testguard-cli 0.18.1__tar.gz → 0.18.2__tar.gz

testguard_cli-0.18.2/.github/scripts/benchmark-node-direct.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+// Same fixture commit and recipes, N=3, fresh workers, no reused verdicts.
+// Warmups excluded; ABBA timing is informational, mismatched proof fails.
+// Run without competing test processes. Keep the receipt directory for audit.
+// node .github/scripts/benchmark-node-direct.mjs --before-ref <SHA> --out <dir>
+import assert from 'node:assert/strict';
+import { cpSync, mkdtempSync, readFileSync, mkdirSync, writeFileSync, rmSync, readdirSync, symlinkSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { parseArgs } from 'node:util';
+import { performance } from 'node:perf_hooks';
+import { probe as after } from '../../src/probe/probe.mjs';
+import { readSpecDoc, writeSpecDoc } from '../../src/evidence/writer.mjs';
+import { detectContention } from '../../src/probe/contention.mjs';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const { values } = parseArgs({ options: { out: { type: 'string' }, 'before-ref': { type: 'string' } } });
+assert(values.out && /^[0-9a-f]{40}$/.test(values['before-ref'] ?? ''), '--out and an exact --before-ref commit SHA are required');
+const out = resolve(values.out);
+mkdirSync(out, { recursive: true, mode: 0o700 });
+mkdirSync(join(out, 'workers'), { mode: 0o700 }); // Refuse to overwrite a previous study.
+const tool = mkdtempSync(join(tmpdir(), 'tg-direct-reference-'));
+const dir = mkdtempSync(join(tmpdir(), 'tg-direct-bench-'));
+const git = (...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8', timeout: 10000 }).trim();
+const projection = (record) => ({
+  id: record.claim.id + '/' + record.subject.id,
+  subject: record.subject,
+  verdict: record.verdict,
+  reason: record.detail.reason ?? null,
+  defenders: record.defenders,
+  targetHash: record.inputs?.targetHash,
+  defenderHashes: record.inputs?.defenderHashes,
+  discoveryHashes: record.inputs?.discoveryHashes,
+  baseline: (record.detail.baselineRuns ?? []).map(({ durationMs, ...run }) => run),
+  probe: (record.detail.probeRuns ?? []).map(({ durationMs, ...run }) => run),
+  negativeControl: record.detail.negativeControl ?? null,
+});
+// testUniverseHash intentionally changes: it binds the changed adapter itself.
+// The unchanged entries, source bytes, defender bytes and outcomes are checked.
+try {
+  const archive = execFileSync('git', ['archive', '--format=tar', values['before-ref']], { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 10000 });
+  execFileSync('tar', ['-xf', '-', '-C', tool], { input: archive, timeout: 10000 });
+  symlinkSync(join(root, 'node_modules'), join(tool, 'node_modules'), 'junction');
+  const { probe: before } = await import(pathToFileURL(join(tool, 'src/probe/probe.mjs')).href);
+  cpSync(join(root, 'fixtures/known-answer-node'), dir, { recursive: true });
+  for (const file of readdirSync(join(dir, 'test'))) {
+    const path = join(dir, 'test', file);
+    const receipt = `import {writeFileSync as receipt} from 'node:fs';if(process.env.TESTGUARD_NODE_COLLECT!=='1')receipt(${JSON.stringify(join(out, 'workers'))}+'/'+process.pid+'.json',JSON.stringify({pid:process.pid,ppid:process.ppid,version:process.versions.node,file:${JSON.stringify(file)}}),{flag:'wx'});\n`;
+    writeFileSync(path, receipt + readFileSync(path, 'utf8'));
+  }
+  for (const args of [['init', '-q'], ['add', '.'], ['-c', 'user.name=research', '-c', 'user.email=research@example.invalid', 'commit', '-qm', 'same inputs']]) git(...args);
