-Based Code Integrity & PR Integrity Shield",

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/slopgate/diff_parser.py

@@ -38,11 +38,14 @@ class FileDiff:
     @property
     def is_test_file(self) -> bool:
         path = self.target_path.lower()
+        name = Path(path).name
         parts = Path(path).parts
         return (
-            any(p in ("tests", "test", "__tests__") for p in parts)
-            or Path(path).name.startswith("test_")
-            or Path(path).name.endswith("_test.py")
+            any(p in ("tests", "test", "__tests__", "spec", "specs") for p in parts)
+            # Django/Flask style: myapp/tests.py, conftest.py, *_spec.py
+            or name in ("tests.py", "test.py", "conftest.py")
+            or name.startswith(("test_", "spec_"))
+            or name.endswith(("_test.py", "_tests.py", "_spec.py"))
         )
 
     @property

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/slopgate/engine.py

@@ -116,8 +116,21 @@ class AuditEngine:
         tampered_test = False
 
         for f in files:
-            # A deleted test file is not a reproduction test
-            if f.is_test_file and not f.is_deleted:
+            if f.is_test_file and f.is_deleted:
+                # Deleting the test is the cheapest way to "make it pass"
+                tampered_test = True
+                violations.append(
+                    Violation(
+                        rule_id="SG-TEST_FILE_DELETED",
+                        severity=Severity.BLOCKED,
+                        file_path=f.old_path or f.target_path,
+                        line_number=1,
+                        title="Test File Deleted",
+                        message="PR deletes a test file instead of fixing the code under test.",
+                        snippet=None,
+                    )
+                )
+            elif f.is_test_file:
                 has_test_change = True
                 # Run Test Tampering Inspection
                 incidents = AstTamperAnalyzer.analyze_file(f)
@@ -128,6 +141,7 @@ class AuditEngine:
                         if inc.kind
                         in (
                             TamperKind.ASSERT_DELETED,
+                            TamperKind.ASSERT_WEAKENED,
                             TamperKind.TRY_EXCEPT_BYPASS,
                             TamperKind.TEST_SKIPPED,
                         )

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/slopgate/fragment.py

@@ -45,12 +45,14 @@ def _lexical_string_lines(text: str) -> Set[int]:
 class Fragment:
     def __init__(self, file_diff: FileDiff):
         self.text = "\n".join(line for _, line in file_diff.added_lines)
+        # A UTF-8 BOM on line 1 makes the whole fragment unparseable
+        self.text = self.text.lstrip("\ufeff")
         self.line_map: List[int] = [ln for ln, _ in file_diff.added_lines]
 
     @classmethod
     def from_lines(cls, lines: List[Tuple[int, str]]) -> "Fragment":
         fragment = cls.__new__(cls)
-        fragment.text = "\n".join(line for _, line in lines)
+        fragment.text = "\n".join(line for _, line in lines).lstrip("\ufeff")
         fragment.line_map = [ln for ln, _ in lines]
         return fragment
 

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/slopgate/phantom.py

@@ -5,6 +5,7 @@ in Python standard library, project manifests, or local repository files.
 """
 
 import ast
+import os
 import re
 import sys
 from dataclasses import dataclass
@@ -37,6 +38,16 @@ def _normalize(name: str) -> str:
     return name.strip().replace("-", "_").replace(".", "_").lower()
 
 
+def _dotted(node: ast.AST) -> str:
+    """Dotted name of a Name/Attribute chain ('typing.TYPE_CHECKING')."""
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        base = _dotted(node.value)
+        return f"{base}.{node.attr}" if base else node.attr
+    return ""
+
+
 class PhantomDetector:
     """Detects phantom imports and hallucinated APIs added in diffs."""
 
