agent-code-guard 0.2.0__tar.gz → 0.3.1__tar.gz

{agent_code_guard-0.2.0/src/agent_code_guard.egg-info → agent_code_guard-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-code-guard
-Version: 0.2.0
+Version: 0.3.1
 Summary: Deterministic cross-language guardrails for agent-assisted development
 License-Expression: MIT
 Project-URL: Source, https://github.com/stef-k/agent-code-guard
@@ -82,16 +82,28 @@ environment, uv, and developer alternatives.
 
 Copy this prompt to a coding agent:
 
-> Consult the official Agent Code Guard repository and documentation. Install
-> the published distribution in an isolated supported way, preferably with
-> pipx; verify `code-guard --version` and run `code-guard doctor`. Locate the
-> installed version-matched skill with `code-guard --skill-path`, and use or
-> export only that skill through the documented mechanism. Inspect this
-> repository without creating a LOC baseline and use changed-work scope. Ask
-> before exporting into a persistent skill directory, changing persistent
-> agent or platform configuration, or configuring hooks.
-> Never weaken thresholds, exclusions, configuration, or baselines merely to
-> silence findings.
+> Adopt Agent Code Guard for this repository using the official project and
+> documentation at https://github.com/stef-k/agent-code-guard. This prompt
+> authorizes installing the published distribution in an isolated supported
+> way, preferably with `pipx install agent-code-guard`, and persistently
+> activating or exporting its installed, version-matched skill for the current
+> agent environment. Verify `code-guard --version` and run `code-guard doctor`,
+> then locate the skill with `code-guard --skill-path`. Follow the
+> [skill activation guide](https://github.com/stef-k/agent-code-guard/blob/main/docs/skill-distribution.md):
+> activate that installed path when the platform supports it, or export it with
+> `code-guard --export-skill <target-directory>` to the platform's documented
+> skill directory. Do not guess a target or overwrite an existing export; verify
+> that `.agent-code-guard-version` matches the installed distribution. Follow the
+> [agent workflow](https://github.com/stef-k/agent-code-guard/blob/main/docs/agent-workflow.md)
+> without creating a LOC baseline. After meaningful source or Markdown edits, run
+> `code-guard . --changed-only --json --json-mode compact`; outside Git, pass the
+> exact edited files. Inspect REVIEW and FAIL findings, make only genuine
+> improvements, rerun the check, and report the result. Never weaken thresholds,
+> exclusions, configuration, or baselines merely to silence findings. Code Guard
+> does not install or enable hooks by default. Ask before configuring a post-edit
+> or post-turn hook, or making unrelated persistent agent or platform changes.
+> Finish by reporting the installed version, doctor status, activated skill
+> location, first analysis result, and any REVIEW findings you accepted.
 
 ## Five-minute start
 
@@ -138,12 +150,14 @@ hook-assisted process.
   warranted; normally exit `1`.
 - **Completed FAIL** — blocks normal completion until fixed or an explicitly
   authorized exception applies; exit `2` with a completed report on stdout.
+- **INCOMPLETE** — one or more requested syntax analyses are unavailable;
+  independent completed findings remain authoritative, but the run exits `3`.
 - An argparse usage or invalid-choice error exits `2`, writes usage/error text
   to stderr, and produces no completed report.
-- Other Code Guard tool, configuration, scope, or provider errors exit `3`.
+- Other Code Guard tool, configuration, scope, or unexpected errors exit `3`.
 
 `--ci` makes REVIEW nonblocking at the process level by changing its exit to
-`0`; it does not hide the findings or change FAIL and tool-error exits.
+`0`; it does not hide findings or change FAIL, INCOMPLETE, and tool-error exits.
 
 **Never game a metric.** Do not create artificial helpers, files,
 abstractions, formatting, exclusions, or policy changes merely to lower a
@@ -175,6 +189,12 @@ result, scope, required policies, guards, ordering, and actionable findings.
 Named modes require `--json`. See [Usage](https://github.com/stef-k/agent-code-guard/blob/main/docs/usage.md) for the schema and
 option contract.
 
