@allansantos-dev/smart-tool 0.9.40 → 0.9.42

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 0.9.42 - beta
+
+- Presentations and workbooks of the project are searchable. `.pptx` text comes out per slide under `[slide N]`, with the
+  speaker notes under `[notes N]`; `.xlsx` per sheet under `[sheet NAME]`, one tab-separated line per row, cached formula
+  values (nothing is calculated), shared and inline strings resolved. They go through the same zip and XML guards as
+  `.docx` and `.pdf` (10 MiB, 2000 entries, no encryption, no DOCTYPE or ENTITY, 8 MiB of XML, 1 MiB of text), plus 100,000
+  rows and 16,384 columns for a workbook; a corrupt, hostile or oversized file is skipped with the reason and the rest of the
+  project is indexed. `document_text.VERSION` is 3: `.docx` and `.pdf` already indexed are read once more. Measurement
+  before and after in `docs/research/data/office-probe-*.json`; tests in `tests/test_office_index.py`. A CSV of 1 MiB is
+  indexed and searched in 4 ms; one of 20 MiB is refused as `over size limit` in the index stats, without stalling.
+- The session-start audit report works in Codex. The Setup audit page turns on the SessionStart hook for Claude Code or
+  Codex (preview, confirm, backup, remove only ours); Codex runs a new hook only after you approve it in `/hooks`, so the page
+  shows "installed, waiting for your approval in /hooks" until the approval is found in `config.toml`, and the first-search
+  audit line keeps showing until then. Research with the primary sources in
+  `docs/research/2026-10-27-codex-sessionstart-hook.md`; tests in `tests/test_codex_audit_hook.py`.
+- Review fixes: a workbook cell reference past column XFD, a negative shared-string index, a corrupt deflate stream and
+  a newline in a sheet name no longer escape as `MemoryError`, `zlib.error`, a wrong text or a forged `[sheet ...]` line;
+  the tests of the Codex hook ignore `CODEX_HOME` and `CLAUDE_CONFIG_DIR` so they never write outside their temporary home.
+
+## 0.9.41 - beta
+
+- Far fewer calls to the embedding and rerank models. Measured on a real machine (24 h): 8303 embedding and 1473 rerank
+  calls, 0.3% of them failing; the volume came from four places, all cut: (1) an indexing job no longer embeds a fixed
+  text to learn the vector size when the index already stores it for the same model (1300 calls a day); (2) embedding
+  batches carry up to 128 chunks and 120,000 characters instead of 32,000 characters (3.8 chunks per call before); a
+  request the gateway refuses for its size is split in two halves once; (3) one rerank call per search instead of one
+  per block (code, test, doc); the blocks keep the order the separate calls gave; (4) a project in `eager` mode whose
+  files change all the time waits longer between jobs (60, 120, 240, 480 up to 900 s, back to 60 s after a quiet
+  period), and `*.tmp`, `*.bak`, `*.swp` and `*~` files no longer mark a project as changed or enter the index.
+  Measurement before and after in `docs/research/data/call-volume-*.json`, findings and sources in
+  `docs/research/2026-10-27-excesso-de-chamadas-embed-rerank.md`. Tests in `tests/test_call_volume.py`.
+- A model that answers 429 or 503 three times in a row opens a circuit for 30 s: calls to it fail at once and the search
+  answers from the lexical index with the usual warning, instead of repeating requests. At most 6 requests are in
+  flight per model. Rerank and the model check wait the gateway's `Retry-After` (or a jittered exponential delay) before
+  asking again, like embeddings.
+- The setup Models page groups the failures by type (429, 503, other 5xx, timeout, connection, authentication, other):
+  one row per type and role with the count, first and last time, one sample message, and the latest 20 lines on
+  expand. The summary shows the calls per purpose (indexing, query, rerank, model check). `dependency_mode` has its own
+  card in the setup rules.
+- The dependency notice also reads `requirements*.txt` (PyPI, `==` pins and the lower bound of `>=` and `~=`) and `go.mod`
+  (Go, `require` lines with a plain `vX.Y.Z`). `web_fetch` reads PDFs with the same page and character caps as the
+  indexer (`document_text`).
+
 ## 0.9.40 - beta
 
 - PDFs of the project are searchable. `smart_search` indexes the text layer of a `.pdf` inside the project scope and

package/README.md

@@ -16,7 +16,7 @@ registered as the `playwright` server where this machine lets a browser be drive
 An optional hook routes the agent's native Grep/Glob/Read/Bash/WebSearch/WebFetch calls to these tools when they
 are cheaper, or just tells the agent what Smart Tool would do.
 