@@ -92,8 +103,43 @@ class PhantomDetector:
         "usb": "pyusb",
         "attr": "attrs",
         "gi": "pygobject",
+        "rest_framework": "djangorestframework",
+        "django_filters": "django_filter",
+        "github": "pygithub",
+        "mysql": "mysqlclient",
+        "mysqldb": "mysqlclient",
+        "jose": "python_jose",
+        "slugify": "python_slugify",
+        "magic": "python_magic",
+        "docx": "python_docx",
+        "pptx": "python_pptx",
+        "fitz": "pymupdf",
+        "grpc": "grpcio",
+        "googleapiclient": "google_api_python_client",
     }
 
+    # Vendored, virtualenv, and build-output trees are not project code.
+    IGNORED_DIRS = {
+        ".git",
+        ".hg",
+        ".svn",
+        ".venv",
+        "venv",
+        "env",
+        "node_modules",
+        "build",
+        "dist",
+        "__pycache__",
+        ".tox",
+        ".nox",
+        ".mypy_cache",
+        ".pytest_cache",
+        "site-packages",
+        "htmlcov",
+        ".eggs",
+    }
+    LOCAL_SCAN_DEPTH = 3
+
     # Common hallucinated methods on standard library objects
     KNOWN_STDLIB_HALLUCINATIONS = {
         ("json", "loads_async"): "json has no async loads method.",
@@ -109,10 +155,49 @@ class PhantomDetector:
 
     @classmethod
     def get_declared_dependencies(cls, repo_root: Optional[Path] = None) -> Set[str]:
-        """Scans dependency manifests and local modules to extract valid import names."""
+        """Scans dependency manifests and local modules to extract valid import names.
+
+        Manifests are read from every directory up to LOCAL_SCAN_DEPTH so
+        monorepos and `src/` layouts resolve too. The manifest is the PR head's
+        copy: shortcut: a PR that adds its own dependency declaration can
+        whitelist a package in the same diff, move to base-SHA manifests if
+        that is ever abused.
+        """
+        repo_root = (repo_root or Path.cwd()).resolve()
         deps: Set[str] = set()
-        repo_root = repo_root or Path.cwd()
 
+        for directory in cls._walk_dirs(repo_root):
+            cls._scan_manifests(directory, deps)
+            if directory != repo_root:
+                # Local package directory (works without __init__.py, PEP 420)
+                deps.add(directory.name.lower())
+            for entry in directory.iterdir():
+                if entry.is_file() and entry.suffix == ".py":
+                    deps.add(entry.stem.lower())
+
+        deps.discard("")
+        return deps
+
+    @classmethod
+    def _walk_dirs(cls, repo_root: Path) -> List[Path]:
+        """Repo directories up to LOCAL_SCAN_DEPTH, skipping vendored/venv trees."""
+        dirs: List[Path] = []
+        base_depth = len(repo_root.parts)
+        for dirpath, dirnames, _ in os.walk(repo_root):
+            current = Path(dirpath)
+            if len(current.parts) - base_depth >= cls.LOCAL_SCAN_DEPTH:
+                dirnames[:] = []
+            dirnames[:] = [
+                d
+                for d in dirnames
+                if d.lower() not in cls.IGNORED_DIRS and not d.startswith(".")
+            ]
+            dirs.append(current)
+        return dirs
+
+    @classmethod
+    def _scan_manifests(cls, repo_root: Path, deps: Set[str]) -> None:
+        """Reads every dependency manifest directly inside one directory."""
         # 1. requirements.txt, requirements/*.txt, requirements-*.txt
         req_files = list(repo_root.glob("*requirement*.txt")) + list(
             repo_root.glob("requirements/*.txt")
@@ -120,14 +205,17 @@ class PhantomDetector:
         for req_file in sorted(set(req_files)):
             cls._read_requirements_file(req_file, deps)
 
