code-mower 0.5.0b49__tar.gz → 0.5.0b51__tar.gz

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b49
+Version: 0.5.0b51
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b49
+pipx install --python python3.12 code-mower==0.5.0b51
 code-mower --version
 ```
 
-`0.5.0b49` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b51` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -155,7 +155,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b49`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b51`.
 
 ## Optional: Plan Before Coding
 
@@ -310,9 +310,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.49` from
+The current public beta is `v0.5.0-beta.51` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b49` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b51` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/README.md

@@ -88,11 +88,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b49
+pipx install --python python3.12 code-mower==0.5.0b51
 code-mower --version
 ```
 
-`0.5.0b49` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b51` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -140,7 +140,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b49`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b51`.
 
 ## Optional: Plan Before Coding
 
@@ -295,9 +295,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.49` from
+The current public beta is `v0.5.0-beta.51` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b49` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b51` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b49"
+version = "0.5.0b51"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b49"
+__version__ = "0.5.0b51"

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/src/code_mower/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 if __package__ in {None, ""}:
     raise SystemExit(
         "code_mower.cli is a packaged entrypoint. Install Code Mower with "
-        "`pipx install code-mower==0.5.0b49`, or run source checkouts with "
+        "`pipx install code-mower==0.5.0b51`, or run source checkouts with "
         "`PYTHONPATH=src python -m code_mower.cli`."
     )
 

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/src/code_mower/cloud.py

@@ -429,6 +429,15 @@ def main(argv: list[str] | None = None) -> int:
         action="store_true",
         help="include verdict head SHA metadata",
     )
+    reviewer_runs.add_argument(
+        "--spend",
+        type=Path,
+        default=None,
+        help=(
+            "reviewer spend ledger to merge into reviewer_run events; defaults "
+            "to .code-mower/reviewer-spend.json when present"
+        ),
+    )
     reviewer_runs.add_argument(
         "--endpoint",
         default=os.environ.get("CODE_MOWER_CLOUD_ENDPOINT", DEFAULT_UPLOAD_ENDPOINT),
@@ -686,6 +695,7 @@ def main(argv: list[str] | None = None) -> int:
                 yes=args.yes,
                 timeout=args.timeout,
                 include_git_ref=args.include_git_ref,
+                spend_path=args.spend,
             )
             if args.json:
                 print(json.dumps(result, indent=2, sort_keys=True))

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/src/code_mower/cloud_client/operations.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import os
 from pathlib import Path
-from typing import Any
+from typing import Any, Mapping
 
 from .. import code_mower_telemetry
 from .. import reviewer_spend
@@ -86,6 +86,108 @@ def build_catch_up_summary(
     }
 
