attocode-code-intel 0.1.0__py3-none-any.whl

attocode_intel/community.py

@@ -0,0 +1,63 @@
+"""Shared community detection helpers.
+
+Used by both the MCP tool (analysis_tools.py) and the HTTP service (service.py).
+"""
+
+from __future__ import annotations
+
+from collections import deque
+
+
+def louvain_communities(
+    all_files: set[str],
+    adj: dict[str, set[str]],
+    weights: dict[tuple[str, str], float],
+) -> tuple[list[set[str]], float]:
+    """Run Louvain community detection using networkx.
+
+    Returns ``([], 0.0)`` for an empty graph (no edges).
+    Raises ``ImportError`` if networkx is not installed.
+    """
+    import networkx as nx
+    from networkx.algorithms.community import louvain_communities as _louvain
+    from networkx.algorithms.community import modularity
+
+    G = nx.Graph()  # noqa: N806
+    G.add_nodes_from(all_files)
+    for src, neighbors in adj.items():
+        for tgt in neighbors:
+            if src < tgt:  # avoid duplicate edges
+                w = weights.get((src, tgt), weights.get((tgt, src), 1.0))
+                G.add_edge(src, tgt, weight=w)
+
+    if G.number_of_edges() == 0:
+        return [{f} for f in all_files], 0.0
+
+    communities = [set(c) for c in _louvain(G, weight="weight", seed=42)]
+    mod = modularity(G, communities, weight="weight")
+    return communities, mod
+
+
+def bfs_connected_components(
+    all_files: set[str],
+    adj: dict[str, set[str]],
+) -> tuple[list[set[str]], float]:
+    """Fallback: connected components via BFS. Modularity = 0."""
+    visited: set[str] = set()
+    communities: list[set[str]] = []
+    for start in all_files:
+        if start in visited:
+            continue
+        component: set[str] = set()
+        bfs_queue: deque[str] = deque([start])
+        while bfs_queue:
+            node = bfs_queue.popleft()
+            if node in visited:
+                continue
+            visited.add(node)
+            component.add(node)
+            for neighbor in adj.get(node, set()):
+                if neighbor not in visited:
+                    bfs_queue.append(neighbor)
+        communities.append(component)
+    return communities, 0.0

attocode_intel/confidence/__init__.py

@@ -0,0 +1,144 @@
+"""Where a finding's confidence comes from.
+
+Most confidences in this package are literals somebody picked: the eight in
+``bug_finder._PATTERNS``, the ``0.6`` on synthesized rules, the ``0.7``/``0.8``
+in ``dead_code_tools``. Two scorers can replace them, chosen with
+``ATTOCODE_FLAG_CONFIDENCE``: jev and llm. Historical experiments and their
+limitations live in ``eval/rule_accuracy/demo``; their results are not
+general accuracy guarantees.
+
+``ATTOCODE_FLAG_CONFIDENCE_MODE`` picks what happens with the estimate:
+``shadow`` logs it beside the constant and changes nothing, ``live`` uses it.
+Both default to off/shadow, so nothing here runs unless asked.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import math
+from contextvars import ContextVar
+from copy import deepcopy
+from typing import TYPE_CHECKING, Any
+
+from attocode_intel.confidence import jev as jev_scorer
+from attocode_intel.confidence import llm as llm_scorer
+from attocode_intel.confidence import settings
+from attocode_intel.confidence.redact import redact
+
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+
+logger = logging.getLogger(__name__)
+
+__all__ = ["MAX_CALLS", "last_report", "last_run", "mode", "redact", "rule_threshold", "score", "scorer_name", "summary"]
+
+# ponytail: per-call cap. A corpus file yields a handful of findings; a wide
+# diff can yield hundreds, and each one is a network round trip.
+MAX_CALLS = 25
+
+_SCORERS = {"jev": jev_scorer, "llm": llm_scorer}
+
+_last: ContextVar[tuple[int, int]] = ContextVar("confidence_counts", default=(0, 0))
+_report: ContextVar[dict | None] = ContextVar("confidence_report", default=None)
+
+
+def last_run() -> tuple[int, int]:
+    """(estimated, considered) from the most recent score() call."""
+    return _last.get()
+
+
+def last_report() -> dict:
+    """A detached request-local audit, including suppressed and unscored candidates."""
+    return deepcopy(_report.get() or {})
+
+
+def summary() -> str:
+    report = _report.get() or {}
+    if not report or report["scorer"] == "off":
+        return ""
+    return (
+        f"Confidence: {report['scorer']} ({report['mode']}); "
+        f"{report['estimated']}/{report['total']} scored, "
+        f"{report['fallback']} fallback, {report['skipped']} skipped by cap. "
+        "Fallback and skipped findings retain their baseline confidence."
+    )
+
+
+def rule_threshold(min_confidence: float) -> float:
+    """Live estimates can promote rules below their old constant threshold."""
+    return 0.0 if settings.selected() != "off" and mode() == "live" else min_confidence
+
+
+def scorer_name() -> str:
+    """Which scorer is selected: "off", "jev" or "llm"."""
+    name = settings.selected()
+    if name == "jev":
+        try:
+            if not jev_scorer.available():
+                return "off"
+        except (ValueError, OSError):
+            return "off"
+    return name if name in _SCORERS else "off"
+
+
+def mode() -> str:
+    """What to do with an estimate: "shadow" (log only) or "live" (use it)."""
+    value = settings.mode()
+    return "live" if value == "live" else "shadow"
+
+
+def score(findings: Sequence[Any], *, min_confidence: float) -> tuple[int, int]:
+    """Estimate p(true positive) per finding and log it beside the constant.
+
+    In ``live`` mode the estimate replaces ``finding.confidence``. Findings the
+    scorer has no opinion on keep their constant. Never raises: a scorer outage
+    must not cost a caller its findings.
+
+    Returns (estimated, considered) so a caller can tell a real score from a
+    scorer that ran but never committed to anything.
+    """
+    requested = settings.selected()
+    name = scorer_name()
+    items = list(findings)
+    batch = items[:MAX_CALLS] if name != "off" else []
+    estimates: list = []
+    if batch:
+        try:
+            estimates = list(_SCORERS[name].estimate(batch, min_confidence=min_confidence))
+        except Exception:
+            logger.warning("confidence: %s scorer failed, keeping constants", name)
+    live = mode() == "live"
+    estimated = 0
+    rows = []
+    for index, finding in enumerate(items):
+        baseline = finding.confidence
+        estimate = estimates[index] if index < len(batch) and index < len(estimates) else None
+        if isinstance(estimate, bool) or not isinstance(estimate, int | float) or not 0 <= estimate <= 1 or not math.isfinite(estimate):
+            estimate = None
+        if estimate is not None:
+            estimated += 1
+            if live:
+                finding.confidence = estimate
+        status = ("off" if requested == "off" else "unavailable" if name == "off"
+                  else "skipped_cap" if index >= len(batch)
+                  else "estimated" if estimate is not None else "fallback")
+        identity = f"{finding.file}:{finding.line}:{getattr(finding, 'rule_id', '')}"
+        rows.append({
+            "id": hashlib.sha256(identity.encode()).hexdigest()[:20],
+            "file": finding.file, "line": finding.line,
+            "rule": getattr(finding, "rule_id", ""),
+            "baseline": baseline, "estimate": estimate, "effective": finding.confidence,
+            "status": status, "kept": finding.confidence >= min_confidence,
+        })
+    report = {
+        "scorer": requested, "mode": mode(), "total": len(items), "estimated": estimated,
+        "considered": len(batch), "skipped": sum(r["status"] == "skipped_cap" for r in rows),
+        "fallback": sum(r["status"] in {"fallback", "unavailable"} for r in rows),
+        "findings": rows,
+    }
+    _report.set(report)
+    _last.set((estimated, len(batch)))
+    if requested != "off":
+        logger.info("%s", summary())
+    return last_run()

attocode_intel/confidence/jev.py

@@ -0,0 +1,234 @@
+"""Jev scorer — a calibrated probability in place of a hardcoded constant.
+
+Jev (TypeSafe System One) answers a yes/no question with a probability.
+Historical comparisons and their limitations live in eval/rule_accuracy/demo.
+
+It needs no client library. The backend is a public HTTP endpoint and one POST
+is the whole protocol. Supported backends are OpenRouter, TypeSafe, and a
+local server, with credentials selected for the configured backend.
+
+If the standalone `jev` CLI happens to be importable, its decide() is used
+outside workspace-scoped requests. It also appends a row to
+~/.jev/decisions.jsonl, which is what `jev label` and `jev report` read.
+
+An unkeyed or unreachable backend yields no estimate, and the caller keeps its
+constant.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import json
+import logging
+import math
+import os
+import urllib.error
+import urllib.request
+from concurrent.futures import ThreadPoolExecutor
+from typing import TYPE_CHECKING, Any
+from urllib.parse import urlsplit
+
+from attocode_intel.confidence import settings
+from attocode_intel.confidence.redact import redact
+
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+
+try:  # optional: only for the decisions.jsonl log the jev CLI reads
+    import jev
+
+    _HAS_JEV = True
+except ImportError:
+    jev = None
+    _HAS_JEV = False
+
+logger = logging.getLogger(__name__)
+
+_env_loaded = False
+
+
+def _load_env() -> None:
+    """Populate keys once, from wherever this machine keeps them.
+
+    The jev CLI keeps its key in ~/.jev/env; the project keeps one in .env.
+    Neither is on a hook's or a subprocess's environment by default.
+    """
+    global _env_loaded
+    if settings.project_dir():
+        return  # Scoped requests read .env without mutating process credentials.
+    if _env_loaded:
+        return
+    _env_loaded = True
+    if _HAS_JEV:
+        jev.load_env()
+    try:
+        from dotenv import load_dotenv
+    except ImportError:  # pragma: no cover - declared dependency
+        return
+    load_dotenv()
+
+
+# backend -> (url, model, key env var). Mirrors the jev CLI so a row logged by
+# either route is directly comparable.
+_BACKENDS = {
+    "openrouter": (
+        "https://openrouter.ai/api/alpha/decisions",
+        "typesafe/jev-1.13",
+        "OPENROUTER_API_KEY",
+    ),
+    "typesafe": ("https://api.typesafe.ai/v1/systemone", "jev-1.13.0", "TYPESAFE_API_KEY"),
+    "local": (None, "jev-latest", "OPENJEV_API_KEY"),
+}
+
+# Measured on the rule corpus: near-linear to 16 workers (9.8x), flat after.
+WORKERS = 16
+
+QUESTION = "Is this rule match a true positive at this location?"
+CRITERIA = {
+    "true": "The problem the rule describes is really present in this code.",
+    "false": "Test code, a comment, a string literal, a dead branch, or the case "
+             "is already handled nearby.",
+}
+
+
+def available() -> bool:
+    """True when a backend can be reached: a key, or a local server."""
+    _load_env()
+    chosen = backend()
+    return bool(chosen == "local" and (
+        settings.environment().get("JEV_BASE_URL")
+        or settings.environment().get("JEV_BACKEND") == "local"
+        or settings.local_settings().get("backend") == "local"
+        or settings.environment().get("ATTOCODE_LOCAL_ONLY", "").lower() in {"1", "true", "yes", "on"}
+    ) or settings.environment().get(_BACKENDS[chosen][2])
+        or (_HAS_JEV and not settings.project_dir()))
+
+
+def _loopback(url: str) -> bool:
+    # IP literals only, as in the SystemOne ranker: a hostname can re-resolve.
+    try:
+        return ipaddress.ip_address(urlsplit(url).hostname or "").is_loopback
+    except ValueError:
+        return False
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args: Any, **kwargs: Any) -> None:
+        return None  # urllib would resend the key to the new URL; the 3xx becomes an error
+
+
+def _open(request: urllib.request.Request, timeout: float) -> Any:
+    """Send without redirects, and without an ambient proxy for a loopback server."""
+    handlers: list[urllib.request.BaseHandler] = [_NoRedirect()]
+    if _loopback(request.full_url):
+        handlers.append(urllib.request.ProxyHandler({}))
+    return urllib.request.build_opener(*handlers).open(request, timeout=timeout)
+
+
+def _decide(site: str, state: dict[str, Any], questions: dict[str, Any],
+            incumbent: str, chosen: str) -> dict[str, Any]:
+    """One decision. Uses the jev CLI when present, else a direct POST."""
+    if _HAS_JEV and not settings.project_dir():
+        result: dict[str, Any] = jev.decide(
+            site, state, questions, incumbent=incumbent, backend=chosen,
+        )
+        return result
+
+    env = settings.environment()
+    url, model, keyvar = _BACKENDS[chosen]
+    if url is None:
+        # 127.0.0.1, not localhost: localhost resolves to ::1 first.
+        base = env.get("JEV_BASE_URL", "http://127.0.0.1:8000").rstrip("/")
+        if not _loopback(base) and (
+            "JEV_BASE_URL" not in os.environ  # a repository .env may not pick the host
+            or env.get("ATTOCODE_LOCAL_ONLY", "").lower() in {"1", "true", "yes", "on"}
+        ):
+            raise ValueError("a local Jev server must use a loopback IP address")
+        url = base + "/v1/systemone"
+    headers = {"Content-Type": "application/json"}
+    key = env.get(keyvar)
+    if key:
+        headers["Authorization"] = "Bearer " + key
+    body = json.dumps(
+        {"model": env.get("JEV_MODEL", model), "state": state, "questions": questions}
+    ).encode()
+    request = urllib.request.Request(url, data=body, headers=headers)  # noqa: S310
+    timeout = float(env.get("JEV_TIMEOUT", "20"))
+    with _open(request, timeout) as response:
+        parsed: dict[str, Any] = json.loads(response.read())
+    return {"answers": parsed.get("answers"), "error": None}
+
+
+def backend() -> str:
+    """Pick a Jev backend: local when offline or unkeyed, else the configured one."""
+    _load_env()
+    env = settings.environment()
+    if env.get("ATTOCODE_LOCAL_ONLY", "").lower() in {"1", "true", "yes", "on"}:
+        return "local"
+    explicit = env.get("JEV_BACKEND") or settings.local_settings().get("backend")
+    if explicit:
+        if explicit not in _BACKENDS:
+            raise ValueError("Unsupported Jev backend")
+        return explicit
+    if env.get("OPENROUTER_API_KEY"):
+        return "openrouter"
+    if env.get("TYPESAFE_API_KEY"):
+        return "typesafe"
+    return "local"
+
+
+def _state(finding: Any) -> dict[str, Any]:
+    """The evidence Jev sees. Redacted: this leaves the machine."""
+    code = "\n".join([
+        *getattr(finding, "context_before", []),
+        getattr(finding, "code_snippet", ""),
+        *getattr(finding, "context_after", []),
+    ])
+    return {
+        "file": redact(finding.file),
+        "line": finding.line,
+        "rule": redact(getattr(finding, "rule_id", "")),
+        "message": redact(getattr(finding, "description", ""))[:1000],
+        "code": redact(code)[:3000],
+    }
+
+
+def estimate(findings: Sequence[Any], *, min_confidence: float) -> list[float | None]:
+    """Return p(true positive) per finding, or None where Jev gave no answer.
+
+    The incumbent recorded with each row is the constant's own verdict at
+    ``min_confidence``, which makes every logged row a paired comparison.
+    """
+    if not findings:
+        return []
+
+    _load_env()
+    questions = {"p": {"type": "noul", "instructions": QUESTION, "criteria": CRITERIA}}
+    chosen = backend()
+
+    def ask(finding: Any) -> float | None:
+        try:
+            row = _decide(
+                "attocode_rule_fp",
+                _state(finding),
+                questions,
+                "yes" if finding.confidence >= min_confidence else "no",
+                chosen,
+            )
+        except Exception:  # thread plus network; a finding is not worth an outage
+            logger.debug("jev: decide failed for %s:%s", finding.file, finding.line)
+            return None
+        try:
+            if row.get("error"):
+                return None
+            value = ((row.get("answers") or {}).get("p") or {}).get("noul")
+            if isinstance(value, bool) or not isinstance(value, int | float):
+                return None
+            return float(value) if math.isfinite(value) and 0 <= value <= 1 else None
+        except (AttributeError, TypeError, ValueError, OverflowError):
+            return None
+
+    with ThreadPoolExecutor(max_workers=WORKERS) as pool:
+        from contextvars import copy_context
+        futures = [pool.submit(copy_context().run, ask, finding) for finding in findings]
+        return [future.result() for future in futures]