boomtick-cli 0.4.0__tar.gz → 0.5.1__tar.gz

{boomtick_cli-0.4.0 → boomtick_cli-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boomtick-cli
-Version: 0.4.0
+Version: 0.5.1
 Summary: BoomTick CLI — agentic dev-tools for GitHub + AI workflows
 Author: Ariel Anders
 Project-URL: Homepage, https://github.com/arii/boomtick

{boomtick_cli-0.4.0 → boomtick_cli-0.5.1}/boomtick_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boomtick-cli
-Version: 0.4.0
+Version: 0.5.1
 Summary: BoomTick CLI — agentic dev-tools for GitHub + AI workflows
 Author: Ariel Anders
 Project-URL: Homepage, https://github.com/arii/boomtick

boomtick_cli-0.5.1/dev_tools/resources/prompt_constants.json

@@ -0,0 +1,5 @@
+{
+  "STRICT_JSON_VERIFICATION": "Strict JSON Verification:\n- You MUST self-verify the completeness and validity of the JSON block before finishing your response.\n- Every finding MUST have an `id`, `file`, `issue`, and `status`.\n- Ensure the JSON is well-formed and contained entirely within the `<findings>` tags.\n- Ensure 'snippet' is a unique string from the diff that identifies the issue.",
+  "SNIPPET_AND_VERIFICATION_RULES": "Snippet and verification rules:\n- STRICT SNIPPET RULE: When citing an error or anti-pattern, you MUST quote the entire, exact line from the diff in the \"snippet\" field. Do not truncate the line.\n- Before flagging a \"syntax error\" or \"missing property/method\", re-read the diff to confirm the code isn't simply continued on the next line or truncated in the diff chunk. Hallucinating errors due to chunk truncation is a severe failure.\n- If a line appears truncated in the diff (e.g. at the edge of a chunk), DO NOT assume it is a syntax error. Assume it is valid code that continues outside the visible context.",
+  "COMMON_REVIEW_GUIDELINES": "Review ONLY PR changes. Assume original code worked.\nEVIDENCE RULE: A blocking concern must point to a concrete contradiction in the diff itself (e.g., wrong types, nonexistent function/class, wrong arity, or failing test). Cite exact lines and explain runtime consequence.\nFALSE POSITIVE FILTER: No speculation. Concerns phrased with speculative hedging language (e.g., \"could\", \"might\", \"unless\", \"if not handled properly\") are NOT blocking. Reviewers must not raise concerns they cannot verify against the code provided; instead, they should state what would be needed to verify, avoiding assumptions of the worst case.\n\nTIERED SCOPE:\n- For App/UI (src/): Flag redundant wrappers. BANNED: Raw Tailwind layout (flex/grid/px-*) in TSX (use Stack/Grid/Box).\n- For Infra/Tooling (scripts/, cli/, .github/): Focus on portability, idempotency, and error handling. Avoid UI-specific feedback for low-level scripts.\n\nREPO RULES: Prefer removal.\nANTI-SLOP: DO NOT recommend overly complex error handling, defensive guards, extra unit tests for simple internal scripts, or boilerplate documentation/comments.\n\n- FILE NECESSITY: Question any added, moved, or removed files that look like temporary artifacts (e.g. .tmp, standalone .py in root, audit-*.md, .json dumps) or seem unrelated to the PR intent. Flag them for removal if they pollute the review context."
+}

{boomtick_cli-0.4.0 → boomtick_cli-0.5.1}/dev_tools/services/dependency_graph.py

@@ -1,4 +1,5 @@
-# pylint: disable=missing-docstring,raise-missing-from,subprocess-run-check
+# pylint: disable=missing-docstring,raise-missing-from,subprocess-run-check,too-many-branches,too-many-nested-blocks
+from collections import deque
 import json
 import os
 import subprocess
@@ -7,6 +8,41 @@ from typing import Dict, List, Set
 from dev_tools.utils import CLIError, log_error, log_warn
 
 
+def validate_and_sanitize_graph_data(data: dict) -> dict:
+    """Validates and sanitizes the dependency graph data structure."""
+    if not isinstance(data, dict):
+        raise ValueError("Graph data must be a dictionary")
+
+    sanitized = {}
+    if "modules" in data:
+        if not isinstance(data["modules"], list):
+            raise ValueError("modules must be a list")
+        sanitized["modules"] = []
+        for mod in data["modules"]:
+            if not isinstance(mod, dict):
+                raise ValueError("Module must be a dictionary")
+            sanitized_mod = {}
+            if "source" in mod:
+                if not isinstance(mod["source"], str):
+                    raise ValueError("source must be a string")
+                sanitized_mod["source"] = mod["source"]
+            if "dependencies" in mod:
+                if not isinstance(mod["dependencies"], list):
+                    raise ValueError("dependencies must be a list")
+                sanitized_mod["dependencies"] = []
+                for dep in mod["dependencies"]:
+                    if not isinstance(dep, dict):
+                        raise ValueError("Dependency must be a dictionary")
+                    sanitized_dep = {}
+                    if "resolved" in dep:
+                        if not isinstance(dep["resolved"], str):
+                            raise ValueError("resolved must be a string")
+                        sanitized_dep["resolved"] = dep["resolved"]
+                    sanitized_mod["dependencies"].append(sanitized_dep)
+            sanitized["modules"].append(sanitized_mod)
+    return sanitized
+
+
 class DependencyGraph:
     def __init__(self, root_dir: str = "."):
         self.root_dir = root_dir
@@ -64,15 +100,22 @@ class DependencyGraph:
                     log_error(f"pnpm or depcruise not found or failed: {e}")
                     raise CLIError("pnpm or depcruise not found. Ensure dependencies are installed.")
 
-                if data and data.get("modules"):
-                    # Cache it
+                # Validate the parsed data before caching
+                validated_data = validate_and_sanitize_graph_data(data)
+
+                if validated_data and validated_data.get("modules"):
+                    # Cache the validated data
                     os.makedirs(os.path.dirname(cache_path), exist_ok=True)
                     with open(cache_path, "w", encoding="utf-8") as f:
-                        json.dump(data, f)
-
-            self._parse_modules(data.get("modules", []))
-        except CLIError:
-            raise
+                        json.dump(validated_data, f)
+                    data = validated_data
+
+            # Ensure cached data is also validated and sanitized
+            validated_data = validate_and_sanitize_graph_data(data)
+            self._parse_modules(validated_data.get("modules", []))
+        except (CLIError, ValueError) as e:
+            log_error(f"Failed loading/validating dependency graph: {e}")
+            raise CLIError(f"Dependency graph loading or validation failed: {e}")
         except Exception as e:
             log_error(f"loading dependency graph: {e}")
             self.graph = {}
@@ -104,11 +147,12 @@ class DependencyGraph:
     def find_affected_files(self, changed_files: List[str], depth: int = 2) -> Set[str]:
         """Recursively finds files affected by the changes."""
         affected = set()
-        queue = [(f, 0) for f in changed_files]
+        visited = set(changed_files)
+        queue = deque([(f, 0) for f in changed_files])
 
         while queue:
-            file, current_depth = queue.pop(0)
-            if file in affected or current_depth > depth:
+            file, current_depth = queue.popleft()
+            if current_depth > depth:
                 continue
 
             if current_depth > 0:  # Don't add the changed files themselves if we want only 'affected'
@@ -116,7 +160,9 @@ class DependencyGraph:
 
             dependents = self.get_dependents(file)
             for dep in dependents:
-                queue.append((dep, current_depth + 1))
+                if dep not in visited:
+                    visited.add(dep)
+                    queue.append((dep, current_depth + 1))
 
         return affected
 

{boomtick_cli-0.4.0 → boomtick_cli-0.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "boomtick-cli"
-version = "0.4.0"
+version = "0.5.1"
 description = "BoomTick CLI — agentic dev-tools for GitHub + AI workflows"
 authors = [{name = "Ariel Anders"}]
 readme = "README.md"

