code-mower 0.5.0b40__tar.gz → 0.5.0b42__tar.gz

{code_mower-0.5.0b40 → code_mower-0.5.0b42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b40
+Version: 0.5.0b42
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b40
+pipx install --python python3.12 code-mower==0.5.0b42
 code-mower --version
 ```
 
-`0.5.0b40` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b42` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -122,6 +122,10 @@ code-mower doctor --preflight
 code-mower checks detect --json
 ```
 
+In Git worktrees, `checks detect` also offers `code-mower.pr-size`, a local
+PR-size lint that defaults to 300 changed lines and flags large batches of
+near-identical files.
+
 When those look sane, write the generated setup to a reviewable folder and
 produce the starter local report:
 
@@ -131,8 +135,9 @@ code-mower calibration value-report .code-mower.generated/calibration-corpus.jso
   --output .code-mower/reviewer-value-report.md
 ```
 
-The generated starter corpus proves the command path. To bootstrap a draft from
-your repository history:
+The generated setup also includes the configurable owner escalation and weekly
+status digest templates. The generated starter corpus proves the command path.
+To bootstrap a draft from your repository history:
 
 ```bash
 code-mower calibration auto-discover \
@@ -150,7 +155,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b40`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b42`.
 
 ## Optional: Plan Before Coding
 
@@ -184,9 +189,21 @@ code-mower work-order attach-delivery \
   --from-github
 ```
 
-That lets CodeMower.com show `issue -> plan -> work order -> PR -> reviewer
-checks -> merge` lineage without receiving source, diffs, transcripts, or issue
-body text.
+If a hosted builder such as Grok Bot or Cursor Cloud Agents produced the PR,
+record source-free builder provenance too:
+
+```bash
+code-mower builder record \
+  --provider grok_bot \
+  --executor cursor_cloud_agent \
+  --work-order .code-mower/work-orders/billing-settings.md \
+  --pr OWNER/REPO#124
+```
+
+That lets CodeMower.com show `issue -> plan -> work order -> builder run -> PR
+-> reviewer checks -> merge` lineage without receiving source, diffs,
+transcripts, prompts, or issue body text. See
+[docs/builders-grok-cursor.md](docs/builders-grok-cursor.md).
 
 ## Why Not Just Run Codex Or Claude Yourself?
 
@@ -287,13 +304,15 @@ engineer can:
 Future builder/orchestrator experiments extend the same loop from "who reviews
 best?" to "which AI builder plus reviewer loop ships best on this product?" See
 [docs/builder-experiments.md](docs/builder-experiments.md) and
-[docs/authoring-intelligence.md](docs/authoring-intelligence.md).
+[docs/authoring-intelligence.md](docs/authoring-intelligence.md). For hosted
+builder provenance, start with
+[docs/builders-grok-cursor.md](docs/builders-grok-cursor.md).
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.40` from
+The current public beta is `v0.5.0-beta.42` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b40` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b42` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b40 → code_mower-0.5.0b42}/README.md

@@ -88,11 +88,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b40
+pipx install --python python3.12 code-mower==0.5.0b42
 code-mower --version
 ```
 
-`0.5.0b40` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b42` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -107,6 +107,10 @@ code-mower doctor --preflight
 code-mower checks detect --json
 ```
 
+In Git worktrees, `checks detect` also offers `code-mower.pr-size`, a local
+PR-size lint that defaults to 300 changed lines and flags large batches of
+near-identical files.
+
 When those look sane, write the generated setup to a reviewable folder and
 produce the starter local report:
 
@@ -116,8 +120,9 @@ code-mower calibration value-report .code-mower.generated/calibration-corpus.jso
   --output .code-mower/reviewer-value-report.md
 ```
 
-The generated starter corpus proves the command path. To bootstrap a draft from
-your repository history:
+The generated setup also includes the configurable owner escalation and weekly
+status digest templates. The generated starter corpus proves the command path.
+To bootstrap a draft from your repository history:
 
 ```bash
 code-mower calibration auto-discover \
@@ -135,7 +140,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b40`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b42`.
 
 ## Optional: Plan Before Coding
 
@@ -169,9 +174,21 @@ code-mower work-order attach-delivery \
   --from-github
 ```
 
-That lets CodeMower.com show `issue -> plan -> work order -> PR -> reviewer
-checks -> merge` lineage without receiving source, diffs, transcripts, or issue
-body text.
+If a hosted builder such as Grok Bot or Cursor Cloud Agents produced the PR,
+record source-free builder provenance too:
+
+```bash
+code-mower builder record \
+  --provider grok_bot \
+  --executor cursor_cloud_agent \
+  --work-order .code-mower/work-orders/billing-settings.md \
+  --pr OWNER/REPO#124
+```
+
+That lets CodeMower.com show `issue -> plan -> work order -> builder run -> PR
+-> reviewer checks -> merge` lineage without receiving source, diffs,
+transcripts, prompts, or issue body text. See
+[docs/builders-grok-cursor.md](docs/builders-grok-cursor.md).
 
