code-coordinator 0.5.195__tar.gz → 0.5.196__tar.gz

{code_coordinator-0.5.195 → code_coordinator-0.5.196}/.github/workflows/test.yml

@@ -153,6 +153,39 @@ jobs:
       # gated separately through the #2164 CI wrapper.
       - run: scripts/run_tests_without_gh.sh python -m pytest tests/ -q --ignore=tests/acceptance
 
+  # #2135 (child of epic #1902): "every `gh` argv construction lives inside
+  # coord/github_ops.py" is the load-bearing assumption under the #1902
+  # forge-portability cost estimate — it's the fact that makes the eventual
+  # port a refactor instead of a rewrite. #1483 already guarded direct
+  # call-argument leaks with an AST scan (formerly
+  # tests/test_no_direct_gh_calls.py), but that walk missed the
+  # variable-indirection shape (`cmd = ["gh", ...]; subprocess.run(cmd)`).
+  # This job's dedicated regex scan catches that gap too, so
+  # test_no_direct_gh_calls.py was retired in its favor rather than kept
+  # running alongside it as a second, disagreeing implementation of the
+  # same invariant (#2135 review) — see scripts/check_gh_argv_containment.py's
+  # module docstring for the full reconciliation.
+  #
+  # scripts/check_gh_argv_containment.py scans coord/**/*.py for a bare
+  # `"gh"`/`'gh'` token outside coord/github_ops.py, with one explicit,
+  # commented allowlist entry for coord/prereqs.py's binary-version probe
+  # (it checks `gh` is installed; it doesn't drive the forge). See that
+  # script's module docstring for the full rationale and
+  # tests/test_check_gh_argv_containment.py for the negative-test proof
+  # that the guard can actually fail.
+  #
+  # Stdlib-only (re/pathlib/dataclasses), so no `pip install` needed here —
+  # this is meant to be as cheap as `no-gh-on-path` above, a grep-shaped
+  # check, not a build step.
+  gh-argv-containment:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python scripts/check_gh_argv_containment.py .
+
   # #2170: run the full suite in the environment of a REAL FLEET MACHINE — a
   # populated `~/.coord/` (thin-client shaped), no `sqlite3` on PATH, and a
   # `$TMPDIR` under an ancestor pytest config.

{code_coordinator-0.5.195 → code_coordinator-0.5.196}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.195
+Version: 0.5.196
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.195 → code_coordinator-0.5.196}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.195
+Version: 0.5.196
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.195 → code_coordinator-0.5.196}/code_coordinator.egg-info/SOURCES.txt

@@ -309,6 +309,7 @@ docs/mocks/web/pipeline-narrow.html
 docs/mocks/web/pipeline-wide.html
 graphify-out/.gitignore
 scripts/audit_review_verdict_overrides.py
+scripts/check_gh_argv_containment.py
 scripts/codegen.py
 scripts/coord-test-runner.sh
 scripts/drive-batch.sh
@@ -379,6 +380,7 @@ tests/test_branch_model.py
 tests/test_bug_intake.py
 tests/test_build_worker_image_env_update.py
 tests/test_cargo_cache.py
+tests/test_check_gh_argv_containment.py
 tests/test_ci_acceptance_gate_1950.py
 tests/test_ci_parity_2091.py
 tests/test_ci_store.py
@@ -554,7 +556,6 @@ tests/test_needs_attention.py
 tests/test_network.py
 tests/test_new_issue_chat.py
 tests/test_next_release_tag.py
-tests/test_no_direct_gh_calls.py
 tests/test_node_shim.py
 tests/test_notifier_baseline.py
 tests/test_notifier_cli.py

{code_coordinator-0.5.195 → code_coordinator-0.5.196}/code_coordinator.egg-info/scm_file_list.json