+  const head = git('rev-parse', 'HEAD');
+  const claims = readSpecDoc('claims', join(dir, 'testguard.claims.json'));
+  const expected = JSON.parse(readFileSync(join(dir, 'expected.json'))).expected;
+  const results = [];
+  let reference;
+  async function wave(strategy, label, measured) {
+    assert(!detectContention().detected, 'foreign runner contention');
+    const ids = new Set(readdirSync(join(out, 'workers')));
+    const start = performance.now();
+    const evidence = await ({ before, after }[strategy])({ projectDir: dir, claims, runnerName: 'node-test', confirmRuns: 3, workers: 1, serial: true, budgetMs: 10000, escalate: false });
+    const elapsedMs = performance.now() - start;
+    assert.equal(evidence.run.repo.head, head);
+    assert.equal(git('status', '--porcelain'), '');
+    assert.equal(git('worktree', 'list', '--porcelain').split('worktree ').length - 1, 1);
+    assert.equal(evidence.records.length, Object.keys(expected).length);
+    assert.deepStrictEqual(evidence.records.map((record) => record.claim.id + '/' + record.subject.id), claims.claims.flatMap((claim) => claim.faults.map((fault) => claim.id + '/' + fault.id)));
+    for (const record of evidence.records) {
+      const oracle = expected[record.claim.id + '/' + record.subject.id];
+      assert.equal(record.verdict, oracle.verdict);
+      if (oracle.reason) assert.equal(record.detail.reason, oracle.reason);
+      assert(!record.reusedFrom);
+      if (record.verdict === 'killed') {
+        assert.equal(record.detail.probeRuns.length, 3);
+        assert.equal(record.detail.baselineRuns.length, 3);
+        assert(record.detail.baselineRuns.every((run) => run.outcome === 'pass'));
+        assert(record.detail.probeRuns.every((run) => run.outcome === 'fail' && run.assertionFailures > 0));
+      }
+    }
+    const projected = evidence.records.map(projection);
+    reference ??= projected;
+    assert.deepStrictEqual(projected, reference);
+    writeSpecDoc('evidence', join(out, label + '-' + strategy + '.json'), evidence);
+    const receipts = readdirSync(join(out, 'workers')).filter((file) => !ids.has(file)).map((file) => JSON.parse(readFileSync(join(out, 'workers', file))));
+    for (const receipt of receipts) assert.equal(receipt.version, process.versions.node);
+    if (measured) results.push({ strategy, label, elapsedMs, measurements: evidence.run.measurements, workerReceipts: receipts.length, parentPids: new Set(receipts.map((receipt) => receipt.ppid)).size });
+  }
+  await wave('before', 'warm', false);
+  await wave('after', 'warm', false);
+  for (const [i, strategy] of ['before', 'after', 'after', 'before'].entries()) await wave(strategy, String(i), true);
+  const mean = (strategy) => results.filter((result) => result.strategy === strategy).reduce((sum, result) => sum + result.elapsedMs, 0) / 2;
+  const summary = {
+    version: process.versions.node,
+    toolHead: execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim(),
+    beforeRef: values['before-ref'], head,
+    beforeMs: mean('before'), afterMs: mean('after'), speedup: mean('before') / mean('after'),
+    verifiedOutcomes: 40, results,
+  };
+  writeFileSync(join(out, 'summary.json'), JSON.stringify(summary, null, 2) + '\n');
+  console.log(JSON.stringify(summary));
+} finally {
+  rmSync(dir, { recursive: true, force: true });
+  rmSync(tool, { recursive: true, force: true });
+}

