code-standards 8.129.1__tar.gz → 8.129.4__tar.gz

{code_standards-8.129.1 → code_standards-8.129.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.129.1
+Version: 8.129.4
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/

{code_standards-8.129.1 → code_standards-8.129.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.129.1"
+version = "8.129.4"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"

{code_standards-8.129.1 → code_standards-8.129.4}/src/sarj_standards/configs/cli-reference.v1.json

@@ -3305,6 +3305,6 @@
   },
   "program": "code-standards",
   "schemaVersion": 1,
-  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.129.1).",
-  "version": "8.129.1"
+  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.129.4).",
+  "version": "8.129.4"
 }

{code_standards-8.129.1 → code_standards-8.129.4}/src/sarj_standards/libs/adoption/lifecycle.py

@@ -490,7 +490,9 @@ def execute(commands: Iterable[Command]) -> int:
         hook_transaction: transaction.FileTransaction | None = None
         try:
             if command.label in {_PRECOMMIT_HOOK_LABEL, _LEFTHOOK_HOOK_LABEL}:
-                hook_transaction = _capture_hook_transaction(command.cwd)
+                hook_transaction = _capture_hook_transaction(
+                    command.cwd, lefthook=command.label == _LEFTHOOK_HOOK_LABEL
+                )
             completed = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true] -- pass the fixed executable as an argv sequence with shell execution disabled.
                 [executable, *command.argv[1:]],
                 cwd=command.cwd,
@@ -498,9 +500,9 @@ def execute(commands: Iterable[Command]) -> int:
                 env=_command_environment(),
                 timeout=_COMMAND_TIMEOUT.total_seconds(),
             )
-        except subprocess.TimeoutExpired:
+        except subprocess.TimeoutExpired as exc:
             _report_hook_rollback(hook_transaction)
-            sys.stderr.write(f"error: {command.label} exceeded {_COMMAND_TIMEOUT.total_seconds():g}s and was stopped\n")
+            sys.stderr.write(f"error: {command.label} exceeded {exc.timeout:g}s and was stopped\n")
             return 2
         except BaseException:
             _report_hook_rollback(hook_transaction)
@@ -518,7 +520,11 @@ def execute(commands: Iterable[Command]) -> int:
     return 0
 
 
-def _capture_hook_transaction(root: Path) -> transaction.FileTransaction:
+def _capture_hook_transaction(root: Path, *, lefthook: bool = False) -> transaction.FileTransaction:
+    if lefthook:
+        from sarj_standards.libs.repository import hooks as repository_hooks  # ruff: ignore[import-outside-top-level] -- load the selected manager's resolved hook ownership only for Lefthook installation.
+
+        return repository_hooks.capture_transaction(root)
     hooks_dir = _precommit_hook_path(root).parent
     names = (
         "pre-commit",

{code_standards-8.129.1 → code_standards-8.129.4}/src/sarj_standards/libs/linting/analysis.py

@@ -297,8 +297,12 @@ def _run_native(
     else:
         native_result = checker_module.analyze(selected_rules, paths)
     cache: dict[Path, SourceDocument | PythonSourceDocument | None] = {}
+    resolved_paths: dict[Path, Path] = {}
     diagnostics = tuple(
-        normalize_native(item, source=name, root=root, metadata=metadata, documents=cache) for item in native_result
+        normalize_native(
+            item, source=name, root=root, metadata=metadata, documents=cache, resolved_paths=resolved_paths
+        )
+        for item in native_result
     )
     return ToolReport(
         name,
@@ -375,8 +379,13 @@ def normalize_native(
     root: Path,
     metadata: Mapping[str, _NativeRuleMetadata],
     documents: dict[Path, SourceDocument | PythonSourceDocument | None],
+    resolved_paths: dict[Path, Path] | None = None,
 ) -> Diagnostic:
-    resolved = item.path.resolve()
+    resolved = None if resolved_paths is None else resolved_paths.get(item.path)
+    if resolved is None:
+        resolved = item.path.resolve()
+        if resolved_paths is not None:
+            resolved_paths[item.path] = resolved
     document = documents.get(resolved)
     if resolved not in documents:
         try:
@@ -400,16 +409,17 @@ def normalize_native(
 
         if item.code in PROTECTED_SUPPRESSION_CODES:
             tags = ("non-baselineable", "required-source-policy")
+    relative_path = _relative_path(resolved, root)
     return Diagnostic(
         code=item.code,
         rule_id=rule_id,
         message=item.message,
         severity=_severity(item),
         source=source,
-        location=Location(_relative_path(resolved, root), position=position),
+        location=Location(relative_path, position=position),
         help=help_text,
         tags=tags,
-        fixes=_python_fixes(item, document, _relative_path(resolved, root)) if source == "sarj-python-lint" else (),
+        fixes=_python_fixes(item, document, relative_path) if source == "sarj-python-lint" else (),
     )
 
 

{code_standards-8.129.1 → code_standards-8.129.4}/src/sarj_standards/libs/release/rollout.py