-**Status:** 0.9.40 beta. Windows only. What changed in each version: [CHANGELOG.md](CHANGELOG.md).
+**Status:** 0.9.42 beta. Windows only. What changed in each version: [CHANGELOG.md](CHANGELOG.md).
 
 ## How it works
 
@@ -129,7 +129,7 @@ Redirects) and Maintenance (Setup audit, Startup).
    When a new version recommends other models than the ones you use, a Windows notification (**Apply now**, **Don't
    show again**) and the **New recommended models** card on this page offer them: nothing changes until you apply, the
    models you had are kept, and **Switch back to my previous models** undoes it. The **Model failures (last 24 h)** table
-   lists every failed gateway call by role, model and tool; a model that fails half of its calls (5 or more) also raises a
+   groups the failed gateway calls by type (429, 503, other 5xx, timeout, connection, authentication) and role, with the count, the first and last time and one sample, and shows the calls per purpose; a model that fails half of its calls (5 or more) also raises a
    notification and a tray alert. A failure inside a tool call also comes back as a warning line in the tool answer;
    calls made by a hook or by background work (index scope and profile, block-pattern proposals) have no answer to
    carry it, so they show only in the table, the log and the notification. The local embedder is not in that table or in
@@ -189,9 +189,12 @@ Redirects) and Maintenance (Setup audit, Startup).
    A documented function edited only in its body is not mentioned. `project_manage` with `action=docs` lists the
    public functions still without a docstring, for documenting a project that started without them.
 
-   **Dependency check on edit**: an edit of `package.json` that adds or changes a dependency lists the OSV advisory IDs of up to 5 of them (exact version, or the lower bound of `^`, `~` and `>=`), answered from a 6 h disk cache or one 2.5 s batch call that sends only package names and versions; when OSV cannot answer, the reminder says the check was skipped and the edit goes on. `dependency_mode` in `config.json`: `warn` (default) or `off`.
+   **Dependency check on edit**: an edit of `package.json`, `requirements*.txt` or `go.mod` that adds or changes a dependency lists the OSV advisory IDs of up to 5 of them (exact version, or the lower bound of `^`, `~`, `~=` and `>=`), answered from a 6 h disk cache or one 2.5 s batch call that sends only package names and versions; when OSV cannot answer, the reminder says the check was skipped and the edit goes on. `dependency_mode` in `config.json`: `warn` (default) or `off`.
 
-   **PDFs** inside a project are indexed as text with `[page N]` markers (20 MiB, 300 pages and 20 s per file; a scanned, password-protected or corrupt PDF is skipped with the reason), so `smart_search` returns the page that holds a passage.
+   **PDFs** inside a project are indexed as text with `[page N]` markers (20 MiB, 300 pages and 20 s per file; a scanned, password-protected or corrupt PDF is skipped with the reason), so `smart_search` returns the page that holds a passage. **Presentations and workbooks** (`.pptx`, `.xlsx`) are indexed the
+   same way: text of each slide under `[slide N]` with the speaker notes under `[notes N]`, each sheet under `[sheet NAME]` with one
+   tab-separated line per row (cached formula values; 100,000 rows or 1 MiB of text at most). Older formats (`.ppt`, `.xls`,
+   `.xlsm`) are not read.
 