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/.github/workflows/ci.yml

@@ -247,6 +247,32 @@ jobs:
           path: .testguard/ci-self-evidence.json
           if-no-files-found: warn
 
+  native-performance:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [22, 24]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm ci --omit=dev
+      - name: Matched native probes against the exact base commit
+        env:
+          BEFORE_REF: ${{ github.event.pull_request.base.sha }}
+        run: node .github/scripts/benchmark-node-direct.mjs --before-ref "$BEFORE_REF" --out "$RUNNER_TEMP/native-performance"
+      - name: Retain timings, worker receipts and every N=3 proof
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-performance-${{ matrix.node-version }}
+          path: ${{ runner.temp }}/native-performance
+          if-no-files-found: error
+
   native-node-floor:
     runs-on: ubuntu-latest
     steps:

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.2] - 2026-10-02
+
+Automated weekly release — everything merged since `v0.18.1`.
+
+### Changed
+
+- perf: use one fresh process for single-entry native probes (#200)
+- perf: focus gate annotation and claim selection defenders (#198)
+- chore(homebrew): sha256 for v0.18.1 (#197)
+
+
+### Performance
+
+- Eligible single-file native Node confirmations use one fresh process, avoiding a second process launch while preserving real CLI entry identity, ordinary tests beside `.only`, import and late-error refusals, budgets, and process cleanup. Discovery, multiple files and older runtimes keep the existing isolated route.
+- Focus gate coverage, repeated claim selection and annotation ID bounds defenders on their relevant checks, retaining all original assertions in the mandatory acceptance suite and all fault recipes.
+
 ## [0.18.1] - 2026-10-01
 
 Automated weekly release — everything merged since `v0.18.0`.

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.18.1
+Version: 0.18.2
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.18.1` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.18.2` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.2/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -809,12 +809,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.18.1
+- uses: raccioly/testguard@v0.18.2
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.2/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.18.1` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.18.2` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.2/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -785,12 +785,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.18.1
+- uses: raccioly/testguard@v0.18.2
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.2/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/action.yml

@@ -50,7 +50,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.18.1'
+    default: '0.18.2'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.18.1 · MIT</div>
+    <div class="meta">Technical Brief · v0.18.2 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/docs-canonical/ARCHITECTURE.md

@@ -85,7 +85,7 @@ other tools, and it must remain portable out of this repository.
 | Runtime | Node.js >= 20, ESM | `node:util.parseArgs` is the floor; the first target runners are JavaScript |
 | Runtime dependencies | exactly one, `ajv` 8.20.0, exact-pinned | Every document is validated before it is written; everything else is standard library |
 | Test runner (ours) | vitest | Also our first supported runner, so we dogfood it |
-| Supported runners | vitest, jest, explicit node-test (project runners); Playwright and Python (per file) | Native Node uses an injected entry preload and bounded structured reporter, reusing shared process budgets; auto selection does not infer Node eligibility from its availability |
+| Supported runners | vitest, jest, explicit node-test (project runners); Playwright and Python (per file) | Native Node uses authenticated entry receipts and a bounded structured reporter, reusing shared process budgets. Eligible single-entry confirmations use one fresh process; discovery and multiple entries retain isolated controller/workers. Auto selection does not infer Node eligibility from its availability |
 | Schemas | JSON Schema 2020-12 | Readable without the tool; portable to other languages |
 | Distribution | npm, PyPI, Homebrew, GitHub Action, pre-commit, GitLab component | Meet teams in the pipeline they already run |
 | Publishing | OIDC for npm/PyPI; tap-scoped SSH deploy key for Homebrew | Registry credentials remain tokenless; the only stored publishing secret cannot access any repository except the tap |

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/docs-canonical/REQUIREMENTS.md