 
+def _reviewer_spend_events(
+    *,
+    repo_path: Path,
+    spend_path: Path | None,
+    repo_slug: str,
+    team_id: str,
+    install_id: str,
+    source: str,
+) -> list[dict[str, Any]]:
+    resolved_spend_path = spend_path or repo_path / reviewer_spend.DEFAULT_SPEND_PATH
+    if not resolved_spend_path.is_file():
+        return []
+    return reviewer_spend.spend_runs_to_events(
+        reviewer_spend.load_spend_file(resolved_spend_path),
+        repo_slug=repo_slug,
+        team_id=team_id,
+        install_id=install_id,
+        source=source,
+    )
+
+
+def _mapping(value: object) -> Mapping[str, Any]:
+    return value if isinstance(value, Mapping) else {}
+
+
+def _event_match_values(event: Mapping[str, Any]) -> tuple[str, str, str, str]:
+    dimensions = _mapping(event.get("dimensions"))
+    lane = str(
+        dimensions.get("audit_comment_lane_id")
+        or dimensions.get("lane_id")
+        or dimensions.get("lane")
+        or event.get("lens")
+        or event.get("provider")
+        or ""
+    ).strip()
+    return (
+        str(event.get("repo_slug") or "").strip(),
+        str(dimensions.get("pr_number") or "").strip(),
+        lane,
+        str(dimensions.get("head_sha") or "").strip(),
+    )
+
+
+def _merge_spend_metrics(
+    event: dict[str, Any],
+    spend_event: Mapping[str, Any],
+) -> dict[str, Any]:
+    merged = dict(event)
+    metrics = dict(_mapping(event.get("metrics")))
+    for key, value in _mapping(spend_event.get("metrics")).items():
+        metrics.setdefault(key, value)
+    dimensions = dict(_mapping(event.get("dimensions")))
+    spend_dimensions = _mapping(spend_event.get("dimensions"))
+    if spend_dimensions.get("spend_run_id"):
+        dimensions["spend_run_id"] = spend_dimensions["spend_run_id"]
+    if spend_event.get("source"):
+        dimensions["spend_source"] = spend_event["source"]
+    merged["metrics"] = metrics
+    merged["dimensions"] = dimensions
+    if not _mapping(event.get("tool")) and isinstance(spend_event.get("tool"), Mapping):
+        merged["tool"] = dict(spend_event["tool"])
+    return merged
+
+
+def _merge_reviewer_spend_events(
+    events: list[dict[str, Any]],
+    spend_events: list[dict[str, Any]],
+) -> list[dict[str, Any]]:
+    if not spend_events:
+        return events
+    merged = list(events)
+    exact_matches: dict[tuple[str, str, str, str], int] = {}
+    fallback_matches: dict[tuple[str, str, str], int | None] = {}
+    for index, event in enumerate(merged):
+        repo_slug, pr_number, lane, head_sha = _event_match_values(event)
+        if not repo_slug or not pr_number or not lane:
+            continue
+        if head_sha:
+            exact_matches[(repo_slug, pr_number, lane, head_sha)] = index
+        fallback_key = (repo_slug, pr_number, lane)
+        fallback_matches[fallback_key] = (
+            None if fallback_key in fallback_matches else index
+        )
+
+    unmatched: list[dict[str, Any]] = []
+    merged_targets: set[int] = set()
+    for spend_event in spend_events:
+        repo_slug, pr_number, lane, head_sha = _event_match_values(spend_event)
+        target_index = None
+        if head_sha:
+            target_index = exact_matches.get((repo_slug, pr_number, lane, head_sha))
+        if target_index is None:
+            target_index = fallback_matches.get((repo_slug, pr_number, lane))
+        if target_index is None or target_index in merged_targets:
+            unmatched.append(spend_event)
+            continue
+        merged_targets.add(target_index)
+        merged[target_index] = _merge_spend_metrics(merged[target_index], spend_event)
+    remaining = max(0, MAX_EVENT_COUNT - len(merged))
+    return [*merged, *unmatched[:remaining]]
+
+
 def dogfood_upload(
     *,
     repo_path: Path,
@@ -112,16 +214,14 @@ def dogfood_upload(
     resolved_team_id = team_id or os.environ.get(DEFAULT_TEAM_ID_ENV, "")
     resolved_install_id = install_id or os.environ.get(DEFAULT_INSTALL_ID_ENV, "")
     resolved_reports = reports or default_dogfood_reports(repo_path)
-    resolved_spend_path = spend_path or repo_path / reviewer_spend.DEFAULT_SPEND_PATH
-    spend_events: list[dict[str, Any]] = []
-    if resolved_spend_path.is_file():
-        spend_events = reviewer_spend.spend_runs_to_events(
-            reviewer_spend.load_spend_file(resolved_spend_path),
-            repo_slug=detected_repo_slug,
-            team_id=resolved_team_id,
-            install_id=resolved_install_id,
-            source="code-mower cloud dogfood spend",
-        )
+    spend_events = _reviewer_spend_events(
+        repo_path=repo_path,
+        spend_path=spend_path,
+        repo_slug=detected_repo_slug,
+        team_id=resolved_team_id,
+        install_id=resolved_install_id,
+        source="code-mower cloud dogfood spend",
+    )
     dogfood_plan = build_dogfood_plan(
         repo_slug=detected_repo_slug,
         team_id=resolved_team_id,
@@ -321,6 +421,7 @@ def reviewer_runs_upload(
     yes: bool,
     timeout: float,
     include_git_ref: bool,
+    spend_path: Path | None = None,
 ) -> dict[str, Any]:
     if limit < 1 or limit > MAX_EVENT_COUNT:
         raise CloudBundleError(f"--limit must be between 1 and {MAX_EVENT_COUNT}")
@@ -344,6 +445,15 @@ def reviewer_runs_upload(
         )
     except ValueError as exc:
         raise CloudBundleError(str(exc)) from exc
+    spend_events = _reviewer_spend_events(
+        repo_path=repo_path,
+        spend_path=spend_path,
+        repo_slug=detected_repo_slug,
+        team_id=resolved_team_id,
+        install_id=resolved_install_id,
+        source="code-mower cloud reviewer-runs spend",
+    )
+    events = _merge_reviewer_spend_events(events, spend_events)
     if not events:
         return {
             "mode": "cloud-reviewer-runs",
@@ -566,6 +676,7 @@ def repo_sync_upload(
                         yes=yes,
                         timeout=timeout,
                         include_git_ref=include_git_ref,
+                        spend_path=None,
                     )
                 else:  # pragma: no cover - argparse constrains modes.
                     raise CloudBundleError(f"unsupported repo-sync mode: {mode}")