    **Block patterns waiting for you** are shown in one approval panel: 8 per page, the ones that would have blocked
    the most logged calls first, a filter over pattern, reason and example, and bulk accept or reject of the selected
@@ -232,9 +235,10 @@ Redirects) and Maintenance (Setup audit, Startup).
    folder (or the nearest audited parent) without auditing again, and fails with what to do when none is stored. On
    its first `smart_search` of a session, and once per folder, the agent also gets one short line (under 100 tokens)
    when the stored report holds errors or warnings; a clean report adds nothing. Optionally, **Report at session
-   start (Claude Code)** on the Setup audit page moves that line to the start of every new session: it previews the
-   exact SessionStart entry, adds it to `~/.claude/settings.json` only after you confirm (backup first), and **Turn
-   off** removes only that entry. It is off by default; while it is on, the search no longer repeats the line. The
+   start** on the Setup audit page (Claude Code or Codex) moves that line to the start of every new session: it
+   previews the exact SessionStart entry, adds it to `~/.claude/settings.json` or `~/.codex/hooks.json` only after you
+   confirm (backup first), and **Turn off** removes only that entry. Codex runs a new hook only after you approve it in
+   `/hooks`; until then the page shows "waiting for your approval" and the search keeps repeating the line. It is off by default; while it is on, the search no longer repeats the line. The
    hook script (`hooks/session_audit.py`) only reads the stored report from the running service and prints nothing
    when the service is down.
 4. **Local models** (optional): if the mcp-memory embedding sidecar is installed on the machine, its local embedder

package/client_hooks.py

@@ -1,9 +1,11 @@
+import hashlib
 import json
 import os
 import secrets
 import shutil
 import sys
 import time
+import tomllib
 
 import daemon_launcher
 import endpoint_sync
@@ -14,6 +16,9 @@ AUDIT_SCRIPT = os.path.join(os.path.dirname(os.path.abspath(__file__)), "hooks",
 AUDIT_MARKER = "session_audit.py"
 AUDIT_MATCHER = "startup|resume|clear"
 AUDIT_TIMEOUT_S = 10
+AUDIT_CLIENTS = ("claude", "codex")
+AUDIT_ON = "current"
+AUDIT_WAITING = "waiting_approval"
 HTTP_PATH = "/hooks/pretool"
 POST_PATH = "/hooks/posttool"
 # A redirected shell search waits for its answer in the PreToolUse (smart_tool_daemon.HOOK_SHELL_BUDGET_S).
@@ -282,9 +287,16 @@ def _audit_entry():
                        "timeout": AUDIT_TIMEOUT_S}]}
 
 
-def _audit_plan():
-    """(path, data, groups) of Claude Code's settings with our SessionStart entry already removed from groups."""
-    path = os.path.realpath(CLIENTS["claude"]["files"][0])
+def _audit_client(client):
+    """The client's config spec; only Claude Code and Codex fire a SessionStart hook whose output the model reads."""
+    if client not in AUDIT_CLIENTS:
+        raise ValueError(f"The session-start audit report is only available for Claude Code or Codex, not {client!r}.")
+    return CLIENTS[client]
+
+
+def _audit_plan(client="claude"):
+    """(path, data, groups) of the client's hooks file with our SessionStart entry already removed from groups."""
+    path = os.path.realpath(_audit_client(client)["files"][0])
     try:
         with open(path, encoding="utf-8") as stream:
             data = json.load(stream)
@@ -299,10 +311,52 @@ def _audit_plan():
     return path, data, groups
 