 ## Why Not Just Run Codex Or Claude Yourself?
 
@@ -272,13 +289,15 @@ engineer can:
 Future builder/orchestrator experiments extend the same loop from "who reviews
 best?" to "which AI builder plus reviewer loop ships best on this product?" See
 [docs/builder-experiments.md](docs/builder-experiments.md) and
-[docs/authoring-intelligence.md](docs/authoring-intelligence.md).
+[docs/authoring-intelligence.md](docs/authoring-intelligence.md). For hosted
+builder provenance, start with
+[docs/builders-grok-cursor.md](docs/builders-grok-cursor.md).
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.40` from
+The current public beta is `v0.5.0-beta.42` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b40` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b42` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b40 → code_mower-0.5.0b42}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b40"
+version = "0.5.0b42"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b40 → code_mower-0.5.0b42}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b40"
+__version__ = "0.5.0b42"

{code_mower-0.5.0b40 → code_mower-0.5.0b42}/src/code_mower/audit_labeler_lib.py

@@ -17,11 +17,16 @@ import urllib.error
 import urllib.request
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Any, Dict, Optional, Pattern, Sequence
+from typing import Any, Callable, Dict, Mapping, Optional, Pattern, Sequence
 from urllib.parse import quote
 import re
 
 MIN_ABBREVIATED_SHA_LENGTH = 7
+AUTHOR_EXCLUSION_ENV = "CODE_MOWER_AUTHOR_EXCLUSION_JSON"
+ACTIONS_RUN_MARKER_RE = re.compile(
+    r"<!--\s*CODE_MOWER_AUDIT_RUN:\s*run_id=([0-9]+)\s*-->"
+)
+TRUSTED_ACTIONS_AUDIT_EVENTS = frozenset({"pull_request_target"})
 
 
 @dataclass(frozen=True)
@@ -65,12 +70,22 @@ class LaneConfig:
             flags=re.IGNORECASE,
         )
 
+    def default_comment_authors(self) -> frozenset[str]:
+        return _author_csv_set(",".join(self.default_authors))
+
+    def configured_comment_authors(self) -> frozenset[str]:
+        if not self.authors_env_var:
+            return frozenset()
+        return _author_csv_set(os.environ.get(self.authors_env_var) or "")
+
     def comment_authors(self) -> frozenset[str]:
-        if self.authors_env_var:
-            raw_authors = os.environ.get(self.authors_env_var) or ",".join(self.default_authors)
-        else:
-            raw_authors = ",".join(self.default_authors)
-        return frozenset(author.strip().lower() for author in raw_authors.split(",") if author.strip())
+        return self.default_comment_authors() | self.configured_comment_authors()
+
+    def is_default_comment_author(self, login: str) -> bool:
+        return login.strip().lower() in self.default_comment_authors()
+
+    def is_configured_comment_author(self, login: str) -> bool:
+        return login.strip().lower() in self.configured_comment_authors()
 
     def github_tokens_from_env(self) -> tuple[GitHubToken, ...]:
         tokens = []
@@ -84,6 +99,14 @@ class LaneConfig:
         return tuple(tokens)
 
 
+def _author_csv_set(raw_authors: str) -> frozenset[str]:
+    return frozenset(
+        author.strip().lower()
+        for author in raw_authors.split(",")
+        if author.strip()
+    )
+
+
 class GitHubRequestError(RuntimeError):
     def __init__(self, method: str, path: str, code: int, response_body: str) -> None:
         self.method = method
@@ -97,6 +120,80 @@ class IssueCommentPaginationLimitExceeded(RuntimeError):
     """Raised when issue comments exceed the configured safe pagination cap."""
 
 
+def _string_mapping(value: Any) -> dict[str, str]:
+    if not isinstance(value, Mapping):
+        return {}
+    return {
+        str(key): str(item)
+        for key, item in value.items()
+        if str(key) and str(item)
+    }
+
+
+def load_author_exclusion_config(raw: str | None = None) -> Mapping[str, Any]:
+    text = raw if raw is not None else os.environ.get(AUTHOR_EXCLUSION_ENV, "")
+    if not text:
+        return {"enabled": False}
+    try:
+        parsed = json.loads(text)
+    except json.JSONDecodeError:
+        return {"enabled": False}
+    return parsed if isinstance(parsed, Mapping) else {"enabled": False}
+
+
+def builder_identity_matches(
+    *,
+    labels: Sequence[str],
+    author: str,
+    text: str,
+    config: Mapping[str, Any],
+) -> tuple[str, ...]:
+    if not bool(config.get("enabled")):
+        return ()
+    label_map = _string_mapping(config.get("labels"))
+    author_map = {
+        key.lower(): value
+        for key, value in _string_mapping(config.get("authors")).items()
+    }
+    matches: list[str] = []
+
+    for label in labels:
+        lane = label_map.get(str(label))
+        if lane:
+            matches.append(lane)
+
+    lane = author_map.get(author.lower())
+    if lane:
+        matches.append(lane)
+
+    return tuple(dict.fromkeys(matches))
+
+
+def author_exclusion_reason(
+    *,
+    lane_name: str,
+    labels: Sequence[str],
+    author: str,
+    text: str,
+    config: Mapping[str, Any] | None = None,
+) -> str | None:
+    exclusion_config = config or load_author_exclusion_config()
+    matches = builder_identity_matches(
+        labels=labels,
+        author=author,
+        text=text,
+        config=exclusion_config,
+    )
+    if not matches:
+        return None
+    if len(set(matches)) > 1:
+        return "conflicting builder identity; skipping author-excluded label update"
+    builder_lane = matches[0]
+    if builder_lane == lane_name:
+        return f"{lane_name} lane excluded for builder-authored PR"
+    return None
+
+
 def load_json(path: Path) -> Dict[str, Any]:
     return json.loads(path.read_text(encoding="utf-8"))
 
@@ -198,6 +295,130 @@ def github_request_with_fallback(
     raise RuntimeError(f"no GitHub tokens available for {method} {path}")
 
 
+def parse_csv_set(raw: str) -> frozenset[str]:
+    return frozenset(item.strip() for item in raw.split(",") if item.strip())
+
+
+def parse_audit_run_id(body: str) -> str:
+    match = ACTIONS_RUN_MARKER_RE.search(body)
+    return match.group(1) if match else ""
+
+
+def workflow_path_matches(path: str, trusted_workflows: Sequence[str]) -> bool:
+    if not path:
+        return False
+    return any(path == item or path.endswith("/" + item) for item in trusted_workflows)
+
+
+def _pr_item_matches_head(
+    item: Mapping[str, Any],
+    *,
+    issue_number: int,
+    head_sha: str,
+    fallback_head_sha: str = "",
+) -> bool:
+    if str(item.get("number") or "") != str(issue_number):
+        return False
+    pr_head = str(((item.get("head") or {}).get("sha")) or "")
+    if pr_head:
+        return sha_matches(pr_head, head_sha)
+    return bool(fallback_head_sha) and sha_matches(fallback_head_sha, head_sha)
+
+
+def fetch_actions_run(
+    repo: str,
+    run_id: str,
+    *,
+    tokens: Sequence[GitHubToken],
+) -> dict[str, Any]:
+    response = github_request_with_fallback(
+        "GET",
+        f"/repos/{repo}/actions/runs/{run_id}",
+        tokens=tokens,
+    )
+    return response if isinstance(response, dict) else {}
+
+
+def fetch_pull_requests_for_commit(
+    repo: str,
+    head_sha: str,
+    *,
+    tokens: Sequence[GitHubToken],
+) -> list[dict[str, Any]]:
+    response = github_request_with_fallback(
+        "GET",
+        f"/repos/{repo}/commits/{head_sha}/pulls?per_page=100",
+        tokens=tokens,
+    )
+    return response if isinstance(response, list) else []
+
+
+def github_actions_comment_attested(
+    *,
+    repo: str,
+    body: str,
+    issue_number: int,
+    head_sha: str,
+    workflow_paths: Sequence[str],
+    tokens: Sequence[GitHubToken],
+    actions_run_lookup: Optional[Callable[[str], Mapping[str, Any]]] = None,
+    commit_pull_requests_lookup: Optional[Callable[[str], Sequence[Mapping[str, Any]]]] = None,
+) -> bool:
+    """Return whether a github-actions[bot] audit comment is tied to this PR head."""
+    trusted_workflows = tuple(parse_csv_set(",".join(workflow_paths)))
+    token_list = tuple(token for token in tokens if token.value)
+    run_id = parse_audit_run_id(body)
+    if not trusted_workflows or not token_list or not run_id or not head_sha:
+        return False
+    try:
+        if actions_run_lookup is None:
+            run = fetch_actions_run(repo, run_id, tokens=token_list)
+        else:
+            run = dict(actions_run_lookup(run_id))
+    except Exception:
+        return False
+
+    path = str(run.get("path") or "")
+    if not workflow_path_matches(path, trusted_workflows):
+        return False
+    if str(run.get("event") or "") not in TRUSTED_ACTIONS_AUDIT_EVENTS:
+        return False
+
+    run_head_sha = str(run.get("head_sha") or "")
+    pull_requests = run.get("pull_requests")
+    if isinstance(pull_requests, list) and pull_requests:
+        return any(
+            isinstance(item, Mapping)
+            and _pr_item_matches_head(
+                item,
+                issue_number=issue_number,
+                head_sha=head_sha,
+                fallback_head_sha=run_head_sha,
+            )
+            for item in pull_requests
+        )
+    if not run_head_sha or not sha_matches(run_head_sha, head_sha):
+        return False
+
+    try:
+        if commit_pull_requests_lookup is None:
+            associated_prs = fetch_pull_requests_for_commit(repo, run_head_sha, tokens=token_list)
+        else:
+            associated_prs = commit_pull_requests_lookup(run_head_sha)
+    except Exception:
+        return False
+    return any(
+        isinstance(item, Mapping)
+        and _pr_item_matches_head(
+            item,
+            issue_number=issue_number,
+            head_sha=head_sha,
+            fallback_head_sha=run_head_sha,
+        )
+        for item in associated_prs
+    )
+
+
 def fetch_pull_request(
     repo: str,
     issue_number: int,