code-mower 0.5.0b5__py3-none-any.whl

code_mower/provider_runners/github_pr.py

@@ -0,0 +1,120 @@
+"""GitHub pull request API helpers for provider runners."""
+
+from __future__ import annotations
+
+import http.client
+import json
+import socket
+import time
+import urllib.error
+import urllib.request
+from typing import Any
+
+
+def _gh_request(
+    method: str,
+    path: str,
+    *,
+    token: str,
+    body: dict[str, Any] | None = None,
+    accept: str = "application/vnd.github+json",
+    timeout: int = 30,
+) -> Any:
+    """Make a GitHub REST request and return parsed JSON or text diffs."""
+
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(
+        f"https://api.github.com{path}",
+        data=data,
+        headers={
+            "Accept": accept,
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
+            "X-GitHub-Api-Version": "2022-11-28",
+        },
+        method=method,
+    )
+    max_attempts = 3 if method.upper() in {"GET", "HEAD"} else 1
+    transient_errors = (
+        TimeoutError,
+        socket.timeout,
+        http.client.IncompleteRead,
+        http.client.RemoteDisconnected,
+        urllib.error.URLError,
+    )
+    for attempt in range(1, max_attempts + 1):
+        try:
+            with urllib.request.urlopen(req, timeout=timeout) as response:
+                text = response.read().decode("utf-8", errors="replace")
+                if accept.endswith("diff"):
+                    return text
+                return json.loads(text) if text else None
+        except urllib.error.HTTPError:
+            raise
+        except transient_errors:
+            if attempt >= max_attempts:
+                raise
+            time.sleep(min(2 ** (attempt - 1), 4))
+    raise AssertionError("unreachable GitHub request retry loop")
+
+
+def fetch_pull_request(repo: str, pr_number: int, *, token: str) -> dict[str, Any]:
+    return _gh_request("GET", f"/repos/{repo}/pulls/{pr_number}", token=token)
+
+
+def fetch_pull_request_diff(repo: str, pr_number: int, *, token: str) -> str:
+    return str(
+        _gh_request(
+            "GET",
+            f"/repos/{repo}/pulls/{pr_number}",
+            token=token,
+            accept="application/vnd.github.v3.diff",
+        )
+    )
+
+
+def fetch_pull_request_files(
+    repo: str,
+    pr_number: int,
+    *,
+    token: str,
+    max_pages: int = 5,
+    per_page: int = 100,
+) -> list[dict[str, Any]]:
+    """Return changed-file entries for a pull request.
+
+    GitHub caps pull file pages at 100 entries. Provider runners usually do
+    not benefit from reviewing enormous PRs in full, so the default mirrors the
+    legacy local-LLM cap of 500 files while keeping the paging behavior shared.
+    """
+
+    all_files: list[dict[str, Any]] = []
+    for page in range(1, max_pages + 1):
+        chunk = _gh_request(
+            "GET",
+            f"/repos/{repo}/pulls/{pr_number}/files?per_page={per_page}&page={page}",
+            token=token,
+        )
+        if not chunk:
+            break
+        if not isinstance(chunk, list):
+            raise ValueError("GitHub pull request files response was not a list")
+        all_files.extend(chunk)
+        if len(chunk) < per_page:
+            break
+    return all_files
+
+
+def post_pr_comment(
+    repo: str,
+    pr_number: int,
+    body: str,
+    *,
+    token: str,
+) -> dict[str, Any]:
+    return _gh_request(
+        "POST",
+        f"/repos/{repo}/issues/{pr_number}/comments",
+        token=token,
+        body={"body": body},
+    )