 
-def audit_state():
-    """The SessionStart audit hook in Claude Code's settings: `current` (our entry equals this version's), `outdated`
-    (an entry of ours that differs) or `missing`."""
-    path = CLIENTS["claude"]["files"][0]
+def _codex_hash(event, group, index=0):
+    """Codex's approval hash (`sha256:` of the key-sorted compact JSON of the normalized hook identity, as in
+    openai/codex hooks/src/engine/discovery.rs `hook_hash`) of the handler at `index` in a hooks.json group."""
+    handler = group["hooks"][index]
+    normalized = {"type": handler["type"], "command": handler["command"], "timeout": handler.get("timeout", 600),
+                  "async": bool(handler.get("async", False))}
+    if handler.get("statusMessage") is not None:
+        normalized["statusMessage"] = handler["statusMessage"]
+    identity = {"event_name": event, "hooks": [normalized]}
+    if group.get("matcher") is not None:
+        identity["matcher"] = group["matcher"]
+    text = json.dumps(identity, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
+    return "sha256:" + hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+
+def _codex_approved(groups):
+    """Our SessionStart handler is trusted in Codex's config.toml: the entry keyed by hooks.json path, event, group
+    and handler index holds the hash of the definition as it is now (a missing or different hash means /hooks has not
+    approved it, so Codex does not run it). An unreadable config.toml raises ValueError."""
+    spec = CLIENTS["codex"]
+    try:
+        with open(spec["files"][1], encoding="utf-8") as stream:
+            hooks = tomllib.loads(stream.read()).get("hooks")
+            states = hooks.get("state") if isinstance(hooks, dict) else None
+            states = states if isinstance(states, dict) else {}
+    except FileNotFoundError:
+        return False
+    except tomllib.TOMLDecodeError as exc:
+        raise ValueError(f"{spec['files'][1]} is not valid TOML: {exc}")
+    paths = {spec["files"][0], os.path.realpath(spec["files"][0])}
+    for group_index, group in enumerate(groups):
+        if not _ours(group, _audit_hook):
+            continue
+        handler_index = next(i for i, hook in enumerate(group["hooks"]) if _audit_hook(hook))
+        for path in paths:
+            trusted = (states.get(f"{path}:session_start:{group_index}:{handler_index}") or {}).get("trusted_hash")
+            if trusted == _codex_hash("session_start", group, handler_index):
+                return True
+    return False
+
+
+def audit_state(client="claude"):
+    """The SessionStart audit hook in the client's hooks file: `current` (our entry equals this version's and, in
+    Codex, was approved in /hooks), `waiting_approval` (Codex only: written but not approved, so it does not run yet),
+    `outdated` (an entry of ours that differs) or `missing`."""
+    path = _audit_client(client)["files"][0]
     try:
         with open(path, encoding="utf-8") as stream:
             data = json.load(stream)
@@ -312,52 +366,61 @@ def audit_state():
     found = [group for group in groups if _ours(group, _audit_hook)] if isinstance(groups, list) else []
     if not found:
         return "missing"
-    return "current" if _audit_entry() in found else "outdated"
+    if _audit_entry() not in found:
+        return "outdated"
+    return "current" if client != "codex" or _codex_approved(groups) else AUDIT_WAITING
 
 
 def audit_hook_installed(client):
-    """The Claude Code session-start audit report is on, so a search need not repeat it. An unreadable settings file
-    counts as off here; `audit_state` raises for it on the setup screen."""
-    if client != "claude":
+    """The session-start audit report is on and running (Codex: approved in /hooks), so a search need not repeat it.
+    An unreadable config file counts as off here; `audit_state` raises for it on the setup screen."""
+    if client not in AUDIT_CLIENTS:
         return False
     try:
-        return audit_state() == "current"
+        return audit_state(client) == "current"
     except (OSError, ValueError):
         return False
 
 
-def audit_preview():
-    """The change that turns the SessionStart audit report on in Claude Code, with a token for `audit_install`."""
-    path, _data, _groups = _audit_plan()
+def _audit_after(client):
+    """{after_install: ...} for a client whose new hooks need the user's approval, else nothing."""
+    note = CLIENTS[client].get("after_install")
+    return {"after_install": note} if note else {}
+
+
+def audit_preview(client="claude"):
+    """The change that turns the SessionStart audit report on in the client, with a token for `audit_install`."""
+    path, _data, _groups = _audit_plan(client)
     entry = _audit_entry()
-    if audit_state() == "current":
+    if audit_state(client) in (AUDIT_ON, AUDIT_WAITING):
         return {"installed": True, "file": path, "change": None}
     token = secrets.token_urlsafe(12)
-    _PREVIEWS[token] = {"client": "audit", "at": time.time()}
+    _PREVIEWS[token] = {"client": f"audit:{client}", "at": time.time()}
     return {"installed": False, "file": path, "event": "SessionStart", "change": entry, "token": token,
-            "expires_s": PREVIEW_TTL_S}
+            "expires_s": PREVIEW_TTL_S, **_audit_after(client)}
 