@@ -95,15 +95,15 @@ fails the pull request naming the unclaimed file, and `status` reports
 | FR-05 | `src/probe/classify.mjs` | `TG-TIMEOUT-NEVER-KILLS`, `TG-PW-TIMEOUT-NEVER-KILLS` |
 | FR-06 | `src/baseline/baseline.mjs` | `test/baseline.test.mjs`, `TG-RESTAMP-REQUIRES-SAME-FINGERPRINTS` |
 | FR-07 | `src/brief/`, `src/status/`, `src/mcp/` | `test/brief.test.mjs`, `test/status.test.mjs`, `TG-MCP-IS-READ-ONLY` |
-| FR-08 | `src/gate/changed.mjs` | `test/gate.test.mjs`, `TG-GATE-UNCLAIMED-EXITS-1` |
+| FR-08 | `src/gate/changed.mjs` | `test/gate.test.mjs`, `test/gate-coverage.test.mjs`, `TG-GATE-UNCLAIMED-EXITS-1` |
 | FR-09 | `src/probe/mocks.mjs` | `test/mocks.test.mjs`, `TG-MOCKING-FILE-IS-NOT-A-DEFENDER` |
-| FR-10 | `src/probe/runners/` | fixture acceptance per runner, `TG-RUNNER-FROM-PROJECT-FIRST` |
+| FR-10 | `src/probe/runners/` | fixture acceptance per runner, `TG-RUNNER-FROM-PROJECT-FIRST`, `test/runner-node-direct.test.mjs` and `TG-NODE-DIRECT-KEEPS-FAILURE-BOUNDARIES` |
 | FR-11 | `src/scaffold/producers.mjs` | `test/scaffold.test.mjs`, `test/scaffold.python.test.mjs`, `TG-SCAFFOLD-ANCHORS-HIT`, `TG-SCAFFOLD-NEVER-PROPOSES-A-NO-OP`, `TG-SCAFFOLD-LOOP-GUARD-IS-A-GUARD` |
 | FR-12 | `src/admit/admit.mjs` | `test/admit.test.mjs`, `TG-ADMIT-NEEDS-ALL-KILLED` |
 | FR-13 | `src/replay/` | `test/replay.test.mjs`, `test/calibration.test.mjs`, `TG-REPLAY-FLAKY-IS-NEVER-CAUGHT`, `TG-CALIBRATION-COUNTS-NOCOVER-AS-A-MISS`, `TG-CALIBRATION-COUNTS-ONLY-BUGS` |
 | FR-14 | `src/mcp/` | `test/mcp.test.mjs` |
 | FR-15 | `src/claims/anchors.mjs`, `src/commands/claims.mjs`, `src/status/status.mjs` | `test/claims-anchors.test.mjs`, `test/status.test.mjs`, `TG-ANCHOR-PREFLIGHT-FAILS-FAST` |
-| FR-16 | `src/cli.mjs`, `src/commands/probe.mjs`, `src/probe/probe.mjs`, `src/commands/scaffold.mjs`, `src/commands/admit.mjs` | `test/claim-selection.test.mjs`, `test/probe.fixture.test.mjs`, `TG-REPEATED-CLAIMS-ARE-ALL-PROBED` |
+| FR-16 | `src/cli.mjs`, `src/commands/probe.mjs`, `src/probe/probe.mjs`, `src/commands/scaffold.mjs`, `src/commands/admit.mjs` | `test/claim-selection.test.mjs`, `test/claim-options.test.mjs`, `test/probe.fixture.test.mjs`, `TG-REPEATED-CLAIMS-ARE-ALL-PROBED` |
 | FR-17 | `src/probe/attribution.mjs`, `src/probe/probe.mjs`, `src/commands/claims.mjs`, `src/status/status.mjs`, `src/probe/cost.mjs` | `test/fault-defenders.test.mjs`, `test/attribution.test.mjs`, `test/status.test.mjs`, `test/cost.test.mjs`, `TG-FAULT-DEFENDER-SELECTION`, `TG-FAULT-DEFENDER-ORCHESTRATION` |
 | NFR-01 | `src/init/init.mjs`, runner resolution | `TG-INIT-HOOK-NO-NETWORK`, `TG-README-HOOK-MATCHES-THE-CODE` (every surface, not only the README), `TG-GITIGNORE-ADVICE-IS-ONE-LIST` |
 | NFR-02 | `package.json` | `npm run test:install` in CI |

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "testguard-cli",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.18.1",
+      "version": "0.18.2",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0"

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/packaging/gitlab/testguard.gitlab-ci.yml

@@ -3,7 +3,7 @@
 # Include it from a project's .gitlab-ci.yml, pinned to a release:
 #
 #   include:
-#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml'
+#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.2/packaging/gitlab/testguard.gitlab-ci.yml'
 #       inputs:
 #         dir: backend            # where testguard.claims.json lives (default ".")
 #         post_note: true         # post the brief as a merge-request note (needs TESTGUARD_GITLAB_TOKEN, api scope)
@@ -29,7 +29,7 @@ spec:
   inputs:
     version:
       description: testguard-cli version to run
-      default: "0.18.1"
+      default: "0.18.2"
     dir:
       description: directory whose test runner is invoked (where testguard.claims.json lives)
       default: "."