boomtick_cli-0.5.1/tests/test_dependency_graph.py

@@ -0,0 +1,90 @@
+# pylint: disable=missing-docstring,too-many-branches,too-many-nested-blocks,line-too-long
+import json
+
+from dev_tools.services.dependency_graph import DependencyGraph, validate_and_sanitize_graph_data
+
+
+def test_dependency_graph_parsing(tmp_path):
+    graph_data = {
+        "modules": [
+            {"source": "src/a.ts", "dependencies": [{"resolved": "src/b.ts"}]},
+            {"source": "src/b.ts", "dependencies": []},
+        ]
+    }
+    validated_data = validate_and_sanitize_graph_data(graph_data)
+
+    # Create a dummy artifact
+    artifact_dir = tmp_path / "artifacts"
+    artifact_dir.mkdir()
+    graph_file = artifact_dir / "dependency-graph.json"
+    graph_file.write_text(json.dumps(validated_data))
+
+    # Instantiate with tmp_path
+    dg = DependencyGraph(root_dir=str(tmp_path))
+
+    assert dg.get_dependencies("src/a.ts") == ["src/b.ts"]
+    assert dg.get_dependents("src/b.ts") == ["src/a.ts"]
+
+    # Create the file so it exists
+    src_dir = tmp_path / "src"
+    src_dir.mkdir(exist_ok=True)
+    (src_dir / "b.ts").touch()
+
+    assert dg.get_context_files(["src/a.ts"]) == ["src/b.ts"]
+
+
+def test_find_affected_files_complex(tmp_path):
+    # D depends on C and B, C depends on A, B depends on A
+    # Wait, reverse graph: dependents of A are B and C, dependents of B is D, dependents of C is D
+    # A is changed. Dependents of A: B, C.
+    # Dependents of B: D. Dependents of C: D.
+    # Multiple paths to D: A -> B -> D, and A -> C -> D.
+    graph_data = {
+        "modules": [
+            {"source": "src/d.ts", "dependencies": [{"resolved": "src/b.ts"}, {"resolved": "src/c.ts"}]},
+            {"source": "src/b.ts", "dependencies": [{"resolved": "src/a.ts"}]},
+            {"source": "src/c.ts", "dependencies": [{"resolved": "src/a.ts"}]},
+            {"source": "src/a.ts", "dependencies": []},
+        ]
+    }
+    validated_data = validate_and_sanitize_graph_data(graph_data)
+
+    artifact_dir = tmp_path / "artifacts"
+    artifact_dir.mkdir(exist_ok=True)
+    graph_file = artifact_dir / "dependency-graph.json"
+    graph_file.write_text(json.dumps(validated_data))
+
+    dg = DependencyGraph(root_dir=str(tmp_path))
+
+    # A changed, depth=2.
+    # Level 1: B, C (depth 1)
+    # Level 2: D, D (depth 2) -> if we did not have visited/affected check before push, D would be added twice!
+    affected = dg.find_affected_files(["src/a.ts"], depth=2)
+    assert affected == {"src/b.ts", "src/c.ts", "src/d.ts"}
+
+    # With depth=1, only B and C should be affected
+    affected_depth_1 = dg.find_affected_files(["src/a.ts"], depth=1)
+    assert affected_depth_1 == {"src/b.ts", "src/c.ts"}
+
+
+def test_find_affected_files_cycle(tmp_path):
+    # Cyclic dependencies: A depends on B, B depends on A (so dependents are mutual)
+    graph_data = {
+        "modules": [
+            {"source": "src/a.ts", "dependencies": [{"resolved": "src/b.ts"}]},
+            {"source": "src/b.ts", "dependencies": [{"resolved": "src/a.ts"}]},
+        ]
+    }
+    validated_data = validate_and_sanitize_graph_data(graph_data)
+
+    artifact_dir = tmp_path / "artifacts"
+    artifact_dir.mkdir(exist_ok=True)
+    graph_file = artifact_dir / "dependency-graph.json"
+    graph_file.write_text(json.dumps(validated_data))
+
+    dg = DependencyGraph(root_dir=str(tmp_path))
+
+    affected = dg.find_affected_files(["src/a.ts"], depth=2)
+    # Changed file itself is excluded from affected since current_depth > 0.
+    # Dependents of A: B. Dependents of B: A (but A was in changed_files, hence visited initially, so it won't be traversed again).
+    assert affected == {"src/b.ts"}