@@ -313,6 +313,7 @@
     "scripts/azure-workers/scrub-and-generalize.sh",
     "scripts/azure-workers/tailnet-acl.hujson",
     "scripts/azure-workers/verify-github-token.sh",
+    "scripts/check_gh_argv_containment.py",
     "scripts/codegen.py",
     "scripts/coord-test-runner.sh",
     "scripts/drive-batch.sh",
@@ -441,6 +442,7 @@
     "tests/test_bug_intake.py",
     "tests/test_build_worker_image_env_update.py",
     "tests/test_cargo_cache.py",
+    "tests/test_check_gh_argv_containment.py",
     "tests/test_ci_acceptance_gate_1950.py",
     "tests/test_ci_parity_2091.py",
     "tests/test_ci_store.py",
@@ -616,7 +618,6 @@
     "tests/test_network.py",
     "tests/test_new_issue_chat.py",
     "tests/test_next_release_tag.py",
-    "tests/test_no_direct_gh_calls.py",
     "tests/test_node_shim.py",
     "tests/test_notifier_baseline.py",
     "tests/test_notifier_cli.py",

{code_coordinator-0.5.195 → code_coordinator-0.5.196}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.195",
+  "tag": "0.5.196",
   "distance": 0,
-  "node": "g2bb7d7ad4f498cd537a6acf1e85b0ee9e8573117",
+  "node": "g049ba86f1fa5713231873ab0a75ea2fa2c2fe27f",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-21"