-        # 2. setup.py install_requires=[...]
+        # 2. setup.py install_requires / extras_require (all quoted dist names)
         setup_py = repo_root / "setup.py"
         if setup_py.exists():
             try:
                 content = setup_py.read_text(encoding="utf-8", errors="ignore")
-                block = re.search(r"install_requires\s*=\s*\[(.*?)\]", content, re.S)
-                if block:
-                    for match in re.finditer(r'["\']([^"\']+)["\']', block.group(1)):
+                if "install_requires" in content or "extras_require" in content:
+                    for match in re.finditer(
+                        r'["\']([A-Za-z0-9][A-Za-z0-9_.\-]*)(?:\[[^\]]*\])?'
+                        r'(?:[<>=!~][^"\']*)?["\']',
+                        content,
+                    ):
                         deps.add(_normalize(match.group(1)))
             except Exception:
                 pass
@@ -183,17 +271,6 @@ class PhantomDetector:
             except Exception:
                 pass
 
-        # 7. Local repo top-level packages & modules
-        for p in repo_root.glob("*.py"):
-            deps.add(p.stem.lower())
-        for pattern in ("*/__init__.py", "src/*.py", "src/*/__init__.py"):
-            for p in repo_root.glob(pattern):
-                deps.add(
-                    p.stem.lower() if p.name != "__init__.py" else p.parent.name.lower()
-                )
-
-        return deps
-
     @classmethod
     def _read_requirements_file(cls, path: Path, deps: Set[str], depth: int = 0):
         """Reads a requirements file, following `-r` includes one level deep."""
@@ -311,9 +388,21 @@ class PhantomDetector:
     @classmethod
     def _scan_tree(cls, tree, file_diff, line_of, declared_deps: Set[str]):
         incidents: List[PhantomIncident] = []
+        # Imports under `if TYPE_CHECKING:` never load at runtime.
+        type_only_lines: Set[int] = set()
+        for node in ast.walk(tree):
+            if isinstance(node, ast.If) and _dotted(node.test) in (
+                "TYPE_CHECKING",
+                "typing.TYPE_CHECKING",
+            ):
+                end = getattr(node, "end_lineno", None) or node.lineno
+                type_only_lines.update(range(node.lineno, end + 1))
+
         for node in ast.walk(tree):
             # Check `import x`
             if isinstance(node, ast.Import):
+                if getattr(node, "lineno", 0) in type_only_lines:
+                    continue
                 for alias in node.names:
                     top_pkg = alias.name.split(".")[0]
                     if not cls._is_known_package(top_pkg, declared_deps):
@@ -329,6 +418,8 @@ class PhantomDetector:
 
             # Check `from x import y`
             elif isinstance(node, ast.ImportFrom):
+                if getattr(node, "lineno", 0) in type_only_lines:
+                    continue
                 # Relative imports (from . import x) always resolve inside the package
                 if node.module and not node.level:
                     top_pkg = node.module.split(".")[0]