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/packaging/homebrew/testguard.rb

@@ -15,8 +15,8 @@
 class Testguard < Formula
   desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.18.1.tgz"
-  sha256 "b722d8656f634198a483ff50db7891c21cfccae3aa136faaf9436fc79df33d7d"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.18.2.tgz"
+  sha256 "ce853672bf41f9570e21f661d8544c4dda6872317b4863f5aeccba1744c78c9c"
   license "MIT"
 
   depends_on "node"

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.18.1"
+version = "0.18.2"
 description = "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/spec/GATE-SEMANTICS.md

@@ -321,7 +321,21 @@ Rules that follow from the table:
    supports plain JavaScript under Node's default collection, without custom
    loaders, `NODE_OPTIONS` or `NODE_PATH`; it is never selected by `auto`.
    Each confirmation uses fresh, isolated Node test processes under the
-   existing worker ceiling. Reports count executed test results, not individual
+   existing worker ceiling. On Node22.8+, Node24 and Node26, a single selected
+   entry can run inside one fresh process through a reporting preload and the
+   public in-process API; Node evaluates the actual CLI entry, preserving
+   CommonJS `require.main`, ESM `import.meta.main` and argv identity. This process
+   serves no other entry or confirmation. Discovery, multiple
+   entries and other runtime families retain the isolated controller/worker
+   route. Single-entry execution preserves ordinary tests beside `.only`,
+   records entry provenance before evaluation, monitors entry-load failures
+   after test registration, and publishes only at process exit when no
+   out-of-test failure or incompatible exit code occurred. A complete stream
+   cannot turn a later exception, rejection or retained-handle timeout into a
+   kill. Report and entry destinations are captured before project evaluation;
+   project environment edits cannot redirect these owned outputs. Both routes
+   bind their implementation to native discovery identity.
+   Reports count executed test results, not individual
    assertion calls: suite and file-container summaries are not extra tests,
    and skipped/TODO results cannot establish a green defender by themselves.
    A test-body failure counts as a rejection; a load error, hook failure,

testguard_cli-0.18.2/src/probe/runners/node/direct.mjs

@@ -0,0 +1,55 @@
+import { appendFileSync, writeFileSync } from 'node:fs';
+import { readBoundedJsonFile } from '../discovery.mjs';
+import { createReport } from './report.mjs';
+
+// This preload returns before Node evaluates its actual CLI entry. Running the
+// file as the entry preserves require.main, import.meta.main and process.argv.
+const file = process.argv[1];
+if (!file) throw new Error('direct node-test requires an entry');
+const entriesFile = process.env.TESTGUARD_NODE_ENTRIES;
+const reportFile = process.env.TESTGUARD_NODE_REPORT;
+const diagnosticFile = `${entriesFile}.error`;
+const report = createReport({ projectDir: process.cwd(), version: process.versions.node });
+let document;
+let outsideFailure = false;
+process.on('uncaughtExceptionMonitor', (error) => {
+  outsideFailure = true;
+  writeFileSync(diagnosticFile, JSON.stringify({ name: String(error?.name ?? 'Error').slice(0, 100), message: String(error?.message ?? error).slice(0, 1000) }), { mode: 0o600 });
+});
+process.on('unhandledRejection', () => { outsideFailure = true; process.exitCode = 1; });
+// A complete stream is insufficient: a retained timer can fail or hang later.
+// Publish only at process exit, after CLI loading and out-of-test failures settle.
+process.on('exit', (code) => {
+  if (!document || outsideFailure || code !== (document.failed ? 1 : 0)) return;
+  const text = JSON.stringify(document);
+  if (Buffer.byteLength(text) > 16 * 1024 * 1024) return;
+  writeFileSync(reportFile, text, { mode: 0o600 });
+});
+const receipt = JSON.stringify({ file, pid: process.pid, version: process.versions.node });
+if (Buffer.byteLength(receipt) > 8192) throw new Error('node-test entry receipt exceeded its byte bound');
+appendFileSync(entriesFile, `${receipt},`);
+
+// Node24+ otherwise enables implicit .only filtering for isolation:none,
+// even with run({only:false}). Preserve isolated-worker filtering semantics.
+process.env.NODE_TEST_CONTEXT = 'child-v8';
+const { run } = await import('node:test');
+const stream = run({ files: [], isolation: 'none', only: false, setup: () => new Promise((resolve) => {
+  // Keep the public root open until Node has loaded the real CLI entry. An
+  // awaited stream here would block entry evaluation; the drain runs below.
+  process.once('beforeExit', resolve);
+}) });
+(async () => {
+  try {
+    for await (const event of stream) report.accept(event);
+    appendFileSync(entriesFile, 'null]}');
+    const entries = readBoundedJsonFile(entriesFile).entries;
+    if (!Array.isArray(entries) || entries.length !== 2 || entries.pop() !== null) throw new Error('incomplete direct node-test entry receipt');
+    document = report.finish(entries);
+    if (document.failed) process.exitCode = 1;
+  } catch (error) {
+    outsideFailure = true;
+    stream.destroy();
+    process.stderr.write(`node-test reporter failed: ${String(error.message ?? error).slice(0, 1000)}\n`);
+    process.exitCode = 1;
+  }
+})();