boomtick_cli-0.4.0/dev_tools/resources/prompt_constants.json

@@ -1,5 +0,0 @@
-{
-  "STRICT_JSON_VERIFICATION": "Strict JSON Verification:\n- You MUST self-verify the completeness and validity of the JSON block before finishing your response.\n- Every finding MUST have an `id`, `file`, `issue`, and `status`.\n- Ensure the JSON is well-formed and contained entirely within the `<findings>` tags.\n- Ensure 'snippet' is a unique string from the diff that identifies the issue.",
-  "SNIPPET_AND_VERIFICATION_RULES": "Snippet and verification rules:\n- STRICT SNIPPET RULE: When citing an error or anti-pattern, you MUST quote the entire, exact line from the diff in the \"snippet\" field. Do not truncate the line.\n- Before flagging a \"syntax error\" or \"missing property/method\", re-read the diff to confirm the code isn't simply continued on the next line or truncated in the diff chunk. Hallucinating errors due to chunk truncation is a severe failure.\n- If a line appears truncated in the diff (e.g. at the edge of a chunk), DO NOT assume it is a syntax error. Assume it is valid code that continues outside the visible context.",
-  "COMMON_REVIEW_GUIDELINES": "Review ONLY PR changes. Assume original code worked.\nEVIDENCE RULE: Issue must point to exact line + explain runtime consequence.\nFALSE POSITIVE FILTER: No speculation. Design choices are NOT bugs.\n\nTIERED SCOPE:\n- For App/UI (src/): Flag redundant wrappers. BANNED: Raw Tailwind layout (flex/grid/px-*) in TSX (use Stack/Grid/Box).\n- For Infra/Tooling (scripts/, cli/, .github/): Focus on portability, idempotency, and error handling. Avoid UI-specific feedback for low-level scripts.\n\nREPO RULES: Prefer removal.\nANTI-SLOP: DO NOT recommend overly complex error handling, defensive guards, extra unit tests for simple internal scripts, or boilerplate documentation/comments.\n\n- FILE NECESSITY: Question any added, moved, or removed files that look like temporary artifacts (e.g. .tmp, standalone .py in root, audit-*.md, .json dumps) or seem unrelated to the PR intent. Flag them for removal if they pollute the review context."
-}

boomtick_cli-0.4.0/tests/test_dependency_graph.py

@@ -1,32 +0,0 @@
-# pylint: disable=missing-docstring
-import json
-
-from dev_tools.services.dependency_graph import DependencyGraph
-
-
-def test_dependency_graph_parsing(tmp_path):
-    graph_data = {
-        "modules": [
-            {"source": "src/a.ts", "dependencies": [{"resolved": "src/b.ts"}]},
-            {"source": "src/b.ts", "dependencies": []},
-        ]
-    }
-
-    # Create a dummy artifact
-    artifact_dir = tmp_path / "artifacts"
-    artifact_dir.mkdir()
-    graph_file = artifact_dir / "dependency-graph.json"
-    graph_file.write_text(json.dumps(graph_data))
-
-    # Instantiate with tmp_path
-    dg = DependencyGraph(root_dir=str(tmp_path))
-
-    assert dg.get_dependencies("src/a.ts") == ["src/b.ts"]
-    assert dg.get_dependents("src/b.ts") == ["src/a.ts"]
-
-    # Create the file so it exists
-    src_dir = tmp_path / "src"
-    src_dir.mkdir(exist_ok=True)
-    (src_dir / "b.ts").touch()
-
-    assert dg.get_context_files(["src/a.ts"]) == ["src/b.ts"]