code-mower 0.5.0b14__tar.gz → 0.5.0b16__tar.gz

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b14
+Version: 0.5.0b16
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -101,11 +101,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b14
+pipx install --python python3.12 code-mower==0.5.0b16
 code-mower --version
 ```
 
-`0.5.0b14` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b16` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -148,7 +148,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b14`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b16`.
 
 ## Why Not Just Run Codex Or Claude Yourself?
 
@@ -253,9 +253,9 @@ best?" to "which AI builder plus reviewer loop ships best on this product?" See
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.14` from
+The current public beta is `v0.5.0-beta.16` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b14` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b16` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/README.md

@@ -86,11 +86,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b14
+pipx install --python python3.12 code-mower==0.5.0b16
 code-mower --version
 ```
 
-`0.5.0b14` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b16` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -133,7 +133,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b14`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b16`.
 
 ## Why Not Just Run Codex Or Claude Yourself?
 
@@ -238,9 +238,9 @@ best?" to "which AI builder plus reviewer loop ships best on this product?" See
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.14` from
+The current public beta is `v0.5.0-beta.16` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b14` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b16` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b14"
+version = "0.5.0b16"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b14"
+__version__ = "0.5.0b16"

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 if __package__ in {None, ""}:
     raise SystemExit(
         "code_mower.cli is a packaged entrypoint. Install Code Mower with "
-        "`pipx install code-mower==0.5.0b14`, or run source checkouts with "
+        "`pipx install code-mower==0.5.0b16`, or run source checkouts with "
         "`PYTHONPATH=src python -m code_mower.cli`."
     )
 

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower/doctor_checks/__init__.py

@@ -36,6 +36,7 @@ from .presets import (
 )
 from .providers import (
     check_lane_runtime,
+    check_review_hygiene,
     effective_lane,
     provider_template_coverage,
     selected_lanes,
@@ -83,6 +84,7 @@ __all__ = [
     "check_github_auth_surface",
     "check_github_setup",
     "check_lane_runtime",
+    "check_review_hygiene",
     "check_pytest",
     "check_python_runtime",
     "check_ripgrep",

code_mower-0.5.0b16/src/code_mower/doctor_checks/provider_review_hygiene.py

@@ -0,0 +1,87 @@
+"""Review-hygiene checks for merge-authority provider lanes."""
+
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+from .common import DoctorCheck, STATUS_FAIL, STATUS_PASS, STATUS_SKIP, as_sequence
+
+
+def check_review_hygiene(
+    lane_id: str,
+    lane: Mapping[str, Any],
+    *,
+    effective_lane: Mapping[str, Any] | None = None,
+) -> DoctorCheck:
+    """Verify that merge-authority lanes have stale terminal-label protection."""
+
+    merge_authority_lane = effective_lane if effective_lane is not None else lane
+    if not bool(merge_authority_lane.get("merge_authority", False)):
+        return DoctorCheck(
+            name="provider.review_hygiene",
+            status=STATUS_SKIP,
+            lane=lane_id,
+            message="lane is not merge authority; stale terminal-label guard is optional",
+        )
+
+    review_hygiene = lane.get("review_hygiene")
+    if not isinstance(review_hygiene, Mapping):
+        review_hygiene = {}
+
+    workflow = str(review_hygiene.get("workflow") or "").strip()
+    token_env = str(review_hygiene.get("token_env") or "").strip()
+    dispatch_workflow = str(review_hygiene.get("dispatch_workflow") or "").strip()
+    trusted_authors = tuple(str(author) for author in as_sequence(review_hygiene.get("trusted_authors", [])))
+    missing: list[str] = []
+    if not workflow:
+        missing.append("workflow")
+    if not token_env:
+        missing.append("token_env")
+
+    detail = {
+        "workflow": workflow,
+        "token_env": token_env,
+        "dispatch_workflow": dispatch_workflow,
+        "trusted_authors": list(trusted_authors),
+        "merge_authority": True,
+    }
+
+    if missing:
+        return DoctorCheck(
+            name="provider.review_hygiene",
+            status=STATUS_FAIL,
+            lane=lane_id,
+            message=(
+                "merge-authority lane is missing stale terminal-label guard config: "
+                + ", ".join(missing)
+            ),
+            detail={**detail, "missing": missing},
+            remediation=(
+                "Add review_hygiene.workflow and review_hygiene.token_env to this "
+                "lane, or regenerate workflows with `code-mower init --easy --apply`."
+            ),
+        )
+
+    if token_env != "GITHUB_TOKEN":
+        return DoctorCheck(
+            name="provider.review_hygiene",
+            status=STATUS_FAIL,
+            lane=lane_id,
+            message=(
+                "merge-authority lane uses unsupported stale terminal-label token_env: "
+                f"{token_env}"
+            ),
+            detail={**detail, "supported_token_env": "GITHUB_TOKEN"},
+            remediation=(
+                "Use review_hygiene.token_env: GITHUB_TOKEN, or update the generated "
+                "clear-stale workflow template before relying on a custom token."
+            ),
+        )
+
+    return DoctorCheck(
+        name="provider.review_hygiene",
+        status=STATUS_PASS,
+        lane=lane_id,
+        message=f"stale terminal-label guard configured via {workflow}",
+        detail=detail,
+    )