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/src/probe/runners/node/entry.mjs

@@ -9,3 +9,9 @@ if (process.env.NODE_TEST_CONTEXT?.startsWith('child')) {
   }
   appendFileSync(process.env.TESTGUARD_NODE_ENTRIES, `${receipt},`);
 }
+
+// A fresh single-entry process initializes reporting before its real CLI
+// entry. Inherited child context must not bootstrap a second reporter in a fork.
+if (process.env.TESTGUARD_NODE_DIRECT === '1' && process.env.NODE_TEST_CONTEXT === '') {
+  await import('./direct.mjs');
+}

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/src/probe/runners/node-test.mjs

@@ -1,10 +1,10 @@
-import { closeSync, mkdtempSync, openSync, readFileSync, readSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { closeSync, existsSync, mkdtempSync, openSync, readFileSync, readSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { runProcess } from './shared.mjs';
-import { createDiscoveryManifest, DiscoveryError, hashDiscoveryConfigs, normalizeDiscoveredFiles, runDiscoveryProcess } from './discovery.mjs';
+import { createDiscoveryManifest, DiscoveryError, hashDiscoveryConfigs, normalizeDiscoveredFiles, readBoundedJsonFile, runDiscoveryProcess } from './discovery.mjs';
 
 export const name = 'node-test';
 export const testGlobs = []; // Native collection is authoritative; never guess from globs.
@@ -12,6 +12,11 @@ const HERE = join(dirname(fileURLToPath(import.meta.url)), 'node');
 const RUNNER = join(HERE, 'runner.mjs');
 const ENTRY = join(HERE, 'entry.mjs');
 const VERSION = process.versions.node;
+/** Admit only maintained runtime families with the in-process public API. */
+export function supportsSingleProcess(version = VERSION) {
+  const [major, minor] = version.split('.').map(Number);
+  return major === 22 && minor >= 8 || major === 24 || major === 26;
+}
 const strategyHash = () => {
   const digest = createHash('sha256');
   const descriptor = openSync(process.execPath, 'r');
@@ -20,7 +25,7 @@ const strategyHash = () => {
     let length;
     while ((length = readSync(descriptor, bytes, 0, bytes.length, null)) > 0) digest.update(bytes.subarray(0, length));
   } finally { closeSync(descriptor); }
-  for (const file of [fileURLToPath(import.meta.url), ...['runner.mjs', 'entry.mjs', 'report.mjs'].map((file) => join(HERE, file)), ...['shared.mjs', 'discovery.mjs', 'lifecycle.mjs'].map((file) => join(HERE, '..', file))]) digest.update(readFileSync(file));
+  for (const file of [fileURLToPath(import.meta.url), ...['runner.mjs', 'direct.mjs', 'entry.mjs', 'report.mjs'].map((file) => join(HERE, file)), ...['shared.mjs', 'discovery.mjs', 'lifecycle.mjs'].map((file) => join(HERE, '..', file))]) digest.update(readFileSync(file));
   return digest.digest('hex');
 };
 const admissionError = () => Number(VERSION.split('.')[0]) < 20 ? 'node-test requires Node20 or newer'
@@ -37,15 +42,16 @@ const receipts = () => {
   writeFileSync(file, '{"entries":[', { mode: 0o600 });
   return { dir, file };
 };
-const environment = (file, collect, workers) => ({
+const environment = (file, collect, workers, direct = false) => ({
   TESTGUARD_NODE_ENTRIES: file,
   TESTGUARD_NODE_COLLECT: collect ? '1' : '0',
   TESTGUARD_NODE_WORKERS: String(workers),
   TESTGUARD_NODE_REPORT: '{out}',
+  TESTGUARD_NODE_DIRECT: direct ? '1' : '0',
   NODE_TEST_CONTEXT: '',
   NODE_DISABLE_COMPILE_CACHE: '1',
 });
-export const argvFor = (projectDir, files) => [process.execPath, `--import=${ENTRY}`, RUNNER, ...files.map((file) => resolve(realpathSync(projectDir), file))];
+export const argvFor = (projectDir, files, { direct = false } = {}) => [process.execPath, `--import=${ENTRY}`, ...(!direct ? [RUNNER] : []), ...files.map((file) => resolve(realpathSync(projectDir), file))];
 