+Known per-file syntax or provider failures instead produce `overall:
+"incomplete"`, ordered structured `unavailable` records, and completed guard
+evidence. Syntax guards identify unavailable paths; LOC and Markdown remain
+complete. Full, debug, and compact JSON retain unavailable records unchanged,
+and completed runs retain their existing schema.
+
 ### Common scope commands
 
 ```bash
@@ -200,7 +220,8 @@ Markdown guards apply to `.md` files.
 Generic `.h` files are not syntax-dispatched; `.markdown` is not enabled; Vue
 template and style regions are not executable syntax input; and unsupported
 artifacts are inapplicable. Malformed applicable syntax or a required provider
-failure is a fail-closed tool error. See [Language support](https://github.com/stef-k/agent-code-guard/blob/main/docs/language-support.md).
+failure is unavailable evidence, distinct from both an inapplicable file and a
+completed FAIL finding. See [Language support](https://github.com/stef-k/agent-code-guard/blob/main/docs/language-support.md).
 
 ### Skill integration
 
@@ -221,6 +242,9 @@ Built-in defaults require no configuration. Configure a project only for a
 concrete policy reason; see the [configuration guide](https://github.com/stef-k/agent-code-guard/blob/main/docs/configuration.md).
 The LOC baseline is an explicit adoption tool for established legacy
 repositories, not an ordinary-use requirement or a way to silence findings.
+Its default `ratchetAt: "fail"` policy freezes files above `failAt`; choose
+`ratchetAt: "review"` only when every established file above `warnAt` must be
+non-increasing while ordinary findings in that range remain REVIEW.
 
 ## Trust, CI, and platform support
 

{agent_code_guard-0.2.0 → agent_code_guard-0.3.1}/README.md

@@ -68,16 +68,28 @@ environment, uv, and developer alternatives.
 
 Copy this prompt to a coding agent:
 
-> Consult the official Agent Code Guard repository and documentation. Install
-> the published distribution in an isolated supported way, preferably with
-> pipx; verify `code-guard --version` and run `code-guard doctor`. Locate the
-> installed version-matched skill with `code-guard --skill-path`, and use or
-> export only that skill through the documented mechanism. Inspect this
-> repository without creating a LOC baseline and use changed-work scope. Ask
-> before exporting into a persistent skill directory, changing persistent
-> agent or platform configuration, or configuring hooks.
-> Never weaken thresholds, exclusions, configuration, or baselines merely to
-> silence findings.
+> Adopt Agent Code Guard for this repository using the official project and
+> documentation at https://github.com/stef-k/agent-code-guard. This prompt
+> authorizes installing the published distribution in an isolated supported
+> way, preferably with `pipx install agent-code-guard`, and persistently
+> activating or exporting its installed, version-matched skill for the current
+> agent environment. Verify `code-guard --version` and run `code-guard doctor`,
+> then locate the skill with `code-guard --skill-path`. Follow the
+> [skill activation guide](https://github.com/stef-k/agent-code-guard/blob/main/docs/skill-distribution.md):
+> activate that installed path when the platform supports it, or export it with
+> `code-guard --export-skill <target-directory>` to the platform's documented
+> skill directory. Do not guess a target or overwrite an existing export; verify
+> that `.agent-code-guard-version` matches the installed distribution. Follow the
+> [agent workflow](https://github.com/stef-k/agent-code-guard/blob/main/docs/agent-workflow.md)
+> without creating a LOC baseline. After meaningful source or Markdown edits, run
+> `code-guard . --changed-only --json --json-mode compact`; outside Git, pass the
+> exact edited files. Inspect REVIEW and FAIL findings, make only genuine
+> improvements, rerun the check, and report the result. Never weaken thresholds,
+> exclusions, configuration, or baselines merely to silence findings. Code Guard
+> does not install or enable hooks by default. Ask before configuring a post-edit
+> or post-turn hook, or making unrelated persistent agent or platform changes.
+> Finish by reporting the installed version, doctor status, activated skill
+> location, first analysis result, and any REVIEW findings you accepted.
 
 ## Five-minute start
 
@@ -124,12 +136,14 @@ hook-assisted process.
   warranted; normally exit `1`.
 - **Completed FAIL** — blocks normal completion until fixed or an explicitly
   authorized exception applies; exit `2` with a completed report on stdout.
+- **INCOMPLETE** — one or more requested syntax analyses are unavailable;
+  independent completed findings remain authoritative, but the run exits `3`.
 - An argparse usage or invalid-choice error exits `2`, writes usage/error text
   to stderr, and produces no completed report.
-- Other Code Guard tool, configuration, scope, or provider errors exit `3`.
+- Other Code Guard tool, configuration, scope, or unexpected errors exit `3`.
 
 `--ci` makes REVIEW nonblocking at the process level by changing its exit to
-`0`; it does not hide the findings or change FAIL and tool-error exits.
+`0`; it does not hide findings or change FAIL, INCOMPLETE, and tool-error exits.
 
 **Never game a metric.** Do not create artificial helpers, files,
 abstractions, formatting, exclusions, or policy changes merely to lower a
@@ -161,6 +175,12 @@ result, scope, required policies, guards, ordering, and actionable findings.
 Named modes require `--json`. See [Usage](https://github.com/stef-k/agent-code-guard/blob/main/docs/usage.md) for the schema and
 option contract.
 
+Known per-file syntax or provider failures instead produce `overall:
+"incomplete"`, ordered structured `unavailable` records, and completed guard
+evidence. Syntax guards identify unavailable paths; LOC and Markdown remain
+complete. Full, debug, and compact JSON retain unavailable records unchanged,
+and completed runs retain their existing schema.
+
 ### Common scope commands
 
