agent-sdlc 0.4.2__tar.gz → 0.5.0__tar.gz

{agent_sdlc-0.4.2/agent_sdlc.egg-info → agent_sdlc-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-sdlc
-Version: 0.4.2
+Version: 0.5.0
 Summary: Diff-scoped mutation gate for pre-commit and agent Stop hooks
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/PavelGuzenfeld/agent-sdlc

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0/agent_sdlc.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-sdlc
-Version: 0.4.2
+Version: 0.5.0
 Summary: Diff-scoped mutation gate for pre-commit and agent Stop hooks
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/PavelGuzenfeld/agent-sdlc

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0}/agent_sdlc.egg-info/SOURCES.txt

@@ -14,6 +14,7 @@ mutation_gate/cli.py
 mutation_gate/commit_msg.py
 mutation_gate/coverage_map.py
 mutation_gate/diff_discipline.py
+mutation_gate/host_exec.py
 mutation_gate/model_vv.py
 mutation_gate/mutants.py
 mutation_gate/no_comments.py

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0}/mutation_gate/__init__.py

@@ -1,3 +1,3 @@
 """Diff-scoped mutation gate. Spec: PavelGuzenfeld/dotfiles#9."""
 
-__version__ = "0.4.2"
+__version__ = "0.5.0"

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0}/mutation_gate/adversary.py

@@ -128,7 +128,10 @@ def run_isolated(name: str, prompt: str, work: Path, extra: tuple[str, ...] = ()
     if not shutil.which("claude"):
         return f"{name} skipped: `claude` not on PATH"
     proc = subprocess.run(
-        ["claude", "-p", prompt, "--restricted", "--disable-slash-commands", *extra],
+        [
+            "claude", "-p", prompt, "--restricted", "--disable-slash-commands",
+            "--no-session-persistence", *extra,
+        ],
         cwd=work, stdin=subprocess.DEVNULL, capture_output=True, text=True,
         check=False, timeout=600,
     )

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0}/mutation_gate/cli.py

@@ -59,15 +59,27 @@ def _warn_stale_waivers(repo, rel: str, wvs) -> None:
     if not any(w.file == rel and w.line and not w.uncovered for w in wvs):
         return
     try:
-        whole = {rel: set(range(1, len((repo.root / rel).read_text().splitlines()) + 1))}
-        every = mutants.generate(repo.root, whole, repo.config.language)
+        every = _every_mutant(repo, rel)
     except (OSError, GateError, ValueError):
         return
-    for w in waivers.stale(wvs, rel, every):
+    for w in waivers.stale(wvs, rel, every, _source_lines(repo, rel)):
         _emit(f"  {rel}: waiver at line {w.line} column {w.column} matches no mutant "
               f"— stale after an edit above it? ({w.old!r} => {w.new!r})")
 
 
+def _source_lines(repo, rel: str) -> list[str]:
+    return (repo.root / rel).read_text().splitlines()
+
+
+def _line_text_of(repo, mutant) -> str:
+    return waivers.line_text(_source_lines(repo, mutant.file), mutant.line)
+
+
+def _every_mutant(repo, rel: str) -> list:
+    whole = {rel: set(range(1, len(_source_lines(repo, rel)) + 1))}
+    return mutants.generate(repo.root, whole, repo.config.language)
+
+
 def _warn_stale_report(repo, staged: bool) -> None:
     """#212: nobody should read an old adversary review as current when the
     gate skipped it this run."""
@@ -131,6 +143,8 @@ def _gate_file(
     _emit(f"  {rel}: baseline {baseline:.1f}s, per-mutant timeout {timeout:.0f}s ({source})")
 
     survivors, blocked, timed_out = [], False, 0
+    every = _every_mutant(repo, rel) if any(w.text and w.file == rel for w in wvs) else []
+    lines = _source_lines(repo, rel) if every else []
     total = len(generated)
     for index, m in enumerate(generated, 1):
         tests = sorted({t.split("|")[0] for t in cover.get(m.line, [])})
@@ -141,7 +155,7 @@ def _gate_file(
         if result.verdict in (runner.KILLED, runner.KILLED_TIMEOUT):
             timed_out += result.verdict == runner.KILLED_TIMEOUT
             continue
-        waiver = waivers.waived(wvs, m)
+        waiver = waivers.waived(wvs, m, every, lines)
         if waiver:
             _emit(f"  {rel}:{m.line}:{m.column} {m.old} => {m.new}  SURVIVED (waived: {waiver.reason})")
             continue
@@ -470,7 +484,7 @@ def _run(repo, args, staged: bool, transcript_path: str | None = None) -> int:
         if all_survivors:
             _emit("")
             _emit(f"Write the killing test, or record a waiver in {waivers.path(repo)}:")
-            _emit(waivers.suggest(all_survivors[0]))
+            _emit(waivers.suggest(all_survivors[0], _line_text_of(repo, all_survivors[0])))
         return 1
 