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/slopgate_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: slopgate-cli
-Version: 0.1.0
+Version: 0.1.1
 Summary: AST-based code integrity, test tamper detection, and phantom symbol interception for GitHub Pull Requests.
 Author-email: Shinraya Tech Labs <labs@shinraya.com>
 License-Expression: Apache-2.0
@@ -18,6 +18,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
@@ -196,7 +197,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run SlopGate Shield
-        uses: Shinraya-Tech-Labs/slopgate@v0.1.0
+        uses: Shinraya-Tech-Labs/slopgate@v0
         with:
           fail-on: blocked   # 'blocked' (fails on tamper/hallucinations) or 'warning'
 ```

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/tests/test_cli.py

@@ -99,7 +99,7 @@ def test_install_template_pins_released_action_tag(monkeypatch, capsys, tmp_path
     text = (tmp_path / ".github" / "workflows" / "slopgate.yml").read_text(
         encoding="utf-8"
     )
-    assert f"Shinraya-Tech-Labs/slopgate@v{cli.__version__}" in text
+    assert "Shinraya-Tech-Labs/slopgate@v0" in text
     assert "pull-requests: write" not in text
     capsys.readouterr()
 
@@ -174,3 +174,27 @@ def test_checked_out_pr_cannot_shadow_package(tmp_path):
     )
     assert not marker.exists()
     assert result.returncode == 1
+
+
+def test_missing_diff_file_exits_2(monkeypatch, capsys):
+    code = _main(
+        monkeypatch, ["check", "--diff", str(FIXTURES / "does_not_exist.diff")]
+    )
+    assert code == 2
+    assert "Cannot read diff" in capsys.readouterr().err
+
+
+def test_unparseable_diff_exits_2(monkeypatch, capsys, tmp_path):
+    bad = tmp_path / "pr.diff"
+    bad.write_text("not a diff, just prose\n", encoding="utf-8")
+    assert _main(monkeypatch, ["check", "--diff", str(bad)]) == 2
+    assert "No file changes could be parsed" in capsys.readouterr().err
+
+
+def test_utf16_diff_is_decoded(monkeypatch, capsys, tmp_path):
+    """PowerShell `git diff > pr.diff` writes UTF-16; it must not read as clean."""
+    text = (FIXTURES / "neutered_test.diff").read_text(encoding="utf-8")
+    path = tmp_path / "pr.diff"
+    path.write_bytes(b"\xff\xfe" + text.encode("utf-16-le"))
+    assert _main(monkeypatch, ["check", "--diff", str(path)]) == 1
+    capsys.readouterr()

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/tests/test_engine.py

@@ -19,7 +19,7 @@ def _audit(fixture_name: str):
 
 def test_tampered_diff_audit():
     report = AuditEngine().audit_diff(SAMPLE_TAMPERED_DIFF)
-    assert report.status == Severity.WARNING  # Assertion weakened
+    assert report.status == Severity.BLOCKED  # Assertion weakened
     assert any(v.rule_id == "SG-ASSERT_WEAKENED" for v in report.violations)
     # A tampered test must not count as a reproduction test
     assert not report.repro_verified
@@ -42,7 +42,15 @@ def test_clean_diff_audit():
 
 
 def test_warning_is_not_clean():
-    report = AuditEngine().audit_diff(SAMPLE_TAMPERED_DIFF)
+    diff_text = """diff --git a/src/app.py b/src/app.py
+--- a/src/app.py
++++ b/src/app.py
+@@ -1,2 +1,3 @@
+ def run():
++    log("starting")
+     return 1
+"""
+    report = AuditEngine().audit_diff(diff_text)
     assert report.status == Severity.WARNING
     assert not report.is_clean
     assert report.not_blocked
@@ -103,8 +111,8 @@ deleted file mode 100644
 """
     report = AuditEngine().audit_diff(diff_text)
     assert not report.repro_verified
-    assert any(v.rule_id == "SG-MISSING_TEST_REPRO" for v in report.violations)
-    assert report.status != Severity.INFO
+    assert report.status == Severity.BLOCKED
+    assert any(v.rule_id == "SG-TEST_FILE_DELETED" for v in report.violations)
 
 
 def test_docs_only_diff_is_not_doc_bloat():