 
-def audit_install(token, confirm):
-    """Writes the SessionStart audit entry into Claude Code's settings with a backup; needs the `audit_preview` token
-    (10 min) and confirm=True. Returns {installed, changed, file, backup}."""
+def audit_install(token, confirm, client="claude"):
+    """Writes the SessionStart audit entry into the client's hooks file with a backup; needs the `audit_preview` token
+    (10 min) and confirm=True. Returns {installed, changed, file, backup}, plus `after_install` in Codex: the hook
+    runs only after the user approves it in /hooks."""
     planned = _PREVIEWS.pop(token or "", None)
-    if confirm is not True or not planned or planned["client"] != "audit" or time.time() - planned["at"] > PREVIEW_TTL_S:
+    if confirm is not True or not planned or planned["client"] != f"audit:{client}" or time.time() - planned["at"] > PREVIEW_TTL_S:
         raise ValueError("Turning the audit report on requires the preview token (valid for 10 min) and confirm=true.")
-    path, data, groups = _audit_plan()
-    if audit_state() == "current":
+    path, data, groups = _audit_plan(client)
+    if audit_state(client) in (AUDIT_ON, AUDIT_WAITING):
         return {"installed": True, "changed": False, "file": path}
     groups.append(_audit_entry())
-    backup = _write_checked(path, data, lambda: audit_state() == "current", "The audit hook")
-    return {"installed": True, "changed": True, "file": path, "backup": backup}
+    backup = _write_checked(path, data, lambda: audit_state(client) in (AUDIT_ON, AUDIT_WAITING), "The audit hook")
+    return {"installed": True, "changed": True, "file": path, "backup": backup, **_audit_after(client)}
 
 
-def audit_remove():
-    """Takes only our SessionStart entry out of Claude Code's settings (after a backup); nothing else is touched."""
-    path, data, groups = _audit_plan()
-    if audit_state() == "missing":
+def audit_remove(client="claude"):
+    """Takes only our SessionStart entry out of the client's hooks file (after a backup); nothing else is touched."""
+    path, data, groups = _audit_plan(client)
+    if audit_state(client) == "missing":
         return {"installed": False, "changed": False, "file": path}
     if not groups:
         del data["hooks"]["SessionStart"]
-    backup = _write_checked(path, data, lambda: audit_state() == "missing", "The removal")
+    backup = _write_checked(path, data, lambda: audit_state(client) == "missing", "The removal")
     return {"installed": False, "changed": True, "file": path, "backup": backup}

package/config.py

@@ -62,7 +62,7 @@ DOC_MODES = ("require", "remind", "off")
 # Edit hook on functions that copy one already indexed (exact or near-identical body): warn = let the edit run and
 # point to the existing function; off = say nothing. Never blocks: near matches are leads, not defects.
 DUPLICATE_MODES = ("warn", "off")
-# Edit hook on package.json: warn = let the edit run and list the added or changed dependencies that have OSV advisories;
+# Edit hook on package.json, requirements*.txt and go.mod: warn = let the edit run and list the added or changed dependencies that have OSV advisories;
 # off = say nothing and make no network call.
 DEPENDENCY_MODES = ("warn", "off")
 # Router model reviewing, in the background, searches the deterministic redirect rule let run: on = propose block

package/dependency_notice.py

@@ -1,10 +1,12 @@
-"""Vulnerable-dependency notice for an edit of package.json, built before the edit runs.
+"""Vulnerable-dependency notice for an edit of a dependency manifest, built before the edit runs.
 