@@ -1610,21 +1610,20 @@ def _apply_one(  # ruff: ignore[too-many-locals] - one transaction binds verific
                 raise RolloutError(msg + process_failure_detail(exc)) from exc
             repository_baselines = repository_baseline_migration(repo, previous_repository_baseline)
             assert_consumer_base_current(consumer, base_sha, runner)
-            report("refreshing scoped baselines")
+            report("bootstrapping consumer and refreshing scoped baselines")
             baseline_rules = rollout_baseline_rules(
                 consumer,
                 previous_react_doctor_policy,
                 react_doctor_policy_snapshot(repo),
             )
-            allowed_baseline_paths, baseline_path, expected_baseline = _prepare_rollout_baseline(
+            allowed_baseline_paths, baseline_path, expected_baseline, bootstrap = _prepare_rollout_baseline(
                 consumer, repo, candidate_runner, baseline_rules, tool_prefix, tool=tool, environment=unauthenticated
             )
             allowed_baseline_paths |= frozenset(path.relative_to(repo).as_posix() for path in repository_baselines)
-            report("diagnosing adoption and bootstrapping consumer")
+            report("diagnosing adoption")
             doctor = candidate_runner.run((*tool_prefix, *tool, "doctor"), cwd=repo, env=unauthenticated, check=False)
             if doctor.returncode != 0:
                 failures.append("Standards doctor failed:\n" + verification_detail(doctor))
-            bootstrap = run_consumer_bootstrap(repo, tool_prefix, candidate_runner, unauthenticated)
             assert_baseline_unchanged(baseline_path, expected_baseline)
             assert_baselines_unchanged(repository_baselines)
             consumer_baselines = _update_consumer_baselines(
@@ -2602,6 +2601,7 @@ class _RolloutBaseline(NamedTuple):
     allowed_paths: frozenset[str]
     path: Path | None
     expected: bytes | None
+    bootstrap: subprocess.CompletedProcess[str] | None
 
 
 def _prepare_rollout_baseline(
@@ -2626,7 +2626,9 @@ def _prepare_rollout_baseline(
             "consumer manifest does not declare diagnostic_baseline"
         )
         raise RolloutError(msg)
-    if baseline_path is not None and baseline_relative is not None and baseline_rules:
+    # Declared generators must finish before analysis captures accepted diagnostics.
+    bootstrap = _bootstrap_for_baseline(repo, tool_prefix, runner, environment, baseline_path=baseline_path)
+    if bootstrap is None and baseline_path is not None and baseline_relative is not None and baseline_rules:
         baseline_command = [
             *tool_prefix,
             *tool,
@@ -2649,7 +2651,34 @@ def _prepare_rollout_baseline(
             msg = f"{consumer.name}: scoped diagnostic baseline generation did not create {baseline_path}"
             raise RolloutError(msg)
     expected_baseline = None if baseline_path is None or not baseline_path.is_file() else baseline_path.read_bytes()
-    return _RolloutBaseline(allowed_baseline_paths, baseline_path, expected_baseline)
+    return _RolloutBaseline(allowed_baseline_paths, baseline_path, expected_baseline, bootstrap)
+
+
+def _bootstrap_for_baseline(
+    repo: Path,
+    tool_prefix: tuple[str, ...],
+    runner: CommandRunner,
+    environment: Mapping[str, str],
+    *,
+    baseline_path: Path | None,
+) -> subprocess.CompletedProcess[str] | None:
+    before = {repo / repository_baseline.PATH: repository_baseline.read_optional(repo)}
+    if baseline_path is not None:
+        before[baseline_path] = baseline_path.read_bytes() if baseline_path.is_file() else None
+    bootstrap = run_consumer_bootstrap(repo, tool_prefix, runner, environment)
+    adopted = load_consumer_manifest(repo)
+    relative = None if adopted is None else adopted.diagnostic_baseline
+    configured_path = None if relative is None else repo / relative
+    if baseline_path != configured_path:
+        msg = "consumer bootstrap changed the diagnostic baseline path"
+        raise RolloutError(msg)
+    for path, contents in before.items():
+        if contents is not None or path.exists() or path.is_symlink():
+            assert_baseline_unchanged(path, contents)
+    if bootstrap is not None and baseline_path is not None and not baseline_path.is_file():
+        msg = "consumer bootstrap failed before the diagnostic baseline was available:\n"
+        raise RolloutError(msg + verification_detail(bootstrap))
+    return bootstrap
 
 
 def _verify_rollout_patch(

{code_standards-8.129.1 → code_standards-8.129.4}/src/sarj_standards/libs/repository/hooks.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from datetime import timedelta
 import hashlib
 import os
 from pathlib import Path
@@ -20,6 +21,9 @@ from sarj_standards.libs.typed_containers import is_object_mapping
 
 
 _VERSION: Final = "2.2.1"
+_CORE_HOOKS: Final = ("pre-commit", "pre-push", "commit-msg")
+_LFS_POST_HOOKS: Final = ("post-checkout", "post-commit", "post-merge")
+_DISCOVERY_TIMEOUT: Final = timedelta(seconds=5)
 _ARCHITECTURES: Final = MappingProxyType({"aarch64": "arm64", "amd64": "x86_64"})
 _EXPORT_ASSIGNMENT_PARTS: Final = 2
 _UVX_PATH_MARKER: Final = "# sarj-standards: uvx-path"
@@ -41,9 +45,7 @@ def install(root: Path) -> int:
         raise OSError(msg)
     native_binary = _native_binary()
     durable_binary = _hook_path(root, "pre-commit").parent / f".sarj-lefthook{native_binary.suffix}"
-    hook_targets = _hook_transaction_targets(durable_binary.parent)
-    transaction.validate_targets(durable_binary.parent, hook_targets)
-    hook_transaction = transaction.FileTransaction.capture(durable_binary.parent, hook_targets)
+    hook_transaction = capture_transaction(root)
     try:
         _install_managed_hooks(root, binary, native_binary, durable_binary, Path(uvx))
     except BaseException as exc:
@@ -93,13 +95,20 @@ def _install_managed_hooks(
 
 def _configured_hooks(root: Path, binary: Path) -> frozenset[str]:
     completed = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true] -- pass the fixed executable as an argv sequence with shell execution disabled.
-        [str(binary), "dump", "--format", "json"], cwd=root, check=True, capture_output=True, text=True
+        [str(binary), "dump", "--format", "json"],
+        cwd=root,
+        check=True,
+        capture_output=True,
+        text=True,
+        timeout=_DISCOVERY_TIMEOUT.total_seconds(),
     )
     configuration = parse_json(completed.stdout)
     if not is_object_mapping(configuration):
         msg = "Lefthook resolved configuration must be a JSON object"
         raise ValueError(msg)
-    return frozenset(name for name in configuration if isinstance(name, str))
+    configured = frozenset(name for name in configuration if isinstance(name, str))
+    # Native install refreshes remotes, so only local post hooks have stable ownership before installation.
+    return configured.difference(_LFS_POST_HOOKS) if configuration.get("remotes") else configured
 
 
 def _harden_precommit_entry(contents: str, root: Path) -> str:
@@ -127,19 +136,22 @@ def _harden_managed_call(contents: str, *, hook_type: str) -> str:
     return contents.replace(original, expected, 1)
 
 
-def _hook_transaction_targets(hooks_dir: Path) -> tuple[Path, ...]:
-    return tuple(
-        hooks_dir / name
-        for name in (
-            "pre-commit",
-            "pre-commit.legacy",
-            "commit-msg",
-            "commit-msg.legacy",
-            "pre-push",
-            "pre-push.legacy",
-            ".sarj-lefthook",
-            ".sarj-lefthook.exe",
-        )
+def capture_transaction(root: Path) -> transaction.FileTransaction:
+    hooks_dir = _hook_path(root, "pre-commit").parent
+    transaction.validate_targets(hooks_dir, _hook_transaction_targets(hooks_dir, frozenset()))
+    configured = _configured_hooks(root, _binary("lefthook"))
+    paths = _hook_transaction_targets(hooks_dir, configured)
+    transaction.validate_targets(hooks_dir, paths)
+    return transaction.FileTransaction.capture(hooks_dir, paths)
+
+
+def _hook_transaction_targets(hooks_dir: Path, configured: frozenset[str]) -> tuple[Path, ...]:
+    post_hooks = tuple(name for name in _LFS_POST_HOOKS if name in configured)
+    return (
+        *(hooks_dir / name for hook in _CORE_HOOKS for name in (hook, f"{hook}.legacy")),
+        *(hooks_dir / name for hook in post_hooks for name in (hook, f"{hook}.legacy", f"{hook}.old")),
+        hooks_dir / ".sarj-lefthook",
+        hooks_dir / ".sarj-lefthook.exe",
     )
 
 
@@ -286,11 +298,7 @@ def _native_binary() -> Path:
 
 
 def _hook_paths(root: Path) -> list[Path]:
-    return [
-        path
-        for hook_name in ("pre-commit", "pre-push", "commit-msg")
-        if (path := _hook_path(root, hook_name)).is_file()
-    ]
+    return [path for hook_name in (*_CORE_HOOKS, *_LFS_POST_HOOKS) if (path := _hook_path(root, hook_name)).is_file()]
 
 
 def _hook_path(root: Path, hook_name: str) -> Path:
@@ -313,5 +321,10 @@ def _git(root: Path, *args: str) -> str:
         msg = "git is required to manage repository hooks"
         raise OSError(msg)
     return subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true] -- pass the fixed executable as an argv sequence with shell execution disabled.
-        [executable, *args], cwd=root, check=True, capture_output=True, text=True
+        [executable, *args],
+        cwd=root,
+        check=True,
+        capture_output=True,
+        text=True,
+        timeout=_DISCOVERY_TIMEOUT.total_seconds(),
     ).stdout