     _emit("mutation-gate: pass")

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0}/mutation_gate/coverage_map.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import ast
 import json
+import shlex
 import sqlite3
 import time
 from pathlib import Path, PurePosixPath
@@ -254,7 +255,7 @@ def covering_tests(
     if not cands:
         return {}
     lang_cfg = repo.config.for_language("python")
-    rels = " ".join(str(p.relative_to(repo.root)) for p in cands)
+    rels = shlex.join(str(p.relative_to(repo.root)) for p in cands)
     cmd = lang_cfg.coverage_command.format(file=_cov_scope(target), tests=rels)
     # Same suite plus instrumentation, so the baseline cap is the honest bound.
     run_start = time.time()

agent_sdlc-0.5.0/mutation_gate/host_exec.py

@@ -0,0 +1,189 @@
+"""PreToolUse Bash hook: host test and build commands run in the repo's `test_image`,
+and a `docker run` that bind-mounts the repo must pass `--user` (#395)."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import shlex
+import subprocess
+import sys
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from .repo import CONFIG_NAME, Config, GateError
+
+CONTAINER_MARKER = Path("/.dockerenv")
+HOST_COMMANDS = frozenset({"python3", "pytest", "make", "cmake", "colcon"})
+USER_FLAG = "--user $(id -u):$(id -g)"
+SEPARATORS = ";&|"
+PWD_PREFIX = re.compile(r"^(\$\{PWD\}|\$PWD|\$\(pwd\)|`pwd`)")
+USER_FLAGS = frozenset({"-u", "--user"})
+VOLUME_FLAGS = frozenset({"-v", "--volume"})
+VALUE_FLAGS = USER_FLAGS | VOLUME_FLAGS | frozenset({
+    "--mount", "-e", "--env", "--env-file", "-w", "--workdir", "-p", "--publish", "--name",
+    "--entrypoint", "--network", "--net", "-l", "--label", "--platform", "--gpus",
+    "--shm-size", "--ipc", "--pid", "-m", "--memory", "--cpus", "--device", "--add-host",
+    "--cap-add", "--cap-drop", "--security-opt", "--ulimit", "--tmpfs", "--runtime",
+    "-h", "--hostname", "--restart", "--log-driver", "--log-opt", "--cidfile",
+    "--group-add", "--expose", "--stop-signal", "--pull", "--userns",
+})
+
+
+@dataclass(frozen=True)
+class Denial:
+    reason: str
+
+
+@dataclass(frozen=True)
+class Rewrite:
+    command: str
+
+
+@dataclass(frozen=True)
+class Notice:
+    reason: str
+
+
+@dataclass(frozen=True)
+class Mount:
+    source: str
+    target: str
+
+
+@dataclass
+class DockerRun:
+    mounts: list[Mount] = field(default_factory=list)
+    has_user: bool = False
+    command: list[str] = field(default_factory=list)
+
+def segments(command: str) -> list[list[str]]:
+    lexer = shlex.shlex(command, posix=True, punctuation_chars=SEPARATORS)
+    lexer.whitespace_split = True
+    lexer.commenters = ""
+    parts: list[list[str]] = [[]]
+    for token in lexer:
+        if not token.strip(SEPARATORS):
+            parts.append([])
+        else:
+            parts[-1].append(token)
+    return [part for part in parts if part]
+
+
+def parse_docker_run(args: list[str]) -> DockerRun:
+    run = DockerRun()
+    tokens = iter(args)
+    for token in tokens:
+        if not token.startswith("-"):
+            run.command = list(tokens)
+            break
+        flag, has_value, value = token.partition("=")
+        if not has_value and flag in VALUE_FLAGS:
+            value = next(tokens, "")
+        if flag in USER_FLAGS:
+            run.has_user = True
+        elif flag in VOLUME_FLAGS and ":" in value:
+            source, _, rest = value.partition(":")
+            run.mounts.append(Mount(source, rest.partition(":")[0]))
+        elif flag == "--mount":
+            options = dict(part.partition("=")[::2] for part in value.split(","))
+            if options.get("type") == "bind":
+                run.mounts.append(Mount(
+                    options.get("source") or options.get("src", ""),
+                    options.get("target") or options.get("dst") or options.get("destination", ""),
+                ))
+    return run
+
+
+def host_path(source: str, cwd: Path) -> Path | None:
+    source = os.path.expanduser(os.path.expandvars(PWD_PREFIX.sub(lambda _: str(cwd), source)))
+    if "$" in source or not source.startswith(("/", ".")):
+        return None
+    return (cwd / source).resolve()
+
+
+def git_lines(cwd: Path, *args: str) -> list[str] | None:
+    result = subprocess.run(["git", "-C", str(cwd), *args], capture_output=True, text=True)
+    return result.stdout.splitlines() if result.returncode == 0 else None
+
+
+def is_inside(path: Path | None, roots: list[Path]) -> bool:
+    return path is not None and any(path == root or root in path.parents for root in roots)
+
+
+def is_ownership_handback(command: list[str], targets: list[str]) -> bool:
+    owners = ("$(id -u):$(id -g)", f"{os.getuid()}:{os.getgid()}")
+    return " ".join(command) in {f"chown -R {owner} {target}" for owner in owners for target in targets}
+
+
+def with_user(command: str) -> str:
+    return re.sub(r"\bdocker\s+run\b", lambda _: f"docker run {USER_FLAG}", command)
+
+
+def is_host_command(tokens: list[str]) -> bool:
+    return tokens[0] in HOST_COMMANDS or tokens[:2] == ["pip", "install"]
+
+
+def decide(command: str, cwd: Path, is_in_container: bool) -> Denial | Rewrite | Notice | None:
+    toplevel = git_lines(cwd, "rev-parse", "--show-toplevel")
+    if toplevel is None or not (Path(toplevel[0]) / CONFIG_NAME).exists():
+        return None
+    try:
+        config = Config.load(Path(toplevel[0]))
+    except (GateError, ValueError):
+        return Notice(f"cannot read {Path(toplevel[0]) / CONFIG_NAME}, passing through")
+    try:
+        parts = segments(command)
+    except ValueError:
+        return None
+    roots = [Path(line.removeprefix("worktree ")).resolve()
+             for line in git_lines(cwd, "worktree", "list", "--porcelain") or []
+             if line.startswith("worktree ")]
+    for part in parts:
+        for start in range(len(part)):
+            if part[start:start + 2] == ["docker", "run"]:
+                run = parse_docker_run(part[start + 2:])
+                inside = [m for m in run.mounts if is_inside(host_path(m.source, cwd), roots)]
+                if (inside and not run.has_user
+                        and not is_ownership_handback(run.command, [m.target for m in inside])):
+                    return Denial(
+                        f"docker run bind-mounts {inside[0].source} inside the repo without --user, "
+                        f"which leaves root-owned files. Run instead:\n  {with_user(command)}"
+                    )
+    host = next((part[0] for part in parts if is_host_command(part)), None)
+    if (host is None or is_in_container or not config.is_test_image_used
+            or any(part[0] == "docker" for part in parts)):
+        return None
+    if not config.test_image:
+        return Denial(
+            f"`{host}` would run on the host. Set test_image = \"<image>\" in "
+            f"{CONFIG_NAME} to run it in that image, or is_test_image_used = false to keep it on the host."
+        )
+    return Rewrite(
+        f'docker run --rm {USER_FLAG} -e HOME=/tmp -v "$PWD:/w" -w /w '
+        f"{shlex.quote(config.test_image)} sh -c {shlex.quote(command)}"
+    )
+
+
+def main() -> int:
+    payload = json.load(sys.stdin)
+    tool_input = payload.get("tool_input") or {}
+    cwd = Path(payload.get("cwd") or os.getcwd())
+    verdict = decide(tool_input.get("command") or "", cwd, CONTAINER_MARKER.exists())
+    if isinstance(verdict, (Denial, Notice)):
+        print(f"host-exec: {verdict.reason}", file=sys.stderr)
+    if isinstance(verdict, Denial):
+        return 2
+    if isinstance(verdict, Rewrite):
+        json.dump({"hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "allow",
+            "permissionDecisionReason": "host-exec: runs in test_image",
+            "updatedInput": {**tool_input, "command": verdict.command},
+        }}, sys.stdout)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0}/mutation_gate/repo.py