code_mower/provider_runners/process.py

@@ -0,0 +1,58 @@
+"""Shared subprocess environment helpers for provider-runner wrappers."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Iterable, Mapping
+
+
+DEFAULT_HOME_ENV_KEYS = ("HOME", "XDG_CONFIG_HOME", "XDG_CACHE_HOME", "XDG_STATE_HOME")
+
+
+def _stringify_env_value(value: object) -> str:
+    if isinstance(value, Path):
+        return str(value)
+    return str(value)
+
+
+def build_allowlisted_child_env(
+    allowlist: Iterable[str],
+    *,
+    exclude_env: Iterable[str] = (),
+    extra_env: Mapping[str, object | None] | None = None,
+    home_env: Mapping[str, object] | None = None,
+    preserve_ambient_home: bool = False,
+    ambient_home_keys: Iterable[str] = DEFAULT_HOME_ENV_KEYS,
+) -> dict[str, str]:
+    """Build a minimal child environment for provider subprocesses.
+
+    ``allowlist`` controls which ambient variables are copied. ``exclude_env``
+    lets a caller suppress allowlisted values for negative-path tests. Provider
+    wrappers can pass ``home_env`` for deterministic isolated HOME/XDG paths, or
+    set ``preserve_ambient_home`` to copy selected home/config variables from
+    the ambient process instead. ``extra_env`` is applied last and ignores
+    ``None`` values, so explicit provider keys can override ambient values.
+    """
+
+    excluded = set(exclude_env)
+    child_env = {
+        key: value
+        for key in allowlist
+        if key not in excluded and (value := os.environ.get(key))
+    }
+    if preserve_ambient_home:
+        for key in ambient_home_keys:
+            if key not in excluded and (value := os.environ.get(key)):
+                child_env[key] = value
+    elif home_env:
+        for key, value in home_env.items():
+            if key not in excluded:
+                child_env[key] = _stringify_env_value(value)
+
+    if extra_env:
+        for key, value in extra_env.items():
+            if value is not None:
+                child_env[key] = _stringify_env_value(value)
+
+    return child_env

code_mower/provider_runners/repo_paths.py

@@ -0,0 +1,23 @@
+"""Shared local repository path parsing for provider wrappers."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Dict
+
+
+def parse_repo_paths(spec: str) -> Dict[str, Path]:
+    """Parse `owner/repo:/path,owner/repo:/path,...` into a dict."""
+
+    out: Dict[str, Path] = {}
+    for entry in spec.split(","):
+        entry = entry.strip()
+        if not entry:
+            continue
+        if ":" not in entry:
+            raise ValueError(
+                f"bad repo paths entry: {entry!r} (expected owner/repo:/path)"
+            )
+        repo, path = entry.split(":", 1)
+        out[repo.strip()] = Path(path.strip())
+    return out

code_mower/provider_runners/text_schema.py

@@ -0,0 +1,41 @@
+"""Provider-neutral text and schema helpers for audit wrappers."""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional, Set
+
+
+def clip_text(value: str, limit: int) -> str:
+    """Trim text to a stable display budget, preserving a clear truncation marker."""
+
+    value = value.strip()
+    if len(value) <= limit:
+        return value
+    suffix = "... [truncated]"
+    return value[: max(0, limit - len(suffix))].rstrip() + suffix
+
+
+def one_line(value: str, limit: int) -> str:
+    """Render user/model text safely inside one-line GitHub comment fragments."""
+
+    return clip_text(
+        value.replace("\r", " ").replace("\n", " ").replace("`", "'"),
+        limit,
+    )
+
+
+def require_exact_keys(
+    value: Dict[str, Any],
+    required: Set[str],
+    where: str,
+) -> Optional[str]:
+    """Return a validation error when a structured provider object drifts."""
+
+    keys = set(value.keys())
+    missing = sorted(required - keys)
+    extra = sorted(keys - required)
+    if missing:
+        return f"{where} missing required keys: {', '.join(missing)}"
+    if extra:
+        return f"{where} contains unsupported keys: {', '.join(extra)}"
+    return None