code_coordinator-0.5.196/scripts/check_gh_argv_containment.py

@@ -0,0 +1,176 @@
+#!/usr/bin/env python3
+"""check_gh_argv_containment.py -- CI guard for #2135 (child of epic #1902).
+
+The epic's headline finding (#1902) is that **every `["gh", ...]` argv
+construction in this repo already lives inside `coord/github_ops.py`** --
+that single fact is what makes the eventual forge-portability port a
+*refactor* instead of a rewrite, and it is the load-bearing assumption
+under the whole #1902 cost estimate. Until this script, that invariant was
+protected by nothing but convention: whoever last thought to grep for it.
+
+Same spirit as `scripts/run_tests_without_gh.sh` (#1484, the `no-gh-on-path`
+CI job) -- that script proved `gh` calls are *mockable* by making the
+binary unresolvable and watching the suite still pass; this script proves
+they are *contained* by refusing any `gh` argv construction that lives
+outside the one file that owns them. Deliberately kept a plain regex scan,
+not an AST walk -- cheap enough to run on every PR, and the invariant it
+guards ("does this file spell the literal string `gh` as its own quoted
+token") does not need a parser to detect.
+
+Supersedes `tests/test_no_direct_gh_calls.py` (#1483's original AST-based
+guard for this same invariant, added when only `github_ops.py`'s
+call-site shape needed catching). #2135 review flagged that the two
+guards were an undocumented split-brain: the AST walk only fires when a
+`["gh", ...]` literal is a *direct call argument*
+(`subprocess.run(["gh", ...])`), so it silently missed the
+variable-indirection shape (`cmd = ["gh", ...]; subprocess.run(cmd)`) that
+this regex scan does catch, since it matches the token wherever it sits on
+the line. Rather than keep two independently-maintained implementations of
+one invariant with two different blind spots, `test_no_direct_gh_calls.py`
+was deleted and this script is now the single implementation, exercised
+both by the dedicated `gh-argv-containment` CI job (`.github/workflows/
+test.yml`) and by the ordinary `pytest tests/` run, via
+`tests/test_check_gh_argv_containment.py::test_real_tree_is_clean` and
+friends -- one scan, reachable both ways, per the repo's "one question,
+one answer" rule (epic #2096). The trade-off this leaves: being a plain
+token scan rather than an AST walk, it can false-positive on a `"gh"`
+token that isn't argv (e.g. inside a docstring or an unrelated string
+literal) -- accepted deliberately, since a false positive costs an
+allowlist entry or a reword, while a false negative (the AST gap above)
+costs a silent regression of the epic's #1902 load-bearing assumption.
+
+Usage:
+    python scripts/check_gh_argv_containment.py [repo-root]
+
+Exit codes: 0 if the tree is clean, 1 if a `gh` argv construction is found
+in coord/**/*.py outside coord/github_ops.py.
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+SEAM = "coord/github_ops.py"
+
+# Matches a bare `"gh"` or `'gh'` token -- the exact spelling every gh argv
+# construction in this repo starts with, whether written `["gh", ...]`,
+# `("gh", ...)`, or (as in github_ops.py's PR-checks call, where the list is
+# opened on the previous line) as a bare leading element `"gh", "pr", ...,`.
+# The closing quote must land immediately after the 'h', so this does not
+# match longer identifiers that merely contain "gh", like "github" or
+# "ghost".
+_GH_TOKEN_RE = re.compile(r"""(["'])gh\1""")
+
+# Explicit allowlist: (file, substring-of-the-matched-line) pairs for
+# known-legitimate `gh` mentions outside the seam. Keyed on line CONTENT,
+# not a line number -- numbers drift as a file changes (this very entry's
+# line moved from prereqs.py:288, where #2135 was filed, to prereqs.py:290
+# by the time this script was written), and a number-keyed allowlist would
+# either miss a real leak that later lands on that number, or stop
+# exempting the intended line the moment it shifts.