 /** Reject unsupported/incomplete envelopes before deriving any verdict inputs. */
 export function validateReport(report) {
@@ -120,11 +126,19 @@ export async function run(opts) {
   const files = normalizeDiscoveredFiles(opts.projectDir, opts.files);
   const spool = receipts();
   try {
-    return await runProcess({ ...opts, files, cleanupOnClose: true, env: environment(spool.file, false, opts.serial ? 1 : opts.workers ?? 1), argv: (selected) => argvFor(opts.projectDir, selected), parse: (report, durationMs) => {
+    const direct = files.length === 1 && supportsSingleProcess();
+    const result = await runProcess({ ...opts, files, cleanupOnClose: true, env: environment(spool.file, false, opts.serial ? 1 : opts.workers ?? 1, direct), argv: (selected) => argvFor(opts.projectDir, selected, { direct }), parse: (report, durationMs) => {
       validateReport(report);
       const entries = normalizeDiscoveredFiles(opts.projectDir, report.entries.map((entry) => entry.file));
       if (entries.length !== report.entries.length || JSON.stringify(entries) !== JSON.stringify(files)) throw new DiscoveryError('node-test did not execute every selected entry exactly');
       return parseReport(report, durationMs);
     } });
+    // CLI loading can fail before a complete stream exists. Keep the actual
+    // bounded exception identity rather than Node's trailing version banner.
+    if (result.run.outcome === 'error' && existsSync(`${spool.file}.error`)) {
+      const diagnostic = readBoundedJsonFile(`${spool.file}.error`, 8192);
+      if (typeof diagnostic.name === 'string' && diagnostic.name.length <= 100 && typeof diagnostic.message === 'string' && diagnostic.message.length <= 1000) result.loadMessage = `${diagnostic.name}: ${diagnostic.message}`;
+    }
+    return result;
   } finally { rmSync(spool.dir, { recursive: true, force: true }); }
 }