code_mower/provider_runners/verdict_artifacts.py

@@ -0,0 +1,103 @@
+"""Verdict artifact helpers shared by provider audit runners."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from .github_pr import post_pr_comment
+
+VERDICT_ARTIFACT_SCHEMA = "code_mower.auditVerdictArtifact.v1"
+VERDICT_ARTIFACT_DIR_ENV = "CODE_MOWER_VERDICT_ARTIFACT_DIR"
+
+
+def _safe_artifact_slug(value: str) -> str:
+    safe = "".join(char if char.isalnum() or char in "._-" else "-" for char in value)
+    safe = safe.strip("._-")
+    while "--" in safe:
+        safe = safe.replace("--", "-")
+    return safe or "item"
+
+
+def _verdict_artifact_root() -> Path:
+    configured = os.environ.get(VERDICT_ARTIFACT_DIR_ENV, "").strip()
+    if configured:
+        return Path(configured).expanduser()
+    return Path.home() / ".cache" / "code-mower-audits" / "verdicts"
+
+
+def write_audit_verdict_artifact(
+    *,
+    lane_id: str,
+    repo: str,
+    pr_number: int,
+    head_sha_start: str,
+    head_sha_end: str,
+    verdict: str,
+    trailer: str,
+    comment_body: str,
+) -> Path | None:
+    """Persist the rendered audit comment before posting to GitHub."""
+
+    root = _verdict_artifact_root()
+    repo_slug = _safe_artifact_slug(repo.replace("/", "__"))
+    head_slug = _safe_artifact_slug(head_sha_start[:16] or "unknown-head")
+    lane_slug = _safe_artifact_slug(lane_id)
+    now = datetime.now(timezone.utc)
+    timestamp = now.strftime("%Y%m%dT%H%M%SZ")
+    filename = f"{timestamp}-{lane_slug}-{_safe_artifact_slug(verdict.lower())}.json"
+    path = root / repo_slug / f"pr-{pr_number}" / head_slug / filename
+    payload = {
+        "schema": VERDICT_ARTIFACT_SCHEMA,
+        "lane_id": lane_id,
+        "repo": repo,
+        "pr_number": pr_number,
+        "head_sha_start": head_sha_start,
+        "head_sha_end": head_sha_end,
+        "verdict": verdict,
+        "trailer": trailer,
+        "comment_body": comment_body,
+        "created_at": now.isoformat().replace("+00:00", "Z"),
+        "posted_comment_url": None,
+    }
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(
+            json.dumps(payload, indent=2, sort_keys=True) + "\n",
+            encoding="utf-8",
+        )
+        return path
+    except OSError as exc:
+        print(
+            f"warning: failed to write audit verdict artifact {path}: {exc}",
+            file=sys.stderr,
+        )
+        return None
+
+
+def load_audit_verdict_artifact(path: Path) -> dict[str, Any]:
+    payload = json.loads(path.expanduser().read_text(encoding="utf-8"))
+    if not isinstance(payload, dict):
+        raise ValueError("verdict artifact must contain a JSON object")
+    if payload.get("schema") != VERDICT_ARTIFACT_SCHEMA:
+        raise ValueError(
+            f"unsupported verdict artifact schema: {payload.get('schema')!r}"
+        )
+    for key in ("repo", "pr_number", "comment_body"):
+        if key not in payload:
+            raise ValueError(f"verdict artifact missing {key}")
+    return payload
+
+
+def repost_audit_verdict_artifact(path: Path, *, token: str) -> dict[str, Any]:
+    artifact = load_audit_verdict_artifact(path)
+    return post_pr_comment(
+        str(artifact["repo"]),
+        int(artifact["pr_number"]),
+        str(artifact["comment_body"]),
+        token=token,
+    )

code_mower/provider_runners/workspace.py

@@ -0,0 +1,57 @@
+"""Shared local checkout validation helpers for provider runners."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+from typing import Any
+
+from .git import local_head_sha, run_git
+
+
+class ProviderWorkspaceError(RuntimeError):
+    """Raised when a provider runner cannot safely use a local checkout."""
+
+
+def working_tree_status(repo_path: Path) -> str:
+    """Return porcelain status for ``repo_path``."""
+
+    return run_git(repo_path, ["status", "--porcelain"]).stdout
+
+
+def verify_checkout_at_head(
+    repo_path: Path,
+    *,
+    expected_head_sha: str,
+    allow_dirty: bool = False,
+    purpose: str = "provider runner",
+    dirty_remediation: str = (
+        "commit/stash them or pass --allow-dirty for an explicitly exploratory run"
+    ),
+) -> dict[str, Any]:
+    """Verify that ``repo_path`` is a git checkout at ``expected_head_sha``."""
+
+    if not repo_path.is_dir():
+        raise ProviderWorkspaceError(f"repo path does not exist: {repo_path}")
+    try:
+        local_head = local_head_sha(repo_path)
+    except subprocess.CalledProcessError as exc:
+        raise ProviderWorkspaceError(
+            f"repo path is not a git checkout: {repo_path}"
+        ) from exc
+    if local_head.lower() != expected_head_sha.lower():
+        raise ProviderWorkspaceError(
+            "local checkout must be at the PR head for "
+            f"{purpose}; local={local_head} expected={expected_head_sha}."
+        )
+    status = working_tree_status(repo_path)
+    if status.strip() and not allow_dirty:
+        raise ProviderWorkspaceError(
+            "local checkout has uncommitted changes; "
+            f"{dirty_remediation}."
+        )
+    return {
+        "repo_path": str(repo_path),
+        "local_head_sha": local_head,
+        "dirty": bool(status.strip()),
+    }