-Compares the dependency tables of the file before and after the edit, asks OSV (one `querybatch` call, short timeout)
-about the added or changed ones only, and answers from a disk cache of (package, version) -> advisory IDs for 6 hours.
-Only package names and versions leave the machine. The caller (`hook_decision`) turns a `DependencyCheckError` into
+Manifests: package.json (OSV ecosystem npm), requirements*.txt (PyPI: `==` pins and the lower bound of `>=` and `~=`)
+and go.mod (Go: `require` lines with a plain vX.Y.Z). Compares the dependencies of the file before and after the edit,
+asks OSV (one `querybatch` call, short timeout) about the added or changed ones only, and answers from a disk cache of
+(ecosystem, package, version) -> advisory IDs for 6 hours. Only package names and versions leave the machine. The caller (`hook_decision`) turns a `DependencyCheckError` into
 "dependency check skipped: <reason>" and lets the edit go on.
 """
+import collections
 import json
 import os
 import re
@@ -23,13 +25,17 @@ TABLES = ("dependencies", "devDependencies", "peerDependencies", "optionalDepend
 PREFIX = "Smart Tool dependencies: "
 _SPECIFIER_RE = re.compile(r"(\^|~|>=|>|=)?\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?"
                            r"((?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)")
+_REQUIREMENTS_FILE_RE = re.compile(r"requirements[A-Za-z0-9._-]*\.txt")
+_REQUIREMENT_RE = re.compile(r"([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*([^;]*)")
+_PIP_VERSION_RE = re.compile(r"[0-9][0-9A-Za-z.+!_-]*")
+_GO_VERSION_RE = re.compile(r"v\d+\.\d+\.\d+")
 
 
 class DependencyCheckError(RuntimeError):
     """The check could not run (OSV unreachable or answering badly, unreadable cache, current file not JSON)."""
 
 
-def _tables(text):
+def _npm_pairs(text):
     """The (name, specifier) pairs of every dependency table in a package.json text.
 
     Parameters: text (str) file content.
@@ -49,32 +55,91 @@ def _tables(text):
     return pairs
 
 
-def changed_dependencies(before, after):
-    """Dependencies added or whose specifier changed between two package.json texts.
+def _requirements_pairs(text):
+    """The (name, specifier) pairs of a requirements.txt text; options, includes, editable and URL lines are skipped.
 
-    Parameters: before (str or None) text before the edit, None when the file did not exist; after (str) text after.
-    Returns: list of (name, specifier); empty when `after` is not valid JSON (the user is mid-edit).
-    Raises: DependencyCheckError when `before` exists but is not valid JSON.
+    Parameters: text (str) file content.
+    Returns: dict (name, specifier) -> None in file order; the specifier is the version clauses without spaces ("" when
+    the line only names the package).
+    """
+    pairs = {}
+    for raw in text.splitlines():
+        line = raw.split(" #")[0].split(";")[0].strip().rstrip("\\").strip()
+        if not line or line.startswith(("#", "-")):
+            continue
+        line = " ".join(word for word in line.split() if not word.startswith("--"))
+        match = _REQUIREMENT_RE.fullmatch(line)
+        if not match:
+            continue
+        specifier = "".join(match.group(2).split())
+        if specifier and specifier[0] not in "=<>!~":
+            continue
+        pairs[(match.group(1), specifier)] = None
+    return pairs
+
+
+def _go_pairs(text):
+    """The (module, version) pairs of the `require` lines of a go.mod text, single-line and block; replace, exclude and
+    the other directives are skipped.
+
+    Parameters: text (str) file content.
+    Returns: dict (module, version) -> None in file order.
     """
-    now = _tables(after)
+    pairs, block = {}, None
+    for raw in text.splitlines():
+        tokens = raw.split("//")[0].split()
+        if not tokens:
+            continue
+        if block is None:
+            if tokens[0] == "require" and len(tokens) == 3:
+                pairs[(tokens[1], tokens[2])] = None
+            elif tokens[-1] == "(":
+                block = tokens[0]
+        elif tokens == [")"]:
+            block = None
+        elif block == "require" and len(tokens) == 2:
+            pairs[(tokens[0], tokens[1])] = None
+    return pairs
+
+
+def ecosystem_of(path):
+    """The OSV ecosystem of a manifest file name.
+
+    Parameters: path (str) file path.
+    Returns: "npm" for package.json, "PyPI" for requirements*.txt, "Go" for go.mod; None for any other file.
+    """
+    name = os.path.basename(path)
+    if name == "package.json":
+        return "npm"
+    if name == "go.mod":
+        return "Go"
+    return "PyPI" if _REQUIREMENTS_FILE_RE.fullmatch(name) else None
+
+
+def changed_dependencies(before, after, ecosystem="npm"):
+    """Dependencies added or whose specifier changed between two manifest texts.
+
+    Parameters: before (str or None) text before the edit, None when the file did not exist; after (str) text after;
+    ecosystem (str) one of ECOSYSTEMS.
+    Returns: list of (name, specifier); empty when `after` is a package.json that is not valid JSON (mid-edit).
+    Raises: DependencyCheckError when `before` exists but is a package.json that is not valid JSON.
+    """
+    parse = _ECOSYSTEMS[ecosystem].parse
+    now = parse(after)
     if now is None:
         return []
     if before is None or not before.strip():
         old = {}
     else:
-        old = _tables(before)
+        old = parse(before)
         if old is None:
             raise DependencyCheckError("current package.json is not valid JSON")
     return [pair for pair in now if pair not in old]
 