@@ -219,6 +219,8 @@ class Config:
     own_namespaces: list[str] = field(default_factory=list)
     doc_allow: list[DocAllow] = field(default_factory=list)
     banned_names_file: str = ""
+    test_image: str = ""
+    is_test_image_used: bool = True
 
     def for_language(self, language: str) -> LanguageConfig:
         override = self.languages.get(language)

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0}/mutation_gate/runner.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 import contextlib
 import os
 import re
+import shlex
 import shutil
 import signal
 import subprocess
@@ -191,7 +192,7 @@ def _run_tests(
     """Verdict within `timeout`. Timing out is not-green: a mutant can make the
     suite hang — `break` to `continue`, or a divide that never settles — and a
     hung gate is worse than a wrong verdict."""
-    return run_capped(repo, test_command.format(tests=" ".join(tests)), timeout)
+    return run_capped(repo, test_command.format(tests=shlex.join(tests)), timeout)
 
 
 def _looks_like_collection_failure(returncode: int, output: bytes) -> bool:
@@ -235,7 +236,7 @@ def baseline_green(repo: Repo, tests: list[str], test_command: str) -> float:
     """Seconds the unmutated suite takes. Refuses rather than reporting, because
     a baseline that is not green makes every later verdict a fabrication."""
     start = time.monotonic()
-    command = test_command.format(tests=" ".join(tests))
+    command = test_command.format(tests=shlex.join(tests))
     verdict = _baseline_outcome(repo, command, repo.config.baseline_timeout)
     if verdict == NO_PASS_MARKER:
         raise GateError(

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0}/mutation_gate/vocabulary_core.toml

@@ -327,7 +327,7 @@ forms = ["plural"]
 
 [[concept]]
 word = "image"
-meaning = "a two-dimensional array of pixels"
+meaning = "a two-dimensional array of pixels, or the filesystem snapshot a container runs from"
 pos = ["noun"]
 forms = ["plural"]
 

{agent_sdlc-0.4.2 → agent_sdlc-0.5.0}/mutation_gate/waivers.py

@@ -32,18 +32,31 @@ class Waiver:
     check: str = ""
     test: str = ""
     ms: int = 0
+    text: str = ""
 
-    def covers(self, mutant: Mutant) -> bool:
+    def covers(self, mutant: Mutant, every: list[Mutant] = (), lines: list[str] = ()) -> bool:
         if self.check or self.file != mutant.file:
             return False
         if self.uncovered:
             return True
+        if self.text:
+            return self._covers_by_text(mutant, every, lines)
         if self.line and self.line != mutant.line:
             return False
         if self.column and self.column != mutant.column:
             return False
         return self.old == mutant.old and self.new == mutant.new
 
+    def _covers_by_text(self, mutant: Mutant, every: list[Mutant], lines: list[str]) -> bool:
+        def same_site(m: Mutant) -> bool:
+            return (m.old, m.new, line_text(lines, m.line)) == (self.old, self.new, self.text)
+
+        if not same_site(mutant):
+            return False
+        if sum(map(same_site, every)) <= 1:
+            return True
+        return self.line == mutant.line and (not self.column or self.column == mutant.column)
+
     def covers_finding(self, check: str, file: str, test: str, ms: int, line: int) -> bool:
         if self.check != check:
             return False
@@ -56,6 +69,10 @@ class Waiver:
         return not self.ms or self.ms == ms
 
 
+def line_text(lines: list[str], line: int) -> str:
+    return lines[line - 1].strip() if 0 < line <= len(lines) else ""
+
+
 def _ambiguous(entry: dict) -> bool:
     """A literal mutant is identified only by its value, so `old = "0"` without a
     line waives every `0 => 1` in the file — silently covering sites nobody looked
@@ -84,11 +101,15 @@ def load(repo: Repo) -> list[Waiver]:
     return out
 
 
-def waived(waivers: list[Waiver], mutant: Mutant) -> Waiver | None:
-    return next((w for w in waivers if w.covers(mutant)), None)
+def waived(
+    waivers: list[Waiver], mutant: Mutant, every: list[Mutant] = (), lines: list[str] = ()
+) -> Waiver | None:
+    return next((w for w in waivers if w.covers(mutant, every, lines)), None)
 
 
-def stale(waivers: list[Waiver], file: str, every_mutant: list[Mutant]) -> list[Waiver]:
+def stale(
+    waivers: list[Waiver], file: str, every_mutant: list[Mutant], lines: list[str] = ()
+) -> list[Waiver]:
     """Waivers naming a site in `file` that the generator no longer produces.
 
     A waiver is keyed on line and column, so inserting anything above one moves its
@@ -102,7 +123,7 @@ def stale(waivers: list[Waiver], file: str, every_mutant: list[Mutant]) -> list[
     return [
         w for w in waivers
         if w.file == file and w.line and not w.uncovered and not w.check
-        and not any(w.covers(m) for m in every_mutant)
+        and not any(w.covers(m, every_mutant, lines) for m in every_mutant)
     ]
 
 
@@ -128,10 +149,11 @@ def suggest_finding(check: str, file: str, test: str = "", ms: int = 0) -> str:
     )
 
 
-def suggest(mutant: Mutant) -> str:
+def suggest(mutant: Mutant, text: str = "") -> str:
     """Always scoped to the one site: `_ambiguous` refuses a bare literal without
     a line, and one line can hold two mutants with identical text. Widening is a
     decision to make by deleting a key."""
+    text_key = f'text = """{text}"""\n' if text else ""
     return (
         "[[waiver]]\n"
         f'file = "{mutant.file}"\n'
@@ -139,6 +161,7 @@ def suggest(mutant: Mutant) -> str:
         f"column = {mutant.column}\n"
         f'old = """{mutant.old}"""\n'
         f'new = """{mutant.new}"""\n'
+        f"{text_key}"
         'reason = "REPLACE ME — why no test can or should kill this"\n'
     )