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower/doctor_checks/providers.py

@@ -24,9 +24,11 @@ from .provider_probe import (
     evaluate_json_probe,
     local_cli_probe_remediation,
 )
+from .provider_review_hygiene import check_review_hygiene
 
 __all__ = [
     "check_lane_runtime",
+    "check_review_hygiene",
     "effective_lane",
     "evaluate_json_probe",
     "local_cli_probe_remediation",
@@ -109,10 +111,13 @@ def check_lane_runtime(
     lane_id: str,
     lane: Mapping[str, Any],
     *,
+    source_lane: Mapping[str, Any] | None = None,
     probe_runtime: bool,
     http_timeout: int,
 ) -> list[DoctorCheck]:
-    checks = check_token_env(lane_id, lane)
+    hygiene_source = source_lane if source_lane is not None else lane
+    checks = [check_review_hygiene(lane_id, hygiene_source, effective_lane=lane)]
+    checks.extend(check_token_env(lane_id, lane))
     checks.extend(check_required_env(lane_id, lane))
     driver = str(lane.get("driver", ""))
     if driver == "local_cli":

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower/doctor_checks/runner.py

@@ -162,6 +162,7 @@ def run_doctor(
             check_lane_runtime(
                 lane_id,
                 effective,
+                source_lane=lane,
                 probe_runtime=probe_runtime,
                 http_timeout=http_timeout,
             )

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower/package_manifest.py

@@ -187,6 +187,11 @@ PACKAGE_FILES = (
         "src/code_mower/doctor_checks/provider_probe_remediation.py",
         "core",
     ),
+    (
+        "src/code_mower/doctor_checks/provider_review_hygiene.py",
+        "src/code_mower/doctor_checks/provider_review_hygiene.py",
+        "core",
+    ),
     ("src/code_mower/doctor_checks/privacy.py", "src/code_mower/doctor_checks/privacy.py", "core"),
     ("src/code_mower/doctor_checks/providers.py", "src/code_mower/doctor_checks/providers.py", "core"),
     ("src/code_mower/doctor_checks/registry.py", "src/code_mower/doctor_checks/registry.py", "core"),

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower/providers/provenance.py

@@ -143,22 +143,50 @@ def _first_text(values: Any) -> str:
     return ""
 
 
+def _text_values(values: Any) -> tuple[str, ...]:
+    if isinstance(values, str):
+        text = _safe_text(values)
+        return (text,) if text else ()
+    if isinstance(values, (list, tuple)):
+        result: list[str] = []
+        for value in values:
+            text = _safe_text(value)
+            if text and text not in result:
+                result.append(text)
+        return tuple(result)
+    return ()
+
+
 def _env_value(config: Mapping[str, Any], key: str) -> str:
     env_name = _safe_text(config.get(key))
     return _safe_text(os.environ.get(env_name)) if env_name else ""
 