+#
+# Add an entry here ONLY with a comment explaining why the mention is not
+# an argv construction -- a loose pattern (e.g. "any line in prereqs.py")
+# would let a real leak through under cover of the exemption, which is
+# exactly the failure mode this script exists to prevent.
+_ALLOWLIST: tuple[tuple[str, str], ...] = (
+    (
+        "coord/prereqs.py",
+        'tool="gh", binary="gh"',
+    ),
+    # ^ Prereq(tool="gh", binary="gh", version_args=("--version",), ...)
+    # probes for the `gh` BINARY's presence/version via shutil.which +
+    # `gh --version` -- it does not drive the forge, so it correctly lives
+    # outside the seam (#2135).
+)
+
+
+@dataclass(frozen=True)
+class Violation:
+    path: str
+    lineno: int
+    line: str
+
+
+def _is_allowlisted(rel_path: str, line: str) -> bool:
+    return any(
+        rel_path == allow_path and allow_substr in line
+        for allow_path, allow_substr in _ALLOWLIST
+    )
+
+
+def find_violations(repo_root: Path) -> list[Violation]:
+    """Scan coord/**/*.py for `gh` argv construction outside the seam.
+
+    Pure function of the filesystem under ``repo_root`` -- no subprocess,
+    no network -- so it is cheap to point at a synthetic fixture tree in
+    tests, not just the real repo.
+    """
+    violations: list[Violation] = []
+    coord_dir = repo_root / "coord"
+    if not coord_dir.is_dir():
+        return violations
+    for path in sorted(coord_dir.rglob("*.py")):
+        rel = path.relative_to(repo_root).as_posix()
+        if rel == SEAM:
+            continue
+        try:
+            text = path.read_text(encoding="utf-8")
+        except (UnicodeDecodeError, OSError) as exc:
+            # Every file under coord/ is expected to be UTF-8 Python
+            # source, so this should never actually fire -- but if it
+            # ever does, skipping silently would mean a real `gh` leak in
+            # that file goes undetected with no trace. Surface it on
+            # stderr rather than swallow it (#2135 review).
+            print(
+                f"check_gh_argv_containment: skipping {rel} "
+                f"(unreadable: {exc}) -- unable to scan for `gh` argv "
+                f"construction in this file",
+                file=sys.stderr,
+            )
+            continue
+        for lineno, line in enumerate(text.splitlines(), start=1):
+            if _GH_TOKEN_RE.search(line) and not _is_allowlisted(rel, line):
+                violations.append(Violation(rel, lineno, line.strip()))
+    return violations
+
+
+def format_report(violations: list[Violation]) -> str:
+    lines = [
+        f"check_gh_argv_containment: found `gh` argv construction outside "
+        f"{SEAM}:",
+        "",
+    ]
+    for v in violations:
+        lines.append(f"  {v.path}:{v.lineno}: {v.line}")
+    lines += [
+        "",
+        "Every `gh` invocation must go through coord/github_ops.py -- that "
+        "chokepoint is the load-bearing assumption behind the #1902 "
+        "forge-portability epic (it's what makes the eventual port a "
+        "refactor instead of a rewrite), and it's what makes `gh` mockable "
+        "for tests (the no-gh-on-path CI job, #1484, depends on it too).",
+        "",
+        'Fix: move this call into coord/github_ops.py. If it is a genuine '
+        'non-forge use of the literal string "gh" (like the binary-version '
+        "probe in coord/prereqs.py), add it to the ALLOWLIST in "
+        "scripts/check_gh_argv_containment.py with a comment explaining "
+        "why -- see #2135.",
+    ]
+    return "\n".join(lines)
+
+
+def main(argv: list[str]) -> int:
+    repo_root = Path(argv[1]) if len(argv) > 1 else Path(".")
+    violations = find_violations(repo_root.resolve())
+    if not violations:
+        return 0
+    print(format_report(violations), file=sys.stderr)
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

code_coordinator-0.5.196/tests/test_check_gh_argv_containment.py

@@ -0,0 +1,156 @@
+"""#2135 (child of epic #1902): CI guard for the gh-argv containment
+invariant -- "every `gh` argv construction lives inside
+coord/github_ops.py".
+
+This is build tooling with no user-visible behavior, so it's exempt from
+the black-box acceptance bar (CLAUDE.md's "Testing" section) -- but per
+that same section's note on this issue, a guard that cannot fail is worse
+than no guard, so this file's job is proving the negative case: a
+deliberately-introduced `gh` argv construction outside the seam actually
+trips scripts/check_gh_argv_containment.py.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from scripts.check_gh_argv_containment import find_violations, format_report
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+
+
+def test_real_tree_is_clean() -> None:
+    """The acceptance bar from #2135: the current tree passes today, with
+    coord/prereqs.py exempted by explicit allowlist rather than by
+    accident (i.e. its exemption is on record, not just an absence of
+    other violations)."""
+    violations = find_violations(REPO_ROOT)
+    assert violations == [], format_report(violations)
+
+
+def test_prereqs_binary_probe_is_allowlisted_not_absent() -> None:
+    """Guard against the allowlist silently becoming dead code: prove
+    coord/prereqs.py actually contains a `gh` token that the scan visits
+    and exempts, not that the scanner simply never looks at that file."""
+    prereqs = REPO_ROOT / "coord" / "prereqs.py"
+    text = prereqs.read_text(encoding="utf-8")
+    assert 'tool="gh", binary="gh"' in text, (
+        "coord/prereqs.py's Prereq(tool=\"gh\", binary=\"gh\", ...) moved or "
+        "was rewritten -- update the ALLOWLIST entry (and this test) to "
+        "match its new shape, per #2135."
+    )
+
+
+def test_deliberate_leak_outside_the_seam_is_caught(tmp_path: Path) -> None:
+    """The acceptance criterion from #2135: a deliberately-added
+    `subprocess.run(["gh", "pr", "view", "1"])` in any coord/*.py other
+    than github_ops.py fails the check."""
+    coord_dir = tmp_path / "coord"
+    coord_dir.mkdir()
+    (coord_dir / "github_ops.py").write_text(
+        'import subprocess\n'
+        'subprocess.run(["gh", "pr", "view", "1"])\n',
+        encoding="utf-8",
+    )
+    leaky = coord_dir / "review.py"
+    leaky.write_text(
+        'import subprocess\n'
+        '\n'
+        'def peek(number):\n'
+        '    subprocess.run(["gh", "pr", "view", str(number)])\n',
+        encoding="utf-8",
+    )
+
+    violations = find_violations(tmp_path)
+
+    assert len(violations) == 1
+    v = violations[0]
+    assert v.path == "coord/review.py"
+    assert v.lineno == 4
+    assert '"gh"' in v.line
+
+    report = format_report(violations)
+    assert "coord/review.py:4" in report
+    assert "coord/github_ops.py" in report
+
+
+def test_single_and_double_quote_forms_are_both_caught(tmp_path: Path) -> None:
+    """Requirement from #2135: detect both quote styles."""
+    coord_dir = tmp_path / "coord"
+    coord_dir.mkdir()
+    (coord_dir / "github_ops.py").write_text("# the seam\n", encoding="utf-8")
+    (coord_dir / "leaky_double.py").write_text(
+        'CMD = ["gh", "pr", "list"]\n', encoding="utf-8"
+    )
+    (coord_dir / "leaky_single.py").write_text(
+        "CMD = ('gh', 'pr', 'list')\n", encoding="utf-8"
+    )
+
+    violations = find_violations(tmp_path)
+
+    flagged = {v.path for v in violations}
+    assert flagged == {"coord/leaky_double.py", "coord/leaky_single.py"}
+
+
+def test_explicit_allowlist_entry_is_exempted(tmp_path: Path) -> None:
+    """The allowlist is content-keyed, not a blanket per-file exemption:
+    the exact allowlisted line is spared, but the file is otherwise still
+    scanned."""
+    coord_dir = tmp_path / "coord"
+    coord_dir.mkdir()
+    (coord_dir / "github_ops.py").write_text("# the seam\n", encoding="utf-8")
+    (coord_dir / "prereqs.py").write_text(
+        'Prereq(\n'
+        '    tool="gh", binary="gh", version_args=("--version",),\n'
+        ')\n',
+        encoding="utf-8",
+    )
+
+    violations = find_violations(tmp_path)
+
+    assert violations == []
+
+
+def test_allowlist_does_not_blanket_exempt_other_gh_leaks_in_same_file(
+    tmp_path: Path,
+) -> None:
+    """A loose allowlist ("any line in prereqs.py") would let a real leak
+    through under cover of the exemption -- exactly the failure mode
+    #2135 calls out. This pins the allowlist to line CONTENT, so an
+    unrelated `gh` argv construction added to the same file is still
+    caught."""
+    coord_dir = tmp_path / "coord"
+    coord_dir.mkdir()
+    (coord_dir / "github_ops.py").write_text("# the seam\n", encoding="utf-8")
+    (coord_dir / "prereqs.py").write_text(
+        'Prereq(\n'
+        '    tool="gh", binary="gh", version_args=("--version",),\n'
+        ')\n'
+        '\n'
+        'import subprocess\n'
+        'subprocess.run(["gh", "pr", "view", "1"])\n',
+        encoding="utf-8",
+    )
+
+    violations = find_violations(tmp_path)
+
+    assert len(violations) == 1
+    assert violations[0].path == "coord/prereqs.py"
+    assert violations[0].lineno == 6
+
+
+def test_does_not_flag_words_that_merely_contain_gh(tmp_path: Path) -> None:
+    """`"github"`, `"ghost"`, etc. must not false-positive -- the closing
+    quote has to land immediately after the 'h'."""
+    coord_dir = tmp_path / "coord"
+    coord_dir.mkdir()
+    (coord_dir / "github_ops.py").write_text("# the seam\n", encoding="utf-8")
+    (coord_dir / "fine.py").write_text(
+        'HOST = "github.com"\n'
+        'NAME = "ghost"\n',
+        encoding="utf-8",
+    )
+
+    violations = find_violations(tmp_path)
+
+    assert violations == []

