@opensip-tools/checks-python 1.0.4

package/.turbo/turbo-typecheck.log

@@ -0,0 +1,4 @@
+
+> @opensip-tools/checks-python@1.0.4 typecheck /Users/sb/Documents/Code/opensip-ai/opensip-tools/packages/fitness/checks-python
+> tsc --noEmit
+

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 opensip-ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@opensip-tools/checks-python",
+  "version": "1.0.4",
+  "license": "MIT",
+  "description": "Python fitness checks for opensip-tools",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/opensip-ai/opensip-tools.git",
+    "directory": "packages/fitness/checks-python"
+  },
+  "homepage": "https://github.com/opensip-ai/opensip-tools",
+  "bugs": {
+    "url": "https://github.com/opensip-ai/opensip-tools/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "dependencies": {
+    "@opensip-tools/fitness": "1.0.4"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "vitest": "^2.1.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run --passWithNoTests",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  }
+}

package/src/__tests__/analyze.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+
+import { analyzeBareExcept } from '../checks/no-bare-except.js';
+
+describe('analyzeBareExcept', () => {
+  it('flags a bare except:', () => {
+    const out = analyzeBareExcept('try:\n    foo()\nexcept:\n    pass\n');
+    expect(out).toHaveLength(1);
+    expect(out[0]?.severity).toBe('warning');
+    expect(out[0]?.line).toBe(3);
+  });
+
+  it('flags a bare except : with whitespace before the colon', () => {
+    const out = analyzeBareExcept('try:\n    foo()\nexcept :\n    pass\n');
+    expect(out).toHaveLength(1);
+  });
+
+  it('does not flag a typed except', () => {
+    expect(analyzeBareExcept('try:\n    foo()\nexcept Exception:\n    pass\n')).toHaveLength(0);
+  });
+
+  it('does not flag except with parentheses (multi-type)', () => {
+    expect(analyzeBareExcept('try:\n    foo()\nexcept (KeyError, ValueError):\n    pass\n')).toHaveLength(0);
+  });
+
+  it('flags multiple bare excepts in the same file', () => {
+    const src = 'try:\n  a()\nexcept:\n  pass\ntry:\n  b()\nexcept:\n  pass\n';
+    const out = analyzeBareExcept(src);
+    expect(out).toHaveLength(2);
+  });
+
+  it('returns an empty list for code without except clauses', () => {
+    expect(analyzeBareExcept('def foo(): return 1\n')).toEqual([]);
+  });
+
+  it('respects leading indentation (nested try)', () => {
+    const src = 'def f():\n    try:\n        a()\n    except:\n        pass\n';
+    const out = analyzeBareExcept(src);
+    expect(out).toHaveLength(1);
+    expect(out[0]?.line).toBe(4);
+  });
+});

package/src/__tests__/no-bare-except.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest'
+
+import { analyzeBareExcept } from '../checks/no-bare-except.js'
+
+describe('analyzeBareExcept', () => {
+  it('flags `except:` on its own line', () => {
+    const src = `try:
+    risky()
+except:
+    pass`
+    const violations = analyzeBareExcept(src)
+    expect(violations.length).toBe(1)
+    expect(violations[0]?.message).toContain('Bare')
+    expect(violations[0]?.line).toBe(3)
+  })
+
+  it('does not flag `except Exception:`', () => {
+    const src = `try:
+    risky()
+except Exception:
+    pass`
+    const violations = analyzeBareExcept(src)
+    expect(violations.length).toBe(0)
+  })
+
+  it('does not flag `except (TypeError, ValueError):`', () => {
+    const src = `try:
+    risky()
+except (TypeError, ValueError):
+    pass`
+    const violations = analyzeBareExcept(src)
+    expect(violations.length).toBe(0)
+  })
+
+  it('does not flag `except Exception as e:`', () => {
+    const src = `try:
+    risky()
+except Exception as e:
+    log(e)`
+    const violations = analyzeBareExcept(src)
+    expect(violations.length).toBe(0)
+  })
+
+  it('reports correct line number for indented bare except', () => {
+    const src = `def fn():
+    try:
+        risky()
+    except:
+        pass`
+    const violations = analyzeBareExcept(src)
+    expect(violations.length).toBe(1)
+    expect(violations[0]?.line).toBe(4)
+  })
+
+  it('flags multiple bare excepts independently', () => {
+    const src = `try:
+    a()
+except:
+    pass
+try:
+    b()
+except:
+    pass`
+    const violations = analyzeBareExcept(src)
+    expect(violations.length).toBe(2)
+    expect(violations[0]?.line).toBe(3)
+    expect(violations[1]?.line).toBe(7)
+  })
+
+  it('tolerates whitespace between `except` and `:`', () => {
+    const src = `try:
+    a()
+except :
+    pass`
+    const violations = analyzeBareExcept(src)
+    expect(violations.length).toBe(1)
+  })
+})