 
-def queried_version(specifier):
-    """The version to ask OSV about for a specifier.
-
-    Parameters: specifier (str) the value in the dependency table.
-    Returns: str, the exact version or the lower bound of a ^, ~, >= or > range; None when the specifier cannot be
-    reduced safely (tags, `*`, URLs, file:, git, workspace:, npm: aliases, x-ranges, compound ranges).
-    """
+def _npm_version(specifier):
+    """The npm case of `queried_version`: the exact version or the lower bound of a ^, ~, >= or > range; None for tags,
+    `*`, URLs, file:, git, workspace:, npm: aliases, x-ranges and compound ranges."""
     match = _SPECIFIER_RE.fullmatch(specifier.strip())
     if not match:
         return None
@@ -87,6 +152,42 @@ def queried_version(specifier):
     return ".".join(parts) + (tail or "")
 
 
+def _pip_version(specifier):
+    """The PyPI case of `queried_version`: the `==` version, else the first `>=` or `~=` lower bound; None for no
+    specifier, `===`, wildcards, `<`, `>`, `!=` alone and anything that is not a version."""
+    clauses = specifier.split(",")
+    for operators in (("==",), (">=", "~=")):
+        for clause in clauses:
+            for operator in operators:
+                if clause.startswith(operator) and _PIP_VERSION_RE.fullmatch(clause[len(operator):]):
+                    return clause[len(operator):]
+    return None
+
+
+def _go_version(specifier):
+    """The Go case of `queried_version`: a plain vX.Y.Z; None for pseudo-versions, pre-releases and +incompatible."""
+    return specifier if _GO_VERSION_RE.fullmatch(specifier) else None
+
+
+def queried_version(specifier, ecosystem="npm"):
+    """The version to ask OSV about for a specifier.
+
+    Parameters: specifier (str) the value in the dependency table; ecosystem (str) one of ECOSYSTEMS.
+    Returns: str, the exact version or the lower bound of the range; None when the specifier cannot be reduced safely.
+    """
+    return _ECOSYSTEMS[ecosystem].version(specifier)
+
+
+_Ecosystem = collections.namedtuple("_Ecosystem", "parse version label exact")
+_ECOSYSTEMS = {
+    "npm": _Ecosystem(_npm_pairs, _npm_version, lambda name, spec: f"{name}@{spec}", lambda spec, version: spec == version),
+    "PyPI": _Ecosystem(_requirements_pairs, _pip_version, lambda name, spec: f"{name}{spec}",
+                       lambda spec, version: spec == "==" + version),
+    "Go": _Ecosystem(_go_pairs, _go_version, lambda name, spec: f"{name}@{spec}", lambda spec, version: spec == version),
+}
+ECOSYSTEMS = tuple(_ECOSYSTEMS)
+
+
 def _load_cache():
     """The cache as {"name@version": {"ids": [...], "at": epoch}}; empty when the file does not exist.
 