code_coordinator-0.5.195/tests/test_no_direct_gh_calls.py

@@ -1,112 +0,0 @@
-"""Regression guard for #1483: `gh` must be invoked from exactly one place.
-
-``coord/github_ops.py`` is the legitimate GitHub adapter -- "the single sink
-that a GitLab backend would sit beside" (#1483). Several other modules used
-to shell out to `gh` directly (``coord/review.py``, ``coord/drive.py``,
-``coord/ci_github.py``, ``coord/test_orchestrator.py``,
-``coord/commands/test_gate.py``), which:
-
-- makes worker/daemon hosts implicitly depend on `gh` being on PATH for code
-  paths that have nothing to do with choosing a forge backend (the elitebook
-  incident: a worker silently lost GitHub access because `gh` lived at a
-  linuxbrew path outside the systemd unit's PATH -- 98 failures burned
-  diagnosing "environment", not the code);
-- in ``coord/drive.py``, made behaviour silently depend on whether a `gh`
-  binary happened to be on PATH (``shutil.which("gh")``), with no log line
-  and no verdict;
-- blocks a future GitLab / bare-DB backend from swapping in cleanly, since
-  each leak is one more place that would need to learn about the new
-  backend.
-
-This test statically scans every non-adapter module under ``coord/`` for a
-literal ``"gh"``/``'gh'`` used as a subprocess argv[0], or
-``shutil.which("gh")``, and fails if either turns up outside
-``coord/github_ops.py``. New `gh` call sites belong in ``github_ops.py``;
-everything else should call through that seam.
-"""
-
-from __future__ import annotations
-
-import ast
-from pathlib import Path
-
-REPO_ROOT = Path(__file__).resolve().parent.parent
-COORD_DIR = REPO_ROOT / "coord"
-
-# The one legitimate `gh` sink -- new gh functionality belongs here, not
-# scattered across the codebase.
-ALLOWED_FILES = {COORD_DIR / "github_ops.py"}
-
-
-def _iter_coord_py_files() -> list[Path]:
-    return [
-        path
-        for path in sorted(COORD_DIR.rglob("*.py"))
-        if path not in ALLOWED_FILES and "__pycache__" not in path.parts
-    ]
-
-
-def _is_gh_argv0(node: ast.AST) -> bool:
-    """True if *node* is a list/tuple literal whose first element is the
-    string literal ``"gh"`` -- the shape of ``subprocess.run(["gh", ...])`` /
-    ``subprocess.Popen(["gh", ...])`` (under any import alias)."""
-    if not isinstance(node, (ast.List, ast.Tuple)) or not node.elts:
-        return False
-    first = node.elts[0]
-    return isinstance(first, ast.Constant) and first.value == "gh"
-
-
-def _is_shutil_which_gh(node: ast.Call) -> bool:
-    """True for ``shutil.which("gh")`` / ``which("gh")`` -- the silent,
-    host-dependent-behaviour shape #1483 called out explicitly in
-    ``coord/drive.py``."""
-    func = node.func
-    name = func.attr if isinstance(func, ast.Attribute) else (
-        func.id if isinstance(func, ast.Name) else None
-    )
-    if name != "which":
-        return False
-    return any(
-        isinstance(arg, ast.Constant) and arg.value == "gh" for arg in node.args
-    )
-
-
-def _find_violations(path: Path) -> list[str]:
-    tree = ast.parse(path.read_text(), filename=str(path))
-    violations = []
-    for node in ast.walk(tree):
-        if not isinstance(node, ast.Call):
-            continue
-        if _is_shutil_which_gh(node):
-            violations.append(f'{path}:{node.lineno}: shutil.which("gh")')
-            continue
-        for arg in node.args:
-            if _is_gh_argv0(arg):
-                violations.append(f'{path}:{node.lineno}: subprocess argv0 "gh" literal')
-                break
-    return violations
-
-
-def test_no_direct_gh_invocations_outside_github_ops() -> None:
-    all_violations: list[str] = []
-    for path in _iter_coord_py_files():
-        all_violations.extend(_find_violations(path))
-    assert not all_violations, (
-        "Direct `gh` invocation(s) found outside coord/github_ops.py -- "
-        "route through the github_ops seam instead (#1483):\n" + "\n".join(all_violations)
-    )
-
-
-def test_guard_actually_detects_a_leak(tmp_path) -> None:
-    """Prove the AST scan isn't a no-op -- planting a leak must trip it."""
-    leak = tmp_path / "leaky.py"
-    leak.write_text(
-        "import subprocess\n"
-        "def f():\n"
-        "    subprocess.run(['gh', 'pr', 'view', '1'])\n"
-    )
-    assert _find_violations(leak)
-
-    which_leak = tmp_path / "leaky_which.py"
-    which_leak.write_text("import shutil\nshutil.which('gh')\n")
-    assert _find_violations(which_leak)