 
-def _configured_command(config: Mapping[str, Any], provider: str) -> str:
+def _configured_command_candidates(
+    config: Mapping[str, Any],
+    provider: str,
+) -> tuple[str, ...]:
     override = _env_value(config, "command_env")
     if override:
-        return override
+        return (override,)
+    candidates: list[str] = []
     command = _safe_text(config.get("command"))
     if command:
-        return command
-    alternate = _first_text(config.get("alternate_commands"))
-    if alternate:
-        return alternate
-    return provider
+        candidates.append(command)
+    for alternate in _text_values(config.get("alternate_commands")):
+        if alternate not in candidates:
+            candidates.append(alternate)
+    if not candidates:
+        candidates.append(provider)
+    return tuple(candidates)
+
+
+def _select_available_command(candidates: tuple[str, ...]) -> tuple[str, str]:
+    for command in candidates:
+        resolved = shutil.which(command)
+        if resolved:
+            return command, resolved
+    return (candidates[0] if candidates else "", "")
 
 
 def build_provider_lane_tool_provenance(
@@ -178,7 +206,8 @@ def build_provider_lane_tool_provenance(
     config = _provider_config(lane)
     provider = _safe_text(_lane_value(lane, "provider")) or lane_id
     driver = _safe_text(_lane_value(lane, "driver")) or "unknown"
-    command = _configured_command(config, provider)
+    command_candidates = _configured_command_candidates(config, provider)
+    command, resolved_command = _select_available_command(command_candidates)
     model = _env_value(config, "model_env") or _safe_text(config.get("default_model"))
     provider_from_env = _env_value(config, "provider_env")
     if provider_from_env:
@@ -197,16 +226,16 @@ def build_provider_lane_tool_provenance(
         "lane_id": lane_id,
         "driver": driver,
         "command": command if driver == "local_cli" else "",
+        "command_candidates": list(command_candidates) if driver == "local_cli" else [],
         "model_known": bool(model),
         "version_known": False,
     }
     tool_version = ""
     if driver == "local_cli" and include_version_probe and command:
-        resolved = shutil.which(command)
-        detail["command_found"] = bool(resolved)
-        if resolved:
-            detail["path_basename"] = os.path.basename(resolved)
-            version_detail = detect_local_cli_version(resolved)
+        detail["command_found"] = bool(resolved_command)
+        if resolved_command:
+            detail["path_basename"] = os.path.basename(resolved_command)
+            version_detail = detect_local_cli_version(resolved_command)
             tool_version = _safe_text(version_detail.get("tool_version"))
             detail["version_known"] = bool(tool_version)
             detail["tool_version_available"] = bool(

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower/release_readiness.py

@@ -358,6 +358,9 @@ def render_release_readiness(repo_path: Path) -> dict[str, Any]:
                 if (
                     _needs_job(testpypi_job, "verify-distributions")
                     and "inputs.publish_testpypi" in testpypi_job_text
+                    and "inputs.publish_testpypi == true" in testpypi_job_text
+                    and "github.event_name == 'workflow_dispatch'" in testpypi_job_text
+                    and "github.event_name == 'release'" in testpypi_job_text
                     and "CODE_MOWER_TESTPYPI_PUBLISH" in testpypi_job_text
                     and _job_uses_environment(testpypi_job, "testpypi")
                     and _permissions_include(testpypi_job, "id-token", "write")
@@ -376,6 +379,9 @@ def render_release_readiness(repo_path: Path) -> dict[str, Any]:
                 if (
                     _needs_job(pypi_job, "verify-distributions")
                     and "inputs.publish_pypi" in pypi_job_text
+                    and "inputs.publish_pypi == true" in pypi_job_text
+                    and "github.event_name == 'workflow_dispatch'" in pypi_job_text
+                    and "github.event_name == 'release'" in pypi_job_text
                     and "CODE_MOWER_PYPI_PUBLISH" in pypi_job_text
                     and _job_uses_environment(pypi_job, "pypi")
                     and _permissions_include(pypi_job, "id-token", "write")

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b14
+Version: 0.5.0b16
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -101,11 +101,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b14
+pipx install --python python3.12 code-mower==0.5.0b16
 code-mower --version
 ```
 
-`0.5.0b14` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b16` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -148,7 +148,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b14`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b16`.
 
 ## Why Not Just Run Codex Or Claude Yourself?
 
@@ -253,9 +253,9 @@ best?" to "which AI builder plus reviewer loop ships best on this product?" See
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.14` from
+The current public beta is `v0.5.0-beta.16` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b14` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b16` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/src/code_mower.egg-info/SOURCES.txt

@@ -143,6 +143,7 @@ src/code_mower/doctor_checks/provider_probe_auth.py
 src/code_mower/doctor_checks/provider_probe_evaluation.py
 src/code_mower/doctor_checks/provider_probe_json.py
 src/code_mower/doctor_checks/provider_probe_remediation.py
+src/code_mower/doctor_checks/provider_review_hygiene.py
 src/code_mower/doctor_checks/providers.py
 src/code_mower/doctor_checks/registry.py
 src/code_mower/doctor_checks/runner.py
@@ -251,6 +252,7 @@ tests/test_doctor_privacy.py
 tests/test_doctor_provider_env_required.py
 tests/test_doctor_provider_env_tokens.py
 tests/test_doctor_provider_probe.py
+tests/test_doctor_provider_review_hygiene.py
 tests/test_doctor_registry.py
 tests/test_local_llm_github_helpers.py
 tests/test_provider_local_cli.py

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/tests/test_doctor_boundaries.py

@@ -107,6 +107,7 @@ class DoctorBoundaryTests(unittest.TestCase):
             "code_mower.doctor_checks.provider_probe_evaluation",
             "code_mower.doctor_checks.provider_probe_json",
             "code_mower.doctor_checks.provider_probe_remediation",
+            "code_mower.doctor_checks.provider_review_hygiene",
             "code_mower.doctor_checks.providers",
             "code_mower.doctor_checks.privacy",
             "code_mower.doctor_checks.registry",

code_mower-0.5.0b16/tests/test_doctor_provider_review_hygiene.py

@@ -0,0 +1,98 @@
+from __future__ import annotations
+
+import unittest
+
+from code_mower.doctor_checks.provider_review_hygiene import check_review_hygiene
+
+
+class DoctorProviderReviewHygieneTests(unittest.TestCase):
+    def test_merge_authority_lane_requires_stale_guard(self) -> None:
+        check = check_review_hygiene(
+            "devin",
+            {
+                "merge_authority": True,
+                "review_hygiene": {},
+            },
+        )
+
+        self.assertEqual(check.status, "fail")
+        self.assertEqual(check.name, "provider.review_hygiene")
+        self.assertEqual(check.lane, "devin")
+        self.assertIn("workflow", check.detail["missing"])
+        self.assertIn("token_env", check.detail["missing"])
+        self.assertIn("code-mower init --easy --apply", check.remediation)
+
+    def test_template_defaults_do_not_satisfy_source_hygiene_requirement(self) -> None:
+        check = check_review_hygiene(
+            "codex",
+            {},
+            effective_lane={
+                "merge_authority": True,
+                "review_hygiene": {
+                    "workflow": ".github/workflows/codex-clear-stale.yml",
+                    "token_env": "GITHUB_TOKEN",
+                },
+            },
+        )
+
+        self.assertEqual(check.status, "fail")
+        self.assertEqual(check.detail["missing"], ["workflow", "token_env"])
+        self.assertIn("missing stale terminal-label guard config", check.message)
