code-mower 0.5.0b5__py3-none-any.whl

code_mower/secrets.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""Small helpers for local Code Mower secret files."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import AbstractSet
+
+
+GEMINI_SECRET_ENV_NAMES = frozenset({"GEMINI_API_KEY", "GOOGLE_API_KEY"})
+
+
+@dataclass(frozen=True)
+class SecretFileParseResult:
+    value: str
+    assignment_name: str | None = None
+    rejected_assignment_name: str | None = None
+
+    @property
+    def ok(self) -> bool:
+        return bool(self.value)
+
+
+def looks_like_secret_assignment_name(name: str) -> bool:
+    return (
+        bool(name)
+        and name.upper() == name
+        and all(char.isalnum() or char == "_" for char in name)
+        and (
+            name.endswith("_API_KEY")
+            or name.endswith("_TOKEN")
+            or name.endswith("_SECRET")
+        )
+    )
+
+
+def first_non_comment_line(text: str) -> str:
+    for line in text.splitlines():
+        stripped = line.strip()
+        if stripped and not stripped.startswith("#"):
+            return stripped
+    return ""
+
+
+def strip_shell_quotes(value: str) -> str:
+    stripped = value.strip()
+    if len(stripped) >= 2 and stripped[0] == stripped[-1] and stripped[0] in {'"', "'"}:
+        return stripped[1:-1].strip()
+    return stripped
+
+
+def parse_secret_file_text(
+    text: str,
+    *,
+    supported_env_names: AbstractSet[str],
+) -> SecretFileParseResult:
+    """Parse a raw secret file or a one-line shell-style secret assignment."""
+
+    stripped = first_non_comment_line(text)
+    if not stripped:
+        return SecretFileParseResult("")
+    if stripped.startswith("export "):
+        stripped = stripped[len("export ") :].strip()
+    if "=" in stripped:
+        name, value = stripped.split("=", 1)
+        assignment_name = name.strip()
+        if assignment_name in supported_env_names:
+            return SecretFileParseResult(
+                strip_shell_quotes(value),
+                assignment_name=assignment_name,
+            )
+        if looks_like_secret_assignment_name(assignment_name):
+            return SecretFileParseResult(
+                "",
+                rejected_assignment_name=assignment_name,
+            )
+    return SecretFileParseResult(strip_shell_quotes(stripped))
+
+
+def read_secret_file(
+    path: Path,
+    *,
+    supported_env_names: AbstractSet[str],
+) -> SecretFileParseResult:
+    return parse_secret_file_text(
+        path.expanduser().read_text(encoding="utf-8"),
+        supported_env_names=supported_env_names,
+    )

code_mower/templates/builder-experiment.example.json

@@ -0,0 +1,55 @@
+{
+  "version": 1,
+  "name": "starter-builder-loop",
+  "description": "Starter Code Mower builder experiment for one bounded task.",
+  "tasks": [
+    {
+      "task_id": "small-package-runtime-change",
+      "repo": "owner/repo",
+      "base_ref": "origin/main",
+      "task_class": "package-runtime",
+      "prompt": "Make one small Code Mower package-runtime improvement.",
+      "success_criteria": [
+        "focused tests pass",
+        "full Code Mower tests pass",
+        "normal Code Mower audit protocol passes",
+        "post-merge health is verified"
+      ],
+      "context_packs": [
+        "package-runtime"
+      ],
+      "review_classes": [
+        "package-runtime"
+      ]
+    }
+  ],
+  "builders": [
+    {
+      "builder_id": "codex-base",
+      "provider": "codex",
+      "tool": "codex-desktop",
+      "prompt_lenses": [
+        "base-audit"
+      ],
+      "cost_policy": "provider-dependent"
+    },
+    {
+      "builder_id": "codex-context-driven-quality",
+      "provider": "codex",
+      "tool": "codex-desktop",
+      "prompt_lenses": [
+        "context-driven-quality"
+      ],
+      "cost_policy": "provider-dependent"
+    }
+  ],
+  "metrics": [
+    "elapsed_seconds",
+    "cost_usd",
+    "user_interventions",
+    "audit_blockers",
+    "resolved_blockers",
+    "tests_passed",
+    "post_merge_health"
+  ]
+}

code_mower/templates/calibration-corpus.example.json

@@ -0,0 +1,129 @@
+{
+  "version": 1,
+  "name": "small-known-pr-pilot",
+  "description": "Small calibration corpus for comparing reviewer overlap, useful findings, and noise before promoting informational lanes.",
+  "corpus": [
+    {
+      "repo": "owner/repo",
+      "pr_number": 123,
+      "head_sha": "0123456789abcdef0123456789abcdef01234567",
+      "difficulty": "medium",
+      "source": "known-pr",
+      "truth": {
+        "expectation": "known_clean",
+        "notes": "A merged/control PR that should not produce blocking findings."
+      },
+      "expected_findings": [],
+      "reviewer_runs": [
+        {
+          "reviewer": "codex-audit",
+          "status": "pass",
+          "finding_count": 0,
+          "known_clean": true,
+          "duration_seconds": 120
+        }
+      ],
+      "notes": "Replace with a recent merged PR whose final outcome is known."
+    },
+    {
+      "repo": "owner/repo",
+      "pr_number": 124,
+      "head_sha": "fedcba9876543210fedcba9876543210fedcba98",
+      "base_ref": "main",
+      "difficulty": "hard",
+      "source": "seeded-bug-history-quota",
+      "truth": {
+        "expectation": "known_blocked",
+        "expected_themes": [
+          "history quota enforcement"
+        ],
+        "notes": "A seeded or historical blocker that reviewers should catch."
+      },
+      "expected_findings": [
+        {
+          "path": "tools/example.py",
+          "summary": "Seeded bug description used for adjudication."
+        }
+      ],
+      "context_packs": [
+        "package-runtime"
+      ],
+      "notes": "Seeded-bug entries make catch rate measurable. Keep the seed branch and base ref available so local CLI lanes can reproduce the same diff."
+    },
+    {
+      "repo": "owner/repo",
+      "pr_number": 125,
+      "head_sha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "base_ref": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "difficulty": "hard",
+      "source": "seeded-bug-auth-or-secret",
+      "truth": {
+        "expectation": "known_blocked",
+        "expected_themes": [
+          "auth or secret boundary"
+        ]
+      },
+      "expected_findings": [
+        {
+          "path": "src/auth/session.ts",
+          "summary": "Seeded auth or secret-handling bug expected to block merge."
+        }
+      ],
+      "context_packs": [
+        "auth-context"
+      ],
+      "notes": "Use for token leakage, auth-state drift, RLS, or permission-boundary calibration."
+    },
+    {
+      "repo": "owner/repo",
+      "pr_number": 126,
+      "head_sha": "cccccccccccccccccccccccccccccccccccccccc",
+      "base_ref": "dddddddddddddddddddddddddddddddddddddddd",
+      "difficulty": "hard",
+      "review_class": "package-runtime",
+      "source": "seeded-bug-runtime-packaging",
+      "truth": {
+        "expectation": "known_blocked",
+        "expected_themes": [
+          "runtime packaging"
+        ]
+      },
+      "expected_findings": [
+        {
+          "path": "tools/code_mower_doctor.py",
+          "summary": "Seeded runtime setup bug expected to be caught by package/runtime lenses."
+        }
+      ],
+      "context_packs": [
+        "package-runtime",
+        "calibration-policy"
+      ],
+      "notes": "Use for Python version, CLI auth, subprocess isolation, package extraction, or artifact durability calibration."
+    },
+    {
+      "repo": "owner/repo",
+      "pr_number": 127,
+      "head_sha": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+      "base_ref": "ffffffffffffffffffffffffffffffffffffffff",
+      "difficulty": "hard",
+      "review_class": "calibration-policy",
+      "source": "seeded-bug-calibration-privacy",
+      "truth": {
+        "expectation": "known_blocked",
+        "expected_themes": [
+          "shareable report privacy"
+        ]
+      },
+      "expected_findings": [
+        {
+          "path": "tools/code_mower_doctor.py",
+          "summary": "Seeded privacy bug where auth probe output is persisted in shareable reports."
+        }
+      ],
+      "context_packs": [
+        "calibration-policy"
+      ],
+      "notes": "Use for output-preview redaction, metrics trust, value report, and lane policy calibration."
+    }
+  ]
+}

code_mower/templates/calibration-corpus.json

@@ -0,0 +1,129 @@
+{
+  "version": 1,
+  "name": "small-known-pr-pilot",
+  "description": "Small calibration corpus for comparing reviewer overlap, useful findings, and noise before promoting informational lanes.",
+  "corpus": [
+    {
+      "repo": "owner/repo",
+      "pr_number": 123,
+      "head_sha": "0123456789abcdef0123456789abcdef01234567",
+      "difficulty": "medium",
+      "source": "known-pr",
+      "truth": {
+        "expectation": "known_clean",
+        "notes": "A merged/control PR that should not produce blocking findings."
+      },
+      "expected_findings": [],
+      "reviewer_runs": [
+        {
+          "reviewer": "codex-audit",
+          "status": "pass",
+          "finding_count": 0,
+          "known_clean": true,
+          "duration_seconds": 120
+        }
+      ],
+      "notes": "Replace with a recent merged PR whose final outcome is known."
+    },
+    {
+      "repo": "owner/repo",
+      "pr_number": 124,
+      "head_sha": "fedcba9876543210fedcba9876543210fedcba98",
+      "base_ref": "main",
+      "difficulty": "hard",
+      "source": "seeded-bug-history-quota",
+      "truth": {
+        "expectation": "known_blocked",
+        "expected_themes": [
+          "history quota enforcement"
+        ],
+        "notes": "A seeded or historical blocker that reviewers should catch."
+      },
+      "expected_findings": [
+        {
+          "path": "tools/example.py",
+          "summary": "Seeded bug description used for adjudication."
+        }
+      ],
+      "context_packs": [
+        "package-runtime"
+      ],
+      "notes": "Seeded-bug entries make catch rate measurable. Keep the seed branch and base ref available so local CLI lanes can reproduce the same diff."
+    },
+    {
+      "repo": "owner/repo",
+      "pr_number": 125,
+      "head_sha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "base_ref": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "difficulty": "hard",
+      "source": "seeded-bug-auth-or-secret",
+      "truth": {
+        "expectation": "known_blocked",
+        "expected_themes": [
+          "auth or secret boundary"
+        ]
+      },
+      "expected_findings": [
+        {
+          "path": "src/auth/session.ts",
+          "summary": "Seeded auth or secret-handling bug expected to block merge."
+        }
+      ],
+      "context_packs": [
+        "auth-context"
+      ],
+      "notes": "Use for token leakage, auth-state drift, RLS, or permission-boundary calibration."
+    },
+    {
+      "repo": "owner/repo",
+      "pr_number": 126,
+      "head_sha": "cccccccccccccccccccccccccccccccccccccccc",
+      "base_ref": "dddddddddddddddddddddddddddddddddddddddd",
+      "difficulty": "hard",
+      "review_class": "package-runtime",
+      "source": "seeded-bug-runtime-packaging",
+      "truth": {
+        "expectation": "known_blocked",
+        "expected_themes": [
+          "runtime packaging"
+        ]
+      },
+      "expected_findings": [
+        {
+          "path": "tools/code_mower_doctor.py",
+          "summary": "Seeded runtime setup bug expected to be caught by package/runtime lenses."
+        }
+      ],
+      "context_packs": [
+        "package-runtime",
+        "calibration-policy"
+      ],
+      "notes": "Use for Python version, CLI auth, subprocess isolation, package extraction, or artifact durability calibration."
+    },
+    {
+      "repo": "owner/repo",
+      "pr_number": 127,
+      "head_sha": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+      "base_ref": "ffffffffffffffffffffffffffffffffffffffff",
+      "difficulty": "hard",
+      "review_class": "calibration-policy",
+      "source": "seeded-bug-calibration-privacy",
+      "truth": {
+        "expectation": "known_blocked",
+        "expected_themes": [
+          "shareable report privacy"
+        ]
+      },
+      "expected_findings": [
+        {
+          "path": "tools/code_mower_doctor.py",
+          "summary": "Seeded privacy bug where auth probe output is persisted in shareable reports."
+        }
+      ],
+      "context_packs": [
+        "calibration-policy"
+      ],
+      "notes": "Use for output-preview redaction, metrics trust, value report, and lane policy calibration."
+    }
+  ]
+}