 ```bash
@@ -186,7 +206,8 @@ Markdown guards apply to `.md` files.
 Generic `.h` files are not syntax-dispatched; `.markdown` is not enabled; Vue
 template and style regions are not executable syntax input; and unsupported
 artifacts are inapplicable. Malformed applicable syntax or a required provider
-failure is a fail-closed tool error. See [Language support](https://github.com/stef-k/agent-code-guard/blob/main/docs/language-support.md).
+failure is unavailable evidence, distinct from both an inapplicable file and a
+completed FAIL finding. See [Language support](https://github.com/stef-k/agent-code-guard/blob/main/docs/language-support.md).
 
 ### Skill integration
 
@@ -207,6 +228,9 @@ Built-in defaults require no configuration. Configure a project only for a
 concrete policy reason; see the [configuration guide](https://github.com/stef-k/agent-code-guard/blob/main/docs/configuration.md).
 The LOC baseline is an explicit adoption tool for established legacy
 repositories, not an ordinary-use requirement or a way to silence findings.
+Its default `ratchetAt: "fail"` policy freezes files above `failAt`; choose
+`ratchetAt: "review"` only when every established file above `warnAt` must be
+non-increasing while ordinary findings in that range remain REVIEW.
 
 ## Trust, CI, and platform support
 

{agent_code_guard-0.2.0 → agent_code_guard-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-code-guard"
-version = "0.2.0"
+version = "0.3.1"
 description = "Deterministic cross-language guardrails for agent-assisted development"
 readme = "README.md"
 requires-python = ">=3.10"

{agent_code_guard-0.2.0 → agent_code_guard-0.3.1}/skills/code-guard/SKILL.md

@@ -15,6 +15,7 @@ Code Guard provides deterministic measurements that act as anchors for agent jud
 - `PASS` — no special action is required.
 - `REVIEW` — inspect the finding and either accept it with a meaningful justification or improve the code when doing so improves real clarity, cohesion, or boundaries.
 - `FAIL` — do not declare normal completion until the condition is fixed or an explicitly permitted/user-approved exception applies.
+- `INCOMPLETE` — known per-file syntax or provider evidence is unavailable; retain and report independent completed evidence, but do not declare normal completion.
 
 ## Universal rules
 
@@ -50,10 +51,11 @@ python3 skills/code-guard/scripts/code_guard.py . --changed-only
 ```
 
 `pyproject.toml` canonically owns the production pins. Tree-sitter remains
-dormant during LOC-only execution; failure to load a required provider or
-grammar is a deterministic tool error during normal zero-config syntax analysis.
-Disabling every syntax guard preserves the lazy no-Tree-sitter path. A strictly
-LOC-only result also requires both Markdown guards to be explicitly disabled.
+dormant during LOC-only execution. A known per-file provider, grammar, or syntax
+failure produces blocking `INCOMPLETE` output while retaining independent LOC,
+Markdown, and unaffected syntax evidence. Disabling every syntax guard preserves
+the lazy no-Tree-sitter path. A strictly LOC-only result also requires both
+Markdown guards to be explicitly disabled.
 
 Without Git, pass exactly the files you created or modified. You are
 responsible for supplying the complete edited-file set:
@@ -75,8 +77,9 @@ project exclusions. LOC `--exclude` remains LOC-specific. Explicit files may
 intentionally inspect Git-ignored or built-in-pruned artifacts, unless Code
 Guard `scope.exclude` or `--scope-exclude` removes them.
 
-Inspect every REVIEW and FAIL. When all guards return `PASS`, no detailed
-policy file needs to be loaded.
+Inspect every REVIEW and FAIL. Treat INCOMPLETE as blocking, preserve its
+completed findings, and report its unavailable paths and failure context. When
+all guards return `PASS`, no detailed policy file needs to be loaded.
 
 When a guard returns `REVIEW` or `FAIL`, read only the policy file named by that finding. The runner returns required policy identifiers/files in both human-readable and JSON output.
 
@@ -103,10 +106,10 @@ code-guard . --changed-only --ci --json --json-mode compact
 ```
 
 `--ci` makes REVIEW exit `0`, but REVIEW remains visible and requires
-judgment; FAIL remains `2` and tool errors remain `3`. Outside Git, a hook
-must supply the exact edited files. Do not install hooks, export into persistent
-skill directories, or modify persistent user or repository configuration
-without authorization.
+judgment; FAIL remains `2`, and INCOMPLETE and tool errors remain `3`. Outside
+Git, a hook must supply the exact edited files. Do not install hooks, export
+into persistent skill directories, or modify persistent user or repository
+configuration without authorization.
 
 ## Scope
 

{agent_code_guard-0.2.0 → agent_code_guard-0.3.1}/skills/code-guard/references/loc-policy.md

@@ -27,6 +27,15 @@ Existing `allowedLargeFiles` entries may be honored with their configured reason
 
 Do not infer approval from inconvenience, historical size, a nearby exemption, time pressure, or a request to finish the coding task.
 
+## Source-controlled ratchets
+
+An established repository may use `guards.loc.ratchetAt: "fail"` (the default)
+to freeze only files already above `failAt`, or `"review"` to freeze every
+recorded file above `warnAt` while retaining ordinary REVIEW semantics within
+its allowance. Growth above a recorded allowance is always FAIL. Never switch
+the policy, raise thresholds, add exclusions or exemptions, or increase/remove
+allowances merely to silence growth.
+
 ## Do not game LOC
 
 Project formatting conventions take priority. Never combine independent statements, compress control flow or expressions unusually, minify handwritten code, remove useful comments/structure, or fight the formatter merely to lower physical LOC.

{agent_code_guard-0.2.0 → agent_code_guard-0.3.1}/src/agent_code_guard/analysis/adapters.py

@@ -116,11 +116,11 @@ def _range_end_node(node, language: str):
 
 def _callable_range(node, region: ExecutableRegion) -> SourceRange:
     """Snapshot provider points once before mapping them to original source."""
-    start_row, start_column = callable_source_start(node, region.language).start_point
-    end_row, end_column = _range_end_node(node, region.language).end_point
+    start = callable_source_start(node, region.language)
+    end = _range_end_node(node, region.language)
     return SourceRange(
-        region.original_point(start_row, start_column),
-        region.original_point(end_row, end_column),
+        region.original_point_at_byte(start.start_byte),
+        region.original_point_at_byte(end.end_byte),
     )
 
 

{agent_code_guard-0.2.0 → agent_code_guard-0.3.1}/src/agent_code_guard/analysis/callable_identity.py

@@ -272,8 +272,7 @@ def _javascript_lexical_name(node, source: bytes) -> str | None:
 
 
 def _callback_name(node, region: ExecutableRegion) -> str:
-    row, column = node.start_point
-    point = region.original_point(row, column)
+    point = region.original_point_at_byte(node.start_byte)
     return f"<callback@{point.line}:{point.byte_column}>"
 
 

agent_code_guard-0.3.1/src/agent_code_guard/analysis/csharp_compat.py

@@ -0,0 +1,115 @@
+"""Narrow compatibility correction for upstream C# contextual-keyword errors."""
+
+from __future__ import annotations
+
+
+_CONTEXTUAL_KEYWORD = b"async"
+_NEUTRAL_IDENTIFIER = b"azync"
+_EXPRESSION_CONTAINERS = {
+    "argument", "arrow_expression_clause", "expression_statement", "return_statement",
+}
+_NON_EXPRESSION_FIELDS = {"alias", "label", "name", "type"}
+
+
+def corrected_csharp_root(provider, source: bytes, first_tree):
+    """Return one verified corrected root, or ``None`` when correction is unsafe."""
+    problems = tuple(_problem_nodes(first_tree.root_node))
+    if not problems:
+        return None
+
+    token_offsets: set[int] = set()
+    for problem in problems:
+        candidates = _contained_unescaped_tokens(source, problem.start_byte, problem.end_byte)
+        if len(candidates) > 1:
+            candidates = tuple(
+                offset
+                for offset in candidates
+                if not _is_declaration_identifier(first_tree.root_node, offset)
+            )
+        if len(candidates) != 1:
+            return None
+        token_offsets.add(candidates[0])
+
+    corrected = bytearray(source)
+    for offset in token_offsets:
+        corrected[offset:offset + len(_CONTEXTUAL_KEYWORD)] = _NEUTRAL_IDENTIFIER
+    corrected_source = bytes(corrected)
+    if len(corrected_source) != len(source) or _newline_offsets(corrected_source) != _newline_offsets(source):
+        return None
+
+    retry_tree = provider.parse("csharp", corrected_source)
+    if retry_tree.root_node.has_error or any(_problem_nodes(retry_tree.root_node)):
+        return None
+    if not all(_has_authorized_role(retry_tree.root_node, offset) for offset in token_offsets):
+        return None
+    return retry_tree.root_node
+
+
+def _problem_nodes(node):
+    if node.is_error or node.is_missing:
+        yield node
+    for child in node.children:
+        yield from _problem_nodes(child)
+
+
+def _contained_unescaped_tokens(source: bytes, start: int, end: int) -> tuple[int, ...]:
+    offsets: list[int] = []
+    position = source.find(_CONTEXTUAL_KEYWORD, start, end)
+    while position >= 0:
+        token_end = position + len(_CONTEXTUAL_KEYWORD)
+        if token_end <= end and _is_token_boundary(source, position, token_end):
+            offsets.append(position)
+        position = source.find(_CONTEXTUAL_KEYWORD, position + 1, end)
+    return tuple(offsets)
+
+
+def _is_token_boundary(source: bytes, start: int, end: int) -> bool:
+    before = source[start - 1] if start else None
+    after = source[end] if end < len(source) else None
+    return before != ord("@") and not _identifier_byte(before) and not _identifier_byte(after)
+
+
+def _identifier_byte(value: int | None) -> bool:
+    return value is not None and (value >= 0x80 or value == ord("_") or chr(value).isalnum())
+
+
+def _newline_offsets(source: bytes) -> tuple[int, ...]:
+    return tuple(index for index, value in enumerate(source) if value == ord("\n"))
+
+
+def _is_declaration_identifier(root, offset: int) -> bool:
+    node = root.descendant_for_byte_range(offset, offset + len(_CONTEXTUAL_KEYWORD))
+    if (
+        node.type != "identifier"
+        or node.start_byte != offset
+        or node.end_byte != offset + len(_CONTEXTUAL_KEYWORD)
+        or node.parent is None
+    ):
+        return False
+    field_name = next(
+        (
+            node.parent.field_name_for_child(index)
+            for index, child in enumerate(node.parent.children)
+            if child == node
+        ),
+        None,
+    )
+    return field_name in _NON_EXPRESSION_FIELDS
+
+
+def _has_authorized_role(root, offset: int) -> bool:
+    node = root.descendant_for_byte_range(offset, offset + len(_NEUTRAL_IDENTIFIER))
+    if node.type != "identifier" or node.start_byte != offset or node.end_byte != offset + len(_NEUTRAL_IDENTIFIER):
+        return False
+    parent = node.parent
+    if parent is None:
+        return False
+    if parent.type == "argument" and parent.child_by_field_name("name") == node:
+        return True
+    field_name = next(
+        (parent.field_name_for_child(index) for index, child in enumerate(parent.children) if child == node),
+        None,
+    )
+    return (
+        parent.type.endswith("_expression") or parent.type in _EXPRESSION_CONTAINERS
+    ) and field_name not in _NON_EXPRESSION_FIELDS