+
+    def test_merge_authority_lane_passes_with_stale_guard(self) -> None:
+        check = check_review_hygiene(
+            "codex",
+            {
+                "merge_authority": True,
+                "review_hygiene": {
+                    "workflow": ".github/workflows/codex-clear-stale.yml",
+                    "token_env": "GITHUB_TOKEN",
+                    "dispatch_workflow": "codex-audit-labeler.yml",
+                    "trusted_authors": ["codex[bot]"],
+                },
+            },
+        )
+
+        self.assertEqual(check.status, "pass")
+        self.assertEqual(
+            check.message,
+            "stale terminal-label guard configured via .github/workflows/codex-clear-stale.yml",
+        )
+        self.assertEqual(check.detail["workflow"], ".github/workflows/codex-clear-stale.yml")
+        self.assertEqual(check.detail["token_env"], "GITHUB_TOKEN")
+        self.assertEqual(check.detail["dispatch_workflow"], "codex-audit-labeler.yml")
+        self.assertEqual(check.detail["trusted_authors"], ["codex[bot]"])
+
+    def test_merge_authority_lane_rejects_custom_hygiene_token_until_template_supports_it(self) -> None:
+        check = check_review_hygiene(
+            "devin",
+            {
+                "merge_authority": True,
+                "review_hygiene": {
+                    "workflow": ".github/workflows/devin-clear-stale.yml",
+                    "token_env": "DEVIN_AUDIT_LABEL_TOKEN",
+                },
+            },
+        )
+
+        self.assertEqual(check.status, "fail")
+        self.assertEqual(check.detail["token_env"], "DEVIN_AUDIT_LABEL_TOKEN")
+        self.assertEqual(check.detail["supported_token_env"], "GITHUB_TOKEN")
+        self.assertIn("unsupported", check.message)
+
+    def test_informational_lane_skips_stale_guard_requirement(self) -> None:
+        check = check_review_hygiene(
+            "gitar",
+            {
+                "merge_authority": False,
+                "review_hygiene": {},
+            },
+        )
+
+        self.assertEqual(check.status, "skip")
+        self.assertEqual(check.lane, "gitar")
+        self.assertIn("optional", check.message)
+
+
+if __name__ == "__main__":
+    unittest.main()

{code_mower-0.5.0b14 → code_mower-0.5.0b16}/tests/test_provider_local_cli.py

@@ -83,6 +83,41 @@ def test_provider_lane_tool_provenance_reads_version_and_model_env(
     assert tool["model"] == "model-v1"
     assert tool["lens"] == "security-threat-model"
     assert detail["lane_id"] == "gemini_cli"
+    assert detail["command_candidates"] == ["provider-cli"]
     assert detail["command_found"] is True
     assert detail["model_known"] is True
     assert detail["version_known"] is True
+
+
+def test_provider_lane_tool_provenance_uses_available_alternate_command(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    executable = _write_executable(
+        tmp_path / "antigravity",
+        "#!/bin/sh\nprintf 'antigravity 1.2.3\\n'\n",
+    )
+    monkeypatch.setenv("PATH", os.fspath(executable.parent))
+    lane = {
+        "driver": "local_cli",
+        "provider": "antigravity",
+        "provider_config": {
+            "command": "agy",
+            "alternate_commands": ("antigravity",),
+            "model_env": "ANTIGRAVITY_MODEL",
+        },
+    }
+
+    tool, detail = build_provider_lane_tool_provenance(
+        "antigravity_cli",
+        lane,
+        source="unit-test",
+    )
+
+    assert tool["tool_name"] == "antigravity"
+    assert tool["tool_version"] == "antigravity 1.2.3"
+    assert tool["provider"] == "antigravity"
+    assert detail["command"] == "antigravity"
+    assert detail["command_candidates"] == ["agy", "antigravity"]
+    assert detail["command_found"] is True
+    assert detail["version_known"] is True