@@ -111,26 +212,27 @@ def _fresh_ids(entry, now):
     return entry["ids"] if now - entry["at"] < CACHE_TTL_S else None
 
 
-def _advisories(queries):
+def _advisories(ecosystem, queries):
     """Advisory IDs for (name, version) pairs, from the cache and one OSV batch for the rest.
 
-    Parameters: queries (list of (name, version)).
+    Parameters: ecosystem (str) one of ECOSYSTEMS; queries (list of (name, version)).
     Returns: tuple (list of IDs or None per query in order, str cache-write problem or "").
     Raises: DependencyCheckError when the cache is corrupt or OSV cannot answer.
     """
     cache, now = _load_cache(), time.time()
-    found = {query: _fresh_ids(cache.get("@".join(query)), now) for query in queries}
+    key = lambda query: f"{ecosystem}:{query[0]}@{query[1]}"  # noqa: E731
+    found = {query: _fresh_ids(cache.get(key(query)), now) for query in queries}
     missing = [query for query in queries if found[query] is None]
     if not missing:
         return [found[query] for query in queries], ""
     try:
-        answered = freshness.npm_advisories_batch(missing, OSV_TIMEOUT_S)
+        answered = freshness.advisories_batch(ecosystem, missing, OSV_TIMEOUT_S)
     except RuntimeError as exc:
         raise DependencyCheckError(str(exc)) from exc
     for query, ids in zip(missing, answered):
         found[query] = ids
         if ids is not None:
-            cache["@".join(query)] = {"ids": ids, "at": now}
+            cache[key(query)] = {"ids": ids, "at": now}
     cache = {key: entry for key, entry in cache.items() if _fresh_ids(entry, now) is not None}
     try:
         os.makedirs(os.path.dirname(CACHE_PATH), exist_ok=True)
@@ -140,28 +242,30 @@ def _advisories(queries):
     return [found[query] for query in queries], ""
 
 
-def notice(before, after):
-    """The dependency notice for one package.json edit.
+def notice(before, after, ecosystem="npm"):
+    """The dependency notice for one manifest edit.
 
-    Parameters: before (str or None) file text before the edit; after (str) text after it.
+    Parameters: before (str or None) file text before the edit; after (str) text after it; ecosystem (str) one of
+    ECOSYSTEMS, from `ecosystem_of`.
     Returns: str, "Smart Tool dependencies: ..." lines for the changed dependencies that have advisories or could not
     be verified, "" when there is nothing to say.
     Raises: DependencyCheckError when the check could not run.
     """
-    changed = changed_dependencies(before, after)
+    spec = _ECOSYSTEMS[ecosystem]
+    changed = changed_dependencies(before, after, ecosystem)
     handled, extra = changed[:MAX_PACKAGES], len(changed) - MAX_PACKAGES
     lines, queries = {}, []
     for name, specifier in handled:
-        version = queried_version(specifier) if freshness.NPM_NAME_RE.fullmatch(name) else None
+        version = spec.version(specifier) if freshness.NAME_RES[ecosystem].fullmatch(name) else None
         if version is None:
-            lines[(name, specifier)] = f"`{name}@{specifier}` specifier not verified."
+            lines[(name, specifier)] = f"`{spec.label(name, specifier)}` specifier not verified."
         else:
             queries.append((name, specifier, version))
     problem = ""
     if queries:
-        ids, problem = _advisories([(name, version) for name, _specifier, version in queries])
+        ids, problem = _advisories(ecosystem, [(name, version) for name, _specifier, version in queries])
         for (name, specifier, version), advisories in zip(queries, ids):
-            label = f"`{name}@{specifier}`" + ("" if version == specifier else f" (checked {version})")
+            label = f"`{spec.label(name, specifier)}`" + ("" if spec.exact(specifier, version) else f" (checked {version})")
             if advisories is None:
                 lines[(name, specifier)] = f"{label} advisory check incomplete, not verified."
             elif advisories: