bmsdna-devtools 0.28.0__tar.gz → 0.29.0__tar.gz

{bmsdna_devtools-0.28.0 → bmsdna_devtools-0.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bmsdna-devtools
-Version: 0.28.0
+Version: 0.29.0
 Summary: Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects
 Requires-Python: >=3.14
 Requires-Dist: pgdevkit[db]>=0.7.1
@@ -287,6 +287,17 @@ CLI flag beats `[tool.bdt.github].board` in `pyproject.toml`:
 board = "Roadmap"
 ```
 
+## `bdt issue do`
+
+```bash
+bdt issue do 60 [--agent claude] [--dry-run] [extra agent args...]
+```
+
+Hands an issue (GitHub) or work item (Azure DevOps) to a coding agent. Fetches the title and
+description and runs `claude -p "<prompt>" --name "60: <title>"`, so the session is easy to find
+with `claude --resume`. `--agent` picks another executable (it then gets just the prompt as its
+last argument); extra args are passed through; `--dry-run` prints the command.
+
 ## `bdt worktree`
 
 ```bash
@@ -297,6 +308,34 @@ Creates `.worktrees/<name>` branched from `--base`, initializes submodules
 (unless `--no-submodules`), and copies an env file into the new worktree as
 `.env` (auto-detects `.local_env` then `.env` if `--env-file` isn't given).
 
+## `bdt find-repo`
+
+```bash
+bdt find-repo my-repo [--root ~/projects] [--org MYORG] [--github-org MYORG] [--yes] [--pat PAT]
+```
+
+Finds a repo by name: first among the local clones under the work dir, then -- only if there is
+no local match -- in an Azure DevOps org and/or a GitHub org. Names match exactly
+(case-insensitive) if any repo has that name, otherwise by substring. Local matches are printed
+as paths. A single remote-only match is offered for cloning (`--yes` skips the prompt; without a
+TTY it never prompts and just tells you to pass `--yes`); several matches are listed and nothing
+is cloned.
+
+Clone destinations: `<root>/<project>/<repo>` for Azure DevOps, `<root>/github/<repo>` for GitHub.
+
+Configuration (flags override env vars):
+
+| Setting | Flag | Env vars | Default |
+| --- | --- | --- | --- |
+| Local work dir | `--root` | `AZDO_WORK_DIR`, `BMS_WORK_DIR` | `~/projects` (`C:/Projects` on Windows) |
+| Azure DevOps org | `--org` | `AZDO_ORG`, `BMS_ORG` | none (ADO not searched) |
+| GitHub org | `--github-org` | `GITHUB_ORG`, `BMS_GITHUB_ORG` | none (GitHub not searched) |
+| ADO PAT for cloning | `--pat` | `AZURE_DEVOPS_EXT_PAT`, `AZURE_DEVOPS_PAT` | falls back to `az` login |
+
+Set the org env vars in your shell profile to make `bdt find-repo <name>` work anywhere. It replaces
+the `cross-repo-discovery` skill's `ALL_REPOS.md` sync. Needs `az` (ADO) / `gh` (GitHub) only when
+those orgs are searched.
+
 ## `bdt cleanup worktrees` / `bdt cleanup orphaned-dbs` / `bdt cleanup db` / `bdt cleanup worktree`
 
 ```bash
@@ -509,6 +548,10 @@ it can't see through):
 
 - **`sql-inline-too-complex`** — more than a trivial (≤4 line) query, or a
   JOIN/CTE/subquery/aggregation, inline instead of `load_sql()`/a `.sql` file.
+  Simple `INSERT`/`UPDATE`/`DELETE` are exempt from the line limit; `INSERT ... SELECT`,
+  `UPDATE ... FROM` and `DELETE ... USING` still count as complex.
+  Also applied to any `*_sql`/`*_SQL` variable assigned a literal, even if it never reaches an
+  `.execute()` call in the same file (e.g. it's handed to a helper).
 - **`sql-fstring-injection`** / **`sql-concat-injection`** /
   **`sql-percent-format-injection`** / **`sql-format-injection`** — SQL built
   with an f-string, `+` concatenation, the `%` operator, or `str.format()`

{bmsdna_devtools-0.28.0 → bmsdna_devtools-0.29.0}/README.md

@@ -274,6 +274,17 @@ CLI flag beats `[tool.bdt.github].board` in `pyproject.toml`:
 board = "Roadmap"
 ```
 
+## `bdt issue do`
+
+```bash
+bdt issue do 60 [--agent claude] [--dry-run] [extra agent args...]
+```
+
+Hands an issue (GitHub) or work item (Azure DevOps) to a coding agent. Fetches the title and
+description and runs `claude -p "<prompt>" --name "60: <title>"`, so the session is easy to find
+with `claude --resume`. `--agent` picks another executable (it then gets just the prompt as its
+last argument); extra args are passed through; `--dry-run` prints the command.
+
 ## `bdt worktree`
 
 ```bash
@@ -284,6 +295,34 @@ Creates `.worktrees/<name>` branched from `--base`, initializes submodules
 (unless `--no-submodules`), and copies an env file into the new worktree as
 `.env` (auto-detects `.local_env` then `.env` if `--env-file` isn't given).
 
+## `bdt find-repo`
+
+```bash
+bdt find-repo my-repo [--root ~/projects] [--org MYORG] [--github-org MYORG] [--yes] [--pat PAT]
+```
+
+Finds a repo by name: first among the local clones under the work dir, then -- only if there is
+no local match -- in an Azure DevOps org and/or a GitHub org. Names match exactly
+(case-insensitive) if any repo has that name, otherwise by substring. Local matches are printed
+as paths. A single remote-only match is offered for cloning (`--yes` skips the prompt; without a
+TTY it never prompts and just tells you to pass `--yes`); several matches are listed and nothing
+is cloned.
+
+Clone destinations: `<root>/<project>/<repo>` for Azure DevOps, `<root>/github/<repo>` for GitHub.
+
+Configuration (flags override env vars):
+
+| Setting | Flag | Env vars | Default |
+| --- | --- | --- | --- |
+| Local work dir | `--root` | `AZDO_WORK_DIR`, `BMS_WORK_DIR` | `~/projects` (`C:/Projects` on Windows) |
+| Azure DevOps org | `--org` | `AZDO_ORG`, `BMS_ORG` | none (ADO not searched) |
+| GitHub org | `--github-org` | `GITHUB_ORG`, `BMS_GITHUB_ORG` | none (GitHub not searched) |
+| ADO PAT for cloning | `--pat` | `AZURE_DEVOPS_EXT_PAT`, `AZURE_DEVOPS_PAT` | falls back to `az` login |
+
+Set the org env vars in your shell profile to make `bdt find-repo <name>` work anywhere. It replaces
+the `cross-repo-discovery` skill's `ALL_REPOS.md` sync. Needs `az` (ADO) / `gh` (GitHub) only when
+those orgs are searched.
+
 ## `bdt cleanup worktrees` / `bdt cleanup orphaned-dbs` / `bdt cleanup db` / `bdt cleanup worktree`
 
 ```bash
@@ -496,6 +535,10 @@ it can't see through):
 
 - **`sql-inline-too-complex`** — more than a trivial (≤4 line) query, or a
   JOIN/CTE/subquery/aggregation, inline instead of `load_sql()`/a `.sql` file.
+  Simple `INSERT`/`UPDATE`/`DELETE` are exempt from the line limit; `INSERT ... SELECT`,
+  `UPDATE ... FROM` and `DELETE ... USING` still count as complex.
+  Also applied to any `*_sql`/`*_SQL` variable assigned a literal, even if it never reaches an
+  `.execute()` call in the same file (e.g. it's handed to a helper).
 - **`sql-fstring-injection`** / **`sql-concat-injection`** /
   **`sql-percent-format-injection`** / **`sql-format-injection`** — SQL built
   with an f-string, `+` concatenation, the `%` operator, or `str.format()`

{bmsdna_devtools-0.28.0 → bmsdna_devtools-0.29.0}/bmsdna/devtools/cli.py

@@ -15,6 +15,7 @@ from pgdevkit.testdb import constants as pgdevkit_constants
 from . import ado_issue, app_service_logs, commit as commit_mod
 from . import env_config
 from . import find_repo as find_repo_mod
+from . import issue_do as issue_do_mod
 from . import gh_issue, gh_pr
 from . import find_injection as find_injection_mod
 from . import lint as lint_mod
@@ -694,6 +695,31 @@ def issue_search(
         )
 
 
+@issue_app.command("do", context_settings={"allow_extra_args": True, "ignore_unknown_options": True})
+def issue_do(
+    ctx: typer.Context,
+    number: int = typer.Argument(..., help="Issue number (GitHub) or work item ID (Azure DevOps)"),
+    agent: str = typer.Option("claude", "--agent", help="Agent executable to start (claude runs headless: `claude -p ... --name '<number>: <title>'`)"),
+    dry_run: bool = typer.Option(False, "--dry-run", help="Print the agent command instead of running it"),
+    pat: str | None = typer.Option(
+        None,
+        "--pat",
+        envvar=["AZURE_DEVOPS_EXT_PAT", "AZURE_DEVOPS_PAT"],
+        help="Azure DevOps PAT (else falls back to `az` login)",
+    ),
+) -> None:
+    """Start a coding agent on an issue / work item, with the session named '<number>: <title>'.
+    Extra args after the number are passed through to the agent."""
+    remote = current_remote()
+    if isinstance(remote, GitHubRemote):
+        title, body = issue_do_mod.fetch_github(require_gh(), number)
+    else:
+        session = requests.Session()
+        session.headers.update(auth_header(pat))
+        title, body = issue_do_mod.fetch_ado(session, remote, number)
+    issue_do_mod.run(number, title, body, agent=agent, extra=list(ctx.args), dry_run=dry_run)
+
+
 @issue_app.command("update")
 def issue_update(
     number: int = typer.Argument(..., help="Issue number (GitHub) or work item ID (Azure DevOps)"),

bmsdna_devtools-0.29.0/bmsdna/devtools/issue_do.py

@@ -0,0 +1,71 @@
+"""`bdt issue do <number>`: hand an issue / work item to a coding agent.
+
+Fetches the issue's title and description (GitHub via `gh`, Azure DevOps via the REST API)
+and starts the agent headless (`claude -p`), naming the session `<number>: <title>` so it is
+easy to find again with `claude --resume`.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import shutil
+import subprocess
+import sys
+
+import requests
+
+from .ado_issue import _base_url
+from .gitrepo import AdoRemote
+
+_HTML_TAG_RE = re.compile(r"<[^>]+>")
+
+
+def fetch_github(gh: str, number: int) -> tuple[str, str]:
+    result = subprocess.run([gh, "issue", "view", str(number), "--json", "title,body"], capture_output=True, text=True, check=False)
+    if result.returncode != 0:
+        sys.exit(f"gh issue view {number} failed:\n{result.stderr.strip()}")
+    data = json.loads(result.stdout)
+    return data["title"], data.get("body") or ""
+
+
+def fetch_ado(session: requests.Session, remote: AdoRemote, number: int) -> tuple[str, str]:
+    r = session.get(
+        f"{_base_url(remote)}/_apis/wit/workitems/{number}",
+        params={"fields": "System.Title,System.Description", "api-version": "7.1"},
+    )
+    r.raise_for_status()
+    fields = r.json()["fields"]
+    # ADO descriptions are HTML; the agent only needs the text.
+    description = _HTML_TAG_RE.sub("", (fields.get("System.Description") or "").replace("<br>", "\n").replace("</div>", "\n"))
+    return fields["System.Title"], description.strip()
+
+
+def session_name(number: int, title: str) -> str:
+    return f"{number}: {title}"
+
+
+def build_prompt(number: int, title: str, body: str) -> str:
+    return (
+        f"Work on issue {number}: {title}\n\n{body.strip() or '(no description)'}\n\n"
+        "Follow the dev-workflow skill: worktree, draft PR early, implement, test, publish the PR "
+        f"and reference issue {number} in it. Do not merge."
+    )
+
+
+def build_command(agent: str, number: int, title: str, body: str, extra: list[str]) -> list[str]:
+    prompt = build_prompt(number, title, body)
+    if agent == "claude":
+        return [agent, "-p", prompt, "--name", session_name(number, title), *extra]
+    # Other agents: no known naming flag, so just hand over the prompt.
+    return [agent, *extra, prompt]
+
+
+def run(number: int, title: str, body: str, *, agent: str, extra: list[str], dry_run: bool) -> None:
+    cmd = build_command(agent, number, title, body, extra)
+    if dry_run:
+        print(" ".join(json.dumps(c) if " " in c or "\n" in c else c for c in cmd))
+        return
+    if shutil.which(agent) is None:
+        sys.exit(f"'{agent}' is required for this command but wasn't found on PATH.")
+    raise SystemExit(subprocess.run(cmd, check=False).returncode)

{bmsdna_devtools-0.28.0 → bmsdna_devtools-0.29.0}/bmsdna/devtools/lint_sql.py

@@ -280,20 +280,26 @@ def _injection_finding(text: str, path: Path, lineno: int, rule: str, how: str)
     return [Finding(path, lineno, rule, f"SQL built with {how} -- injection risk. {fix}")]
 
 
-def _literal_findings(text: str, path: Path, lineno: int) -> list[Finding]:
-    parsed = parse_sql_text(text)
-    if parsed is None:
-        return []
+def _complexity_findings(parsed: "exp.Expression", text: str, path: Path, lineno: int) -> list[Finding]:
     findings: list[Finding] = []
-
     line_count = len([line for line in text.splitlines() if line.strip()])
-    is_complex = (
-        line_count > 4
-        or parsed.find(exp.Join) is not None
+    has_complex_construct = (
+        parsed.find(exp.Join) is not None
         or parsed.find(exp.With) is not None
         or parsed.find(exp.Subquery) is not None
         or parsed.find(exp.AggFunc) is not None
     )
+    if isinstance(parsed, (exp.Insert, exp.Update, exp.Delete)):
+        # A simple write may span many lines (long column lists) -- only its shape counts:
+        # INSERT ... SELECT, UPDATE ... FROM and DELETE ... USING are query logic, so they're complex.
+        is_complex = (
+            has_complex_construct
+            or parsed.find(exp.Select) is not None
+            or parsed.find(exp.From) is not None
+            or bool(parsed.args.get("using"))
+        )
+    else:
+        is_complex = line_count > 4 or has_complex_construct
     if is_complex:
         findings.append(
             Finding(
@@ -304,6 +310,14 @@ def _literal_findings(text: str, path: Path, lineno: int) -> list[Finding]:
                 "-- move it to its own .sql file and load it with load_sql()/SqlLoader.",
             )
         )
+    return findings
+
+
+def _literal_findings(text: str, path: Path, lineno: int) -> list[Finding]:
+    parsed = parse_sql_text(text)
+    if parsed is None:
+        return []
+    findings = _complexity_findings(parsed, text, path, lineno)
 
     if _POSITIONAL_PARAM_RE.search(text):
         findings.append(
@@ -430,6 +444,12 @@ def _check_query_arg(
     return findings
 
 
+def _is_sql_named(name: str) -> bool:
+    """`FOO_SQL` / `foo_sql` (or a bare `sql`/`SQL`): a variable whose name says it holds SQL text."""
+    lowered = name.lower()
+    return lowered == "sql" or lowered.endswith("_sql")
+
+
 def _execute_query_arg(call: ast.Call) -> ast.expr | None:
     if not (isinstance(call.func, ast.Attribute) and call.func.attr in ("execute", "executemany")):
         return None
@@ -470,12 +490,31 @@ class _ExecuteCallVisitor(ast.NodeVisitor):
     def visit_Assign(self, node: ast.Assign) -> None:
         if len(node.targets) == 1 and isinstance(node.targets[0], ast.Name):
             self._scopes[-1].setdefault(node.targets[0].id, []).append(node.value)
+            self._check_sql_named_literal(node.targets[0].id, node.value, node.lineno)
+        self.generic_visit(node)
+
+    def visit_AnnAssign(self, node: ast.AnnAssign) -> None:
+        if isinstance(node.target, ast.Name) and node.value is not None:
+            self._scopes[-1].setdefault(node.target.id, []).append(node.value)
+            self._check_sql_named_literal(node.target.id, node.value, node.lineno)
         self.generic_visit(node)
 
+    def _check_sql_named_literal(self, name: str, value: ast.expr, lineno: int) -> None:
+        """A `*_sql`/`*_SQL` variable bound to a literal is inline SQL even if it never reaches an
+        `.execute()` call in this file (e.g. it's passed to a helper) -- apply the complexity rule."""
+        if not (_is_sql_named(name) and isinstance(value, ast.Constant) and isinstance(value.value, str)):
+            return
+        parsed = parse_sql_text(value.value)
+        if parsed is not None:
+            self.findings.extend(_complexity_findings(parsed, value.value, self.path, lineno))
+
     def visit_Call(self, node: ast.Call) -> None:
         query_arg = _execute_query_arg(node)
         if query_arg is not None:
-            self.findings.extend(_check_query_arg(query_arg, self._lookup, self.path, node.lineno, self.trust, self.review))
+            found = _check_query_arg(query_arg, self._lookup, self.path, node.lineno, self.trust, self.review)
+            if isinstance(query_arg, ast.Name) and _is_sql_named(query_arg.id):
+                found = [f for f in found if f.rule != "sql-inline-too-complex"]  # already reported at the assignment
+            self.findings.extend(found)
         self.generic_visit(node)
 
 

{bmsdna_devtools-0.28.0 → bmsdna_devtools-0.29.0}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["bmsdna"]
 
 [project]
 name = "bmsdna-devtools"
-version = "0.28.0"
+version = "0.29.0"
 description = "Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects"
 readme = "README.md"
 requires-python = ">=3.14"  # pgdevkit>=0.7.1 requires 3.14; was >=3.11 before adding it as a dependency

bmsdna_devtools-0.29.0/tests/test_issue_do.py

@@ -0,0 +1,20 @@
+from bmsdna.devtools import issue_do
+
+
+def test_claude_command_names_session_and_is_headless() -> None:
+    cmd = issue_do.build_command("claude", 60, "add command", "body text", ["--model", "opus"])
+    assert cmd[:2] == ["claude", "-p"]
+    assert "body text" in cmd[2]
+    assert cmd[3:5] == ["--name", "60: add command"]
+    assert cmd[-2:] == ["--model", "opus"]
+
+
+def test_other_agent_gets_prompt_last() -> None:
+    cmd = issue_do.build_command("codex", 7, "t", "", ["exec"])
+    assert cmd[:2] == ["codex", "exec"]
+    assert "(no description)" in cmd[2]
+
+
+def test_dry_run_prints(capsys) -> None:
+    issue_do.run(1, "x", "y", agent="claude", extra=[], dry_run=True)
+    assert '"1: x"' in capsys.readouterr().out

{bmsdna_devtools-0.28.0 → bmsdna_devtools-0.29.0}/tests/test_lint_sql.py

@@ -294,3 +294,76 @@ def c(cur):
     path.write_text(source)
     assert sorted(f.rule for f in check_sql_file(path)) == ["sql-fstring-injection"]
     assert sorted(f.rule for f in check_sql_file(path, review=True)) == ["sql-fstring-injection", "sql-unverified-cast"]
+
+
+def test_long_simple_insert_update_delete_allowed_inline(tmp_path: Path) -> None:
+    source = '''
+async def f(cur):
+    await cur.execute(
+        """
+        insert into dim.customer (
+            id,
+            name,
+            email,
+            active
+        ) values (%(id)s, %(name)s, %(email)s, true)
+        on conflict (id) do update set name = excluded.name
+        """,
+        {},
+    )
+    await cur.execute(
+        """
+        update dim.customer
+        set name = %(name)s,
+            email = %(email)s,
+            active = false
+        where id = %(id)s
+        """,
+        {},
+    )
+    await cur.execute(
+        """
+        delete from dim.customer
+        where id = %(id)s
+          and active = false
+          and email is null
+        """,
+        {},
+    )
+'''
+    assert "sql-inline-too-complex" not in _rules(_findings(source, tmp_path / "a.py"))
+
+
+def test_insert_select_and_update_from_still_too_complex(tmp_path: Path) -> None:
+    source = '''
+async def f(cur):
+    await cur.execute("insert into a (id) select id from b")
+    await cur.execute("update a set x = b.x from b where a.id = b.id")
+    await cur.execute("delete from a using b where a.id = b.id")
+'''
+    findings = _findings(source, tmp_path / "a.py")
+    assert [f.rule for f in findings].count("sql-inline-too-complex") == 3
+
+
+_COMPLEX_SELECT = '''"""
+select a.id, p.price
+from core.dim_article a
+left join core.dim_price p on p.article_id = a.id
+where a.active
+"""'''
+
+
+def test_sql_named_variable_with_complex_literal_flagged_without_execute(tmp_path: Path) -> None:
+    source = f"ARTICLES_SQL = {_COMPLEX_SELECT}\nother_sql: str = {_COMPLEX_SELECT}\nnot_a_query = {_COMPLEX_SELECT}\n"
+    findings = _findings(source, tmp_path / "a.py")
+    assert [(f.rule, f.line) for f in findings] == [("sql-inline-too-complex", 1), ("sql-inline-too-complex", 7)]
+
+
+def test_sql_named_variable_simple_or_dml_not_flagged(tmp_path: Path) -> None:
+    source = 'GET_SQL = "select id from t where id = %(id)s"\nINSERT_SQL = """\ninsert into t (\n a,\n b,\n c,\n d\n) values (1, 2, 3, 4)\n"""\n'
+    assert _findings(source, tmp_path / "a.py") == []
+
+
+def test_sql_named_variable_used_in_execute_reported_once(tmp_path: Path) -> None:
+    source = f"ARTICLES_SQL = {_COMPLEX_SELECT}\n\ndef f(cur):\n    cur.execute(ARTICLES_SQL)\n"
+    assert len(_findings(source, tmp_path / "a.py")) == 1

{bmsdna_devtools-0.28.0 → bmsdna_devtools-0.29.0}/uv.lock

@@ -22,7 +22,7 @@ wheels = [
 
 [[package]]
 name = "bmsdna-devtools"
-version = "0.28.0"
+version = "0.29.0"
 source = { editable = "." }
 dependencies = [
     { name = "pgdevkit", extra = ["db"] },