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/src/code_mower/config.py

@@ -21,8 +21,15 @@ ALLOWED_LANE_TYPES = {"audit", "review"}
 ALLOWED_DRIVERS = {"local_cli", "manual", "hosted_bridge", "saas_event", "api_model"}
 ALLOWED_EVENTS = {"issue_comment", "pull_request_review", "check_run"}
 ALLOWED_SPEND_POLICIES = {"none", "local", "included", "paid"}
-BUILDER_IDENTITY_SECTIONS = {"labels", "authors", "trailers"}
+BUILDER_IDENTITY_SECTIONS = {
+    "labels",
+    "authors",
+    "trailers",
+    "branch_prefixes",
+    "fix_round_mentions",
+}
 SAFE_IDENTIFIER_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_-]*$")
+SAFE_ENV_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 SAFE_WORKFLOW_FILENAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_-]*\.ya?ml$")
 GENERATED_WORKFLOW_BY_DRIVER = {
     "api_model": "trailer-comment labeler + API/model runner",
@@ -305,6 +312,21 @@ def _require_identifier(value: Any, path: str, issues: list[ConfigIssue]) -> str
     return text
 
 
+def _require_env_name(value: Any, path: str, issues: list[ConfigIssue]) -> str | None:
+    text = _require_string(value, path, issues)
+    if text is None:
+        return None
+    if not SAFE_ENV_NAME_RE.fullmatch(text):
+        issues.append(
+            ConfigIssue(
+                path,
+                "must match [A-Za-z_][A-Za-z0-9_]* for generated workflow safety",
+            )
+        )
+        return None
+    return text
+
+
 def _require_workflow_path(value: Any, path: str, issues: list[ConfigIssue]) -> str | None:
     text = _require_string(value, path, issues)
     if text is None:
@@ -403,13 +425,28 @@ def validate_config(config: Mapping[str, Any]) -> list[ConfigIssue]:
             section_path = f"builder_identity.{section}"
             if section not in BUILDER_IDENTITY_SECTIONS:
                 issues.append(
-                    ConfigIssue(section_path, "must be labels, authors, or trailers")
+                    ConfigIssue(
+                        section_path,
+                        "must be labels, authors, trailers, branch_prefixes, or fix_round_mentions",
+                    )
                 )
                 continue
+            if section == "fix_round_mentions":
+                for lane_name, mention in _as_mapping(values, section_path, issues).items():
+                    _require_identifier(lane_name, f"{section_path}.{lane_name}", issues)
+                    _require_string(mention, f"{section_path}.{lane_name}", issues)
+                continue
             for key, lane_name in _as_mapping(values, section_path, issues).items():
                 _require_string(str(key), f"{section_path}.{key}", issues)
                 _require_identifier(lane_name, f"{section_path}.{key}", issues)
 
+    owner_surface = config.get("owner_surface")
+    if owner_surface is not None:
+        owner_surface_map = _as_mapping(owner_surface, "owner_surface", issues)
+        for key in ("dispatch_token_env", "dispatch_token_expires_var"):
+            if key in owner_surface_map:
+                _require_env_name(owner_surface_map.get(key), f"owner_surface.{key}", issues)
+
     all_labels: dict[str, str] = {}
     for lane_id, lane in lanes.items():
         path = f"lanes.{lane_id}"

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/src/code_mower/doctor_checks/__init__.py

@@ -19,6 +19,11 @@ from .common import (
 )
 from .github import check_github_setup
 from .github_config import check_repository_posture
+from .github_human_token import (
+    check_human_automation_token,
+    human_automation_token_config,
+    human_automation_token_required,
+)
 from .groups import GROUP_LABELS, doctor_check_group_id
 from .models import (
     STATUS_FAIL,
@@ -86,6 +91,7 @@ __all__ = [
     "check_github_auth_surface",
     "check_macos_runner_launchagent",
     "check_github_setup",
+    "check_human_automation_token",
     "check_repository_posture",
     "check_lane_runtime",
     "check_review_hygiene",
@@ -97,6 +103,8 @@ __all__ = [
     "doctor_output_group",
     "effective_lane",
     "evaluate_json_probe",
+    "human_automation_token_config",
+    "human_automation_token_required",
     "load_inputs",
     "local_cli_probe_remediation",
     "provider_template_coverage",

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/src/code_mower/doctor_checks/github.py

@@ -18,6 +18,7 @@ from .github_actions import (
 from .github_actions_permissions import check_actions_permissions
 from .github_branch import check_branch_protection
 from .github_config import configured_repositories, selected_saas_or_hosted_lanes
+from .github_human_token import check_human_automation_token
 from .github_provider import check_private_repo_provider_surface
 from .github_repo import (
     check_repo_auto_merge,
@@ -124,6 +125,15 @@ def check_github_setup(
                 ),
             ]
         )
+        checks.append(
+            check_human_automation_token(
+                gh_path=gh_path,
+                slug=slug,
+                config=config,
+                lanes=lanes,
+                http_timeout=http_timeout,
+            )
+        )
         if has_merge_authority:
             checks.append(
                 check_repo_auto_merge(slug=slug, repo_payload=metadata.payload)

{code_mower-0.5.0b49 → code_mower-0.5.0b51}/src/code_mower/doctor_checks/github_branch.py

@@ -8,6 +8,8 @@ from typing import Mapping
 from .common import DoctorCheck, STATUS_PASS, STATUS_WARN
 from .github_api import _github_api_json
 
+GITHUB_ACTIONS_APP_ID = 15368
+
 
 def check_branch_protection(
     *,
@@ -41,6 +43,7 @@ def check_branch_protection(
 
     required_checks = protection_payload.get("required_status_checks")
     contexts: list[str] = []
+    check_bindings: list[dict[str, object]] = []
     if isinstance(required_checks, Mapping):
         raw_contexts = required_checks.get("contexts")
         if isinstance(raw_contexts, list):
@@ -49,8 +52,42 @@ def check_branch_protection(
         if isinstance(raw_checks, list):
             for check in raw_checks:
                 if isinstance(check, Mapping) and check.get("context"):
-                    contexts.append(str(check["context"]))
+                    context = str(check["context"])
+                    contexts.append(context)
+                    check_bindings.append(
+                        {"context": context, "app_id": check.get("app_id")}
+                    )
     contexts = list(dict.fromkeys(contexts))
+    wrong_gate_bindings = [
+        binding
+        for binding in check_bindings
+        if binding.get("context") == required_status_context
+        and binding.get("app_id") == GITHUB_ACTIONS_APP_ID
+    ]
+    if required_status_context and wrong_gate_bindings:
+        return DoctorCheck(
+            name="github.branch_protection",
+            status=STATUS_WARN,
+            message=(
+                f"{slug}@{default_branch} requires {required_status_context} "
+                "from GitHub Actions instead of Any source"
+            ),
+            detail={
+                "repo": slug,
+                "default_branch": default_branch,
+                "required_status_context": required_status_context,
+                "required_status_contexts": contexts,
+                "required_status_check_count": len(contexts),
+                "required_status_check_bindings": check_bindings,
+            },
+            remediation=(
+                f"Rebind `{required_status_context}` in branch protection to "
+                "Any source, not GitHub Actions. In the API response, the "
+                f"`checks[]` entry for `{required_status_context}` should have "
+                "`app_id: null`; `app_id: 15368` means GitHub is evaluating "
+                "the Actions job check-run instead of the Code Mower commit status."
+            ),
+        )
     if required_status_context and required_status_context not in contexts:
         return DoctorCheck(
             name="github.branch_protection",
@@ -70,7 +107,7 @@ def check_branch_protection(
                 "unattended merge. Inspect existing checks with "
                 f"`gh api repos/{slug}/branches/{encoded_branch}/protection/required_status_checks`, "
                 "then PATCH that endpoint with all existing contexts plus "
-                f"`{required_status_context}`."
+                f"`{required_status_context}` from Any source."
             ),
         )
     return DoctorCheck(
@@ -86,5 +123,6 @@ def check_branch_protection(
             "default_branch": default_branch,
             "required_status_check_count": len(contexts),
             "required_status_contexts": contexts,
+            "required_status_check_bindings": check_bindings,
         },
     )