{testguard_cli-0.18.1 → testguard_cli-0.18.2}/test/annotation-advisory.test.mjs

@@ -2,8 +2,6 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
 import { claimsCommand } from '../src/commands/claims.mjs';
 import { computeStatus, renderStatus } from '../src/status/status.mjs';
 import { validate } from '../spec/lib/validate.mjs';
@@ -88,21 +86,6 @@ describe('annotation guidance is not verification', () => {
     expect(status.notes.join('\n')).not.toContain('EACCES');
     expect(status.notes.join('\n')).not.toContain('Missing source annotation:');
   });
-  it('finishes lexical scanning for long prose tokens without a hyphen', () => {
-    const dir = project(); writeFileSync(join(dir, 'prose.md'), `@claim ${'a'.repeat(256)}\n`);
-    const run = spawnSync(process.execPath, ['--input-type=module', '-e',
-      'const { projectAnnotationAdvisory, scanAnnotations } = await import(process.argv[1]); const advice = projectAnnotationAdvisory(process.argv[2], { claims: [{ id: "A-1" }] }); if (advice.missingIds.join() !== "A-1" || scanAnnotations(process.argv[2]).length) process.exit(1);',
-      new URL('../src/claims/annotations.mjs', import.meta.url).href, dir], { encoding: 'utf8', timeout: 2000 });
-    expect(run.error).toBeUndefined(); expect(run.status).toBe(0);
-  });
-  it('promptly refuses valid shared-format IDs outside placement vocabulary', () => {
-    const dir = project(); const path = join(dir, 'testguard.claims.json');
-    const claims = { schemaVersion: 1, claims: [{ id: 'a'.repeat(128), statement: 'Intended behavior.', severity: 'high', source: { kind: 'manual' }, producedBy: { producer: 'human' }, faults: [{ id: 'F1', file: 'a.mjs', find: 'true', replace: 'false', description: 'Break behavior.', faultClass: 'other', producedBy: { producer: 'human' } }] }] };
-    expect(validate('claims', claims).ok).toBe(true); writeFileSync(path, JSON.stringify(claims));
-    const run = spawnSync(process.execPath, [fileURLToPath(new URL('../cli/testguard.mjs', import.meta.url)), 'claims', dir, '--annotate', '--json'], { encoding: 'utf8', timeout: 2000 });
-    expect(run.error).toBeUndefined(); expect(run.status).toBe(2);
-    expect(JSON.parse(run.stdout).refused[0].reason).toBe('unsupported-claim-id');
-  });
   it('explicitly preserves custom claims selection in preview advice', async () => {
     const dir = project(); const custom = join(dir, 'custom.json');
     writeFileSync(custom, JSON.stringify({ schemaVersion: 1, claims: [{ id: 'B-1', statement: 'Custom intent.', severity: 'high', source: { kind: 'manual' }, producedBy: { producer: 'human' }, faults: [{ id: 'F1', file: 'a.mjs', find: 'true', replace: 'false', description: 'Break condition.', faultClass: 'other', producedBy: { producer: 'human' } }] }] }));

testguard_cli-0.18.2/test/annotation-id-bounds.test.mjs

@@ -0,0 +1,33 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { validate } from '../spec/lib/validate.mjs';
+
+const roots = [];
+afterEach(() => roots.splice(0).forEach((dir) => rmSync(dir, { recursive: true, force: true })));
+function project() {
+  const dir = mkdtempSync(join(tmpdir(), 'tg-annotation-bounds-')); roots.push(dir);
+  writeFileSync(join(dir, 'a.mjs'), 'export const allowed = true;\n');
+  return dir;
+}
+describe('bounded annotation ID matching', () => {
+
+  it('finishes lexical scanning for long prose tokens without a hyphen', () => {
+    const dir = project(); writeFileSync(join(dir, 'prose.md'), `@claim ${'a'.repeat(256)}\n`);
+    const run = spawnSync(process.execPath, ['--input-type=module', '-e',
+      'const { projectAnnotationAdvisory, scanAnnotations } = await import(process.argv[1]); const advice = projectAnnotationAdvisory(process.argv[2], { claims: [{ id: "A-1" }] }); if (advice.missingIds.join() !== "A-1" || scanAnnotations(process.argv[2]).length) process.exit(1);',
+      new URL('../src/claims/annotations.mjs', import.meta.url).href, dir], { encoding: 'utf8', timeout: 2000 });
+    expect(run.error).toBeUndefined(); expect(run.status).toBe(0);
+  });
+  it('promptly refuses valid shared-format IDs outside placement vocabulary', () => {
+    const dir = project(); const path = join(dir, 'testguard.claims.json');
+    const claims = { schemaVersion: 1, claims: [{ id: 'a'.repeat(128), statement: 'Intended behavior.', severity: 'high', source: { kind: 'manual' }, producedBy: { producer: 'human' }, faults: [{ id: 'F1', file: 'a.mjs', find: 'true', replace: 'false', description: 'Break behavior.', faultClass: 'other', producedBy: { producer: 'human' } }] }] };
+    expect(validate('claims', claims).ok).toBe(true); writeFileSync(path, JSON.stringify(claims));
+    const run = spawnSync(process.execPath, [fileURLToPath(new URL('../cli/testguard.mjs', import.meta.url)), 'claims', dir, '--annotate', '--json'], { encoding: 'utf8', timeout: 2000 });
+    expect(run.error).toBeUndefined(); expect(run.status).toBe(2);
+    expect(JSON.parse(run.stdout).refused[0].reason).toBe('unsupported-claim-id');
+  });
+});