{agent_code_guard-0.2.0 → agent_code_guard-0.3.1}/src/agent_code_guard/analysis/errors.py

@@ -4,6 +4,10 @@
 class AnalysisError(RuntimeError):
     """Base error suitable for Code Guard's existing exit-3 boundary."""
 
+    def __init__(self, message: str, *, language: str | None = None) -> None:
+        super().__init__(message)
+        self.language = language
+
 
 class ProviderUnavailableError(AnalysisError):
     """The configured parser provider or a required grammar is unavailable."""

{agent_code_guard-0.2.0 → agent_code_guard-0.3.1}/src/agent_code_guard/analysis/facts.py

@@ -2,8 +2,10 @@
 
 from __future__ import annotations
 
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
+from types import MappingProxyType
+from typing import Mapping
 
 
 @dataclass(frozen=True, order=True)
@@ -82,11 +84,20 @@ class FileFacts:
     controls: tuple[ControlFlowFact, ...]
     decisions: tuple[DecisionFact, ...]
     region_count: int
+    reporting_path: str | None = None
 
 
 @dataclass(frozen=True)
 class AnalysisFacts:
     files: tuple[FileFacts, ...]
+    _reporting_paths: Mapping[Path, str] = field(init=False, repr=False, compare=False)
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "_reporting_paths", MappingProxyType({
+            file.path: file.reporting_path
+            for file in self.files
+            if file.reporting_path is not None
+        }))
 
     @property
     def callables(self) -> tuple[CallableFact, ...]:
@@ -99,3 +110,12 @@ class AnalysisFacts:
     @property
     def decisions(self) -> tuple[DecisionFact, ...]:
         return tuple(fact for file in self.files for fact in file.decisions)
+
+    def reporting_path_for(self, path: Path, root: Path | None = None) -> str:
+        stored = self._reporting_paths.get(path)
+        if stored is not None:
+            return stored
+        try:
+            return path.relative_to(root).as_posix() if root is not None else path.as_posix()
+        except ValueError:
+            return path.as_posix()