package/src/checks/no-bare-except.ts

@@ -0,0 +1,54 @@
+/**
+ * @fileoverview Flag bare `except:` clauses in Python.
+ *
+ * A bare `except:` catches every exception, including ones that are
+ * usually meant to propagate — KeyboardInterrupt, SystemExit, and any
+ * subclass of BaseException. This makes programs harder to terminate
+ * and hides bugs. The Python style guide and most lint tools (ruff
+ * E722, pylint W0702) flag this. Always specify what you're catching,
+ * even if it's just `except Exception:`.
+ *
+ * Detection is line-pattern based: a line whose first non-whitespace
+ * characters are `except:` (with optional whitespace before the colon).
+ * The check uses `strip-strings` content filtering so a literal like
+ * `"except:"` inside a docstring or string doesn't false-fire.
+ */
+import { defineCheck, type CheckViolation } from '@opensip-tools/fitness'
+
+// eslint-disable-next-line sonarjs/slow-regex -- anchored, bounded line scan; \s* on bounded leading whitespace is safe
+const BARE_EXCEPT_PATTERN = /^\s*except\s*:/gm
+
+/**
+ * Pure analysis function. Exported so unit tests can exercise the
+ * detection logic without standing up the full Check framework.
+ */
+export function analyzeBareExcept(content: string): CheckViolation[] {
+  const violations: CheckViolation[] = []
+  BARE_EXCEPT_PATTERN.lastIndex = 0
+  let match: RegExpExecArray | null
+  while ((match = BARE_EXCEPT_PATTERN.exec(content)) !== null) {
+    // Compute 1-based line number from match index.
+    const upto = content.slice(0, match.index)
+    const line = upto.split('\n').length
+    violations.push({
+      message: 'Bare `except:` catches BaseException — including KeyboardInterrupt and SystemExit',
+      severity: 'warning',
+      line,
+      suggestion: 'Catch a specific exception (e.g. `except Exception:` or a narrower type)',
+    })
+  }
+  return violations
+}
+
+export const noBareExcept = defineCheck({
+  id: 'b1c2d3e4-9876-4321-bbbb-200000000001',
+  slug: 'python-no-bare-except',
+  description: 'Bare except clauses catch system-exiting exceptions like KeyboardInterrupt',
+  scope: { languages: ['python'], concerns: [] },
+  tags: ['quality', 'python'],
+  // Use 'strip-strings' so a literal `"except:"` inside a string is
+  // not matched. Comments are still visible — but `# except:` won't
+  // match the leading-whitespace anchor since `#` is in the way.
+  contentFilter: 'strip-strings',
+  analyze: (content) => analyzeBareExcept(content),
+})

package/src/index.ts

@@ -0,0 +1,12 @@
+import { noBareExcept } from './checks/no-bare-except.js'
+
+export const checks = [noBareExcept] as const
+
+
+export const metadata = {
+  name: '@opensip-tools/checks-python',
+  version: '0.6.1',
+  description: 'Python fitness checks',
+}
+
+export {noBareExcept} from './checks/no-bare-except.js'

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}

package/vitest.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from 'vitest/config';
+export default defineConfig({
+  test: {
+    include: ['src/**/*.test.ts'],
+    coverage: {
+      include: ['src/**'],
+      exclude: ['src/**/*.test.ts', 'src/**/__tests__/**', 'src/index.ts'],
+    },
+  },
+});