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/tests/test_phantom.py

@@ -5,6 +5,7 @@ Tests for Phantom Symbol & Hallucinated Import Detector.
 from pathlib import Path
 
 from slopgate.diff_parser import DiffParser
+from slopgate.engine import AuditEngine
 from slopgate.phantom import PhantomDetector, PhantomKind
 
 
@@ -217,3 +218,87 @@ def test_repo_root_local_package_is_known(tmp_path):
     deps = PhantomDetector.get_declared_dependencies(tmp_path)
     assert "mypkg" in deps
     assert Path(tmp_path / "mypkg").is_dir()
+
+
+def _audit_in(repo_root, diff_text):
+    return AuditEngine(repo_root=repo_root).audit_diff(diff_text)
+
+
+def _hallucinated(report):
+    return [v for v in report.violations if "HALLUCINATED" in v.rule_id]
+
+
+def test_namespace_package_without_init_is_local(tmp_path):
+    (tmp_path / "ns" / "sub").mkdir(parents=True)
+    (tmp_path / "ns" / "sub" / "__init__.py").write_text("", encoding="utf-8")
+    (tmp_path / "ns" / "sub" / "util.py").write_text("def helper():\n    return 1\n")
+    diff = """diff --git a/app/main.py b/app/main.py
+--- a/app/main.py
++++ b/app/main.py
+@@ -1,1 +1,2 @@
++from ns.sub.util import helper
+"""
+    assert _hallucinated(_audit_in(tmp_path, diff)) == []
+
+
+def test_subproject_manifest_is_read(tmp_path):
+    (tmp_path / "services" / "api").mkdir(parents=True)
+    (tmp_path / "services" / "api" / "pyproject.toml").write_text(
+        '[project]\nname = "api"\ndependencies = ["fastapi>=0.100"]\n',
+        encoding="utf-8",
+    )
+    diff = """diff --git a/services/api/main.py b/services/api/main.py
+--- a/services/api/main.py
++++ b/services/api/main.py
+@@ -1,1 +1,2 @@
++from fastapi import FastAPI
+"""
+    assert _hallucinated(_audit_in(tmp_path, diff)) == []
+
+
+def test_setup_py_extras_are_dependencies(tmp_path):
+    (tmp_path / "setup.py").write_text(
+        "from setuptools import setup\n"
+        "setup(\n"
+        "    name='demo',\n"
+        "    install_requires=['requests'],\n"
+        "    extras_require={'aws': ['boto3>=1.0']},\n"
+        ")\n",
+        encoding="utf-8",
+    )
+    deps = PhantomDetector.get_declared_dependencies(tmp_path)
+    assert {"requests", "boto3"} <= deps
+
+
+def test_import_alias_for_declared_distribution():
+    diff = """diff --git a/api/views.py b/api/views.py
+--- a/api/views.py
++++ b/api/views.py
+@@ -1,1 +1,2 @@
++from rest_framework.decorators import api_view
+"""
+    assert _incidents(diff, {"djangorestframework"}) == []
+
+
+def test_type_checking_imports_are_not_runtime_deps():
+    diff = """diff --git a/src/models.py b/src/models.py
+--- a/src/models.py
++++ b/src/models.py
+@@ -1,1 +1,4 @@
++from typing import TYPE_CHECKING
++if TYPE_CHECKING:
++    import pandas
+"""
+    assert _incidents(diff, set()) == []
+
+
+def test_bom_does_not_hide_the_first_line():
+    diff = (
+        "diff --git a/src/x.py b/src/x.py\n"
+        "--- a/src/x.py\n"
+        "+++ b/src/x.py\n"
+        "@@ -1,0 +1,1 @@\n"
+        "+\ufeffimport hallucinated_pkg\n"
+    )
+    incidents = _incidents(diff, set())
+    assert any(inc.symbol == "hallucinated_pkg" for inc in incidents)

{slopgate_cli-0.1.0 → slopgate_cli-0.1.1}/tests/test_tamper.py

@@ -22,7 +22,7 @@ def test_detect_assert_deletion():
     assert any(inc.kind == TamperKind.ASSERT_DELETED for inc in _incidents(diff_text))
 
 
-def test_assert_deletion_not_masked_by_other_hunk():
+def test_assert_move_between_hunks_is_not_a_deletion():
     diff_text = """diff --git a/tests/test_math.py b/tests/test_math.py
 --- a/tests/test_math.py
 +++ b/tests/test_math.py
@@ -33,8 +33,25 @@ def test_assert_deletion_not_masked_by_other_hunk():
 +    assert add(1, 1) == 2
      pass
 """
-    incidents = _incidents(diff_text)
-    assert any(inc.kind == TamperKind.ASSERT_DELETED for inc in incidents)
+    # Splitting a test moves assertions between hunks; only a net loss counts
+    assert not any(
+        inc.kind == TamperKind.ASSERT_DELETED for inc in _incidents(diff_text)
+    )
+
+
+def test_assert_net_loss_across_hunks_is_a_deletion():
+    diff_text = """diff --git a/tests/test_math.py b/tests/test_math.py
+--- a/tests/test_math.py
++++ b/tests/test_math.py
+@@ -10,3 +10,1 @@ def test_one():
+-    assert add(2, 2) == 4
+-    assert add(3, 3) == 6
++    pass
+@@ -40,1 +38,2 @@ def test_two():
++    assert add(1, 1) == 2
+     pass
+"""
+    assert any(inc.kind == TamperKind.ASSERT_DELETED for inc in _incidents(diff_text))
 
 
 def test_assert_rewrite_in_same_hunk_is_not_a_deletion():
@@ -161,3 +178,27 @@ def test_incident_line_numbers_are_absolute():
 """
     incidents = _incidents(diff_text)
     assert [inc.line_number for inc in incidents] == [102]
+
+
+def test_django_style_tests_module_is_detected():
+    diff_text = """diff --git a/blog/tests.py b/blog/tests.py
+--- a/blog/tests.py
++++ b/blog/tests.py
+@@ -10,2 +10,1 @@
+-    assert Post.objects.count() == 1
++    pass
+"""
+    assert any(inc.kind == TamperKind.ASSERT_DELETED for inc in _incidents(diff_text))
+
+
+def test_xfail_and_expected_failure_are_skips():
+    for marker in ('@pytest.mark.xfail(reason="flaky")', "@unittest.expectedFailure"):
+        diff_text = (
+            "diff --git a/tests/test_x.py b/tests/test_x.py\n"
+            "--- a/tests/test_x.py\n"
+            "+++ b/tests/test_x.py\n"
+            "@@ -1,1 +1,2 @@\n"
+            f"+{marker}\n"
+            " def test_x():\n"
+        )
+        assert any(inc.kind == TamperKind.TEST_SKIPPED for inc in _incidents(diff_text))

slopgate_cli-0.1.0/CHANGELOG.md

@@ -1,38 +0,0 @@
-# Changelog
-
-All notable changes to this project are documented here.
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [0.1.0] - 2026-10-28
-
-First public release. Python 3.10+, zero runtime dependencies.
-
-### Added
-
-- `slopgate check` — audits a unified git diff from a file, stdin, or the current
-  PR (`GITHUB_BASE_REF`), with `terminal`, `json`, and `github` output formats and
-  `--fail-on blocked|warning|never`.
-- Test tamper detection: deleted assertions (per hunk), tautology/weakening swaps,
-  `try: ... except: pass` suppression, and newly added `pytest` skips — parsed
-  with `ast`, so `skipif` and comments do not trip it.
-- Phantom symbol detection: imports missing from the stdlib, declared dependencies
-  (`pyproject.toml`, `requirements*.txt` incl. `-r` includes, `setup.py`,
-  `setup.cfg`, `Pipfile`, `environment.yml`, Poetry) and local modules; plus a
-  table of hallucinated stdlib methods.
-- Reproduction gate: flags production changes that ship without a test change,
-  and only counts the reproduction as verified when the test change is untampered.
-- Slop ratio: docstring/comment bloat versus executable statements added.
-- `slopgate demo` — offline interactive simulation of three real PR scenarios.
-- `slopgate install` — writes a pinned `.github/workflows/slopgate.yml` into a repo.
-- `slopgate badge` — Markdown and HTML README badges.
-- Composite GitHub Action with Step Summary output and `::error` annotations.
-- GitHub Actions workflows: CI matrix (Python 3.10–3.13 on Linux/macOS/Windows),
-  package-integrity job (build + `twine check` + wheel smoke test), and a release
-  pipeline (build → PyPI via Trusted Publishing or `PYPI_API_TOKEN` → GitHub
-  Release) with SHA-pinned actions.
-
-[Unreleased]: https://github.com/Shinraya-Tech-Labs/slopgate/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/Shinraya-Tech-Labs/slopgate/releases/tag/v0.1.0