agent_code_guard-0.3.1/src/agent_code_guard/analysis/pipeline.py

@@ -0,0 +1,92 @@
+"""Parse applicable selected files once and return reusable immutable facts."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from ..invocation import SelectedFile
+
+from .adapters import extract_facts
+from .csharp_compat import corrected_csharp_root
+from .errors import ProviderUnavailableError, SyntaxAnalysisError
+from .facts import AnalysisFacts, FileFacts
+from .provider import ParserProvider, TreeSitterProvider
+from .regions import executable_regions, is_applicable
+
+
+def analyze_files(files: tuple[SelectedFile, ...] | list[SelectedFile], provider: ParserProvider | None = None) -> AnalysisFacts:
+    """Analyze only applicable entries from the already-resolved caller scope."""
+    active_provider = provider or TreeSitterProvider()
+    results = [
+        _analyze_file(selected.physical_path, active_provider, selected.reporting_path)
+        for selected in files if is_applicable(selected.physical_path)
+    ]
+    return AnalysisFacts(tuple(results))
+
+
+@dataclass(frozen=True)
+class UnavailableAnalysis:
+    path: Path
+    reporting_path: str
+    language: str
+    kind: str
+    message: str
+
+
+@dataclass(frozen=True)
+class BatchAnalysis:
+    facts: AnalysisFacts
+    unavailable: tuple[UnavailableAnalysis, ...]
+
+
+def analyze_files_for_runner(
+    files: tuple[SelectedFile, ...], provider: ParserProvider | None = None,
+) -> BatchAnalysis:
+    """Analyze selected files independently while retaining only known unavailable evidence."""
+    active_provider = provider or TreeSitterProvider()
+    results: list[FileFacts] = []
+    unavailable: list[UnavailableAnalysis] = []
+    for selected in files:
+        path = selected.physical_path
+        if not is_applicable(path):
+            continue
+        try:
+            results.append(_analyze_file(path, active_provider, selected.reporting_path))
+        except (SyntaxAnalysisError, ProviderUnavailableError) as exc:
+            if exc.language is None:
+                raise
+            kind = "syntax" if isinstance(exc, SyntaxAnalysisError) else "provider"
+            unavailable.append(UnavailableAnalysis(path, selected.reporting_path, exc.language, kind, str(exc)))
+    return BatchAnalysis(AnalysisFacts(tuple(results)), tuple(unavailable))
+
+
+def _analyze_file(path: Path, provider: ParserProvider, reporting_path: str | None = None) -> FileFacts:
+    callables = []
+    controls = []
+    decisions = []
+    regions = executable_regions(path, provider)
+    for region in regions:
+        try:
+            tree = provider.parse(region.language, region.source)
+        except (SyntaxAnalysisError, ProviderUnavailableError) as exc:
+            if exc.language is None:
+                raise type(exc)(str(exc), language=region.language) from exc
+            raise
+        root = tree.root_node
+        if tree.root_node.has_error:
+            root = (
+                corrected_csharp_root(provider, region.source, tree)
+                if region.language == "csharp"
+                else None
+            )
+            if root is None:
+                raise SyntaxAnalysisError(
+                    f"unable to parse {path}: embedded {region.language} syntax tree contains errors",
+                    language=region.language,
+                )
+        region_callables, region_controls, region_decisions = extract_facts(root, region)
+        callables.extend(region_callables)
+        controls.extend(region_controls)
+        decisions.extend(region_decisions)
+    return FileFacts(path, tuple(callables), tuple(controls), tuple(decisions), len(regions), reporting_path)

{agent_code_guard-0.2.0 → agent_code_guard-0.3.1}/src/agent_code_guard/analysis/provider.py

@@ -33,13 +33,15 @@ class TreeSitterProvider:
             except (ImportError, LookupError, OSError, RuntimeError) as exc:
                 raise ProviderUnavailableError(
                     f"syntax provider unavailable for supported language {language!r}: {exc}; "
-                    "reinstall Agent Code Guard"
+                    "reinstall Agent Code Guard",
+                    language=language,
                 ) from exc
             self._parsers[language] = parser
         try:
             return parser.parse(source)
-        except Exception as exc:
+        except RuntimeError as exc:
             raise ProviderUnavailableError(
                 f"syntax provider failed for supported language {language!r}: {exc}; "
-                "verify the Agent Code Guard installation"
+                "verify the Agent Code Guard installation",
+                language=language,
             ) from exc