tests/test_hygiene.py — Email Domain Setup Checker

"""Check published source and documentation for accidental disclosure.

By Zero Width Lab (zerowidthlab.com)
"""

from __future__ import annotations

import ast
import json
import re
import subprocess
import sys
import unittest
from pathlib import Path

# By Zero Width Lab (zerowidthlab.com)
__author__ = "Zero Width Lab"

SIGNATURE = "By Zero Width Lab (zerowidthlab.com)"
ROOT = Path(__file__).resolve().parent.parent


class PackageHygieneTests(unittest.TestCase):
    @classmethod
    def setUpClass(cls) -> None:
        declaration = ROOT / "manifest.json"
        if not declaration.is_file():
            declaration = ROOT / "packaging" / "package-spec.json"
        spec = json.loads(declaration.read_text(encoding="utf-8"))
        cls.spec = spec
        cls.shipped = [ROOT / entry["path"] for entry in spec["files"]]

    def test_package_inventory_and_python_permissions(self) -> None:
        names = {path.relative_to(ROOT).as_posix() for path in self.shipped}
        self.assertEqual(len(names), len(self.shipped))
        self.assertTrue(all(path.is_file() for path in self.shipped))
        self.assertTrue({"SKILL.md", "README.md", "SETUP.md", "LICENSE.txt", "source-package.json"} <= names)
        self.assertIn("scripts/email_domain_setup_checker.py", names)
        self.assertIn("tests/test_hygiene.py", names)
        self.assertIn("tests/test_email_domain_setup_checker.py", names)
        self.assertTrue(any(name.startswith("agents/") for name in names))
        self.assertTrue(any(name.startswith("references/") for name in names))
        self.assertFalse(any(name.startswith("packaging/") for name in names))
        for entry in self.spec["files"]:
            if entry["path"].endswith(".py"):
                self.assertTrue(entry["executable"], entry["path"])

    def test_visible_signature_and_script_help(self) -> None:
        for path in self.shipped:
            if path.suffix == ".md":
                self.assertEqual(path.read_text(encoding="utf-8").splitlines()[-1], SIGNATURE, str(path))
            elif path.suffix == ".py":
                source = path.read_text(encoding="utf-8")
                self.assertIn("# " + SIGNATURE, source[:500], str(path))
                self.assertIn('__author__ = "Zero Width Lab"', source, str(path))
        result = subprocess.run(
            [sys.executable, str(ROOT / "scripts" / "email_domain_setup_checker.py"), "--help"],
            cwd=ROOT, capture_output=True, text=True, check=False,
        )
        self.assertEqual(result.returncode, 0, result.stderr)
        self.assertEqual(result.stdout.splitlines()[-1], SIGNATURE)

    def test_no_forbidden_constructs(self) -> None:
        forbidden = {"eval", "exec", "compile", "re.compile", "os.system"}
        for path in self.shipped:
            if path.suffix != ".py":
                continue
            tree = ast.parse(path.read_text(encoding="utf-8"))
            for node in ast.walk(tree):
                if isinstance(node, (ast.Import, ast.ImportFrom)):
                    modules = [alias.name for alias in node.names] if isinstance(node, ast.Import) else [node.module or ""]
                    self.assertFalse(any(name.split(".")[0] in {"pickle", "ctypes"} for name in modules))
                if isinstance(node, ast.Call):
                    name = ast.unparse(node.func)
                    self.assertNotIn(name, forbidden, str(path))
                    self.assertFalse(any(keyword.arg == "shell" and not
                        (isinstance(keyword.value, ast.Constant) and keyword.value.value is False)
                        for keyword in node.keywords), str(path))

    def test_no_private_identifiers_or_invisible_characters(self) -> None:
        guid = "[0-9a-fA-F]{8}-" + "-".join(["[0-9a-fA-F]{4}"] * 3) + "-[0-9a-fA-F]{12}"
        mailbox = r"[A-Za-z0-9._%+-]+" + "@" + r"[A-Za-z0-9.-]+\.[A-Za-z]{2,}"
        home = r"/(?:home|Users)/[^/\s]+/"
        tenant = r"[A-Za-z0-9-]+\.(?:onmicrosoft|sharepoint)\.com"
        invisible = {chr(code) for code in (0x200B, 0x200C, 0x200D, 0x2060, 0xFEFF)}
        ai_names = ["Open" + "AI", "Anth" + "ropic", "Chat" + "G" + "PT", "Gem" + "ini",
                    "Clau" + "de", "Code" + "x", "Copi" + "lot", "Son" + "net",
                    "Op" + "us"]
        gpt_token = "G" + "PT"
        for path in self.shipped:
            text = path.read_text(encoding="utf-8")
            with self.subTest(path=path.relative_to(ROOT)):
                self.assertIsNone(re.search(guid, text))
                for address in re.findall(mailbox, text):
                    self.assertIn(address.rsplit("@", 1)[1].lower(),
                                  {"example.com", "example.net", "example.org"})
                self.assertIsNone(re.search(home, text))
                self.assertIsNone(re.search(tenant, text, re.IGNORECASE))
                self.assertFalse(invisible.intersection(text))
                for name in ai_names:
                    self.assertNotIn(name.lower(), text.lower())
                self.assertIsNone(re.search(r"\b" + gpt_token + r"\b", text))



if __name__ == "__main__":
    unittest.main()

License: MIT (read it).

Back to the listing