code-standards 8.151.0__tar.gz → 8.151.40__tar.gz

{code_standards-8.151.0 → code_standards-8.151.40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.151.0
+Version: 8.151.40
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/
@@ -31,7 +31,7 @@ Requires-Dist: referencing==0.37.0
 Requires-Dist: repo-standards==6.14.0
 Requires-Dist: ruff==0.17.2
 Requires-Dist: sarj-iac-lint==0.31.0
-Requires-Dist: sarj-python-lint==1.88.0
+Requires-Dist: sarj-python-lint==1.88.20
 Requires-Dist: sarj-rule-contracts==0.5.0
 Requires-Dist: sarj-sql-lint==0.33.0
 Requires-Dist: shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')

{code_standards-8.151.0 → code_standards-8.151.40}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.151.0"
+version = "8.151.40"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -32,7 +32,7 @@ dependencies = [
   "ruff==0.17.2",
   "shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')",
   "sarj-iac-lint==0.31.0",
-  "sarj-python-lint==1.88.0",
+  "sarj-python-lint==1.88.20",
   "sarj-sql-lint==0.33.0",
   "typer==0.27.3",
 ]

{code_standards-8.151.0 → code_standards-8.151.40}/src/sarj_standards/cli/main.py

@@ -2101,7 +2101,7 @@ def _staged_file_names(root: Path, *, include_deleted: bool = True) -> list[str]
         cwd=root,
         check=True,
         capture_output=True,
-        env=_git_environment(),
+        env=_git_environment(staged=True),
     )
     names = [part.decode("utf-8", errors="surrogateescape") for part in completed.stdout.split(b"\0") if part]
     return list(dict.fromkeys(names))
@@ -2165,22 +2165,46 @@ def _unstaged_versions(root: Path, staged_paths: Iterable[str]) -> tuple[str, ..
     if git is None:
         msg = "git is required for --staged"
         raise OSError(msg)
+    selected = set(_repository_relative_names(root, staged_paths))
+    if not selected:
+        return ()
+    # Keep the index byte-exact; compare text content and refine opaque binary records internally.
     completed = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true] -- fixed argv, no shell.
-        [git, "diff", "--name-only", "-z"],
+        [
+            git,
+            "--literal-pathspecs",
+            "-c",
+            "diff.autoRefreshIndex=false",
+            "diff",
+            "--no-ext-diff",
+            "--no-textconv",
+            "--exit-code",
+            "--numstat",
+            "-z",
+            "--no-renames",
+            "--",
+            *sorted(selected),
+        ],
         cwd=root,
-        check=True,
+        check=False,
         capture_output=True,
-        env=_git_environment(),
+        env=_git_environment(staged=True),
     )
-    unstaged = {part.decode("utf-8", errors="surrogateescape") for part in completed.stdout.split(b"\0") if part}
-    selected = set(_repository_relative_names(root, staged_paths))
+    if completed.returncode not in {0, 1}:
+        completed.check_returncode()
+    entries = _numstat_entries(completed.stdout)
+    unstaged = {
+        path
+        for path, binary in entries.items()
+        if path in selected and (not binary or _binary_worktree_differs(root, git, path))
+    }
     if selected:
         tracked = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true] -- literal selected paths and NUL records preserve authored filenames.
             [git, "--literal-pathspecs", "ls-files", "-v", "-z", "--", *sorted(selected)],
             cwd=root,
             check=True,
             capture_output=True,
-            env=_git_environment(),
+            env=_git_environment(staged=True),
         )
         unstaged.update(
             entry[2:].decode("utf-8", errors="surrogateescape")
@@ -2190,6 +2214,60 @@ def _unstaged_versions(root: Path, staged_paths: Iterable[str]) -> tuple[str, ..
     return tuple(sorted(unstaged & selected))
 
 
+def _numstat_entries(output: bytes) -> dict[str, bool]:
+    if not output:
+        return {}
+    if not output.endswith(b"\0"):
+        msg = "git diff returned malformed numstat output"
+        raise OSError(msg)
+    entries: dict[str, bool] = {}
+    for record in output[:-1].split(b"\0"):
+        try:
+            added, deleted, raw_path = record.split(b"\t", 2)
+        except ValueError as exc:
+            msg = "git diff returned malformed numstat output"
+            raise OSError(msg) from exc
+        if not raw_path:
+            msg = "git diff returned malformed numstat output"
+            raise OSError(msg)
+        binary = added == deleted == b"-"
+        if not binary and not (added.isdigit() and deleted.isdigit()):
+            msg = "git diff returned malformed numstat output"
+            raise OSError(msg)
+        path = raw_path.decode("utf-8", errors="surrogateescape")
+        if path not in entries or not binary:
+            entries[path] = binary
+    return entries
+
+
+def _binary_worktree_differs(root: Path, git: str, path: str) -> bool:
+    # Binary numstat records can be stat-only. Internal patch generation compares canonical content and mode.
+    completed = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true] -- fixed argv and literal selected path, no shell.
+        [
+            git,
+            "--literal-pathspecs",
+            "-c",
+            "diff.autoRefreshIndex=false",
+            "diff",
+            "--no-ext-diff",
+            "--no-textconv",
+            "--exit-code",
+            "--patch",
+            "--no-renames",
+            "--no-color",
+            "--",
+            path,
+        ],
+        cwd=root,
+        check=False,
+        capture_output=True,
+        env=_git_environment(staged=True),
+    )
+    if completed.returncode not in {0, 1}:
+        completed.check_returncode()
+    return bool(completed.stdout)
+
+
 def _repository_relative_names(root: Path, paths: Iterable[str]) -> list[str]:
     repository = root.resolve()
     relative_names: list[str] = []
@@ -2207,11 +2285,11 @@ def _repository_relative_names(root: Path, paths: Iterable[str]) -> list[str]:
     return list(dict.fromkeys(relative_names))
 
 
-def _git_environment() -> dict[str, str]:
+def _git_environment(*, staged: bool = False) -> dict[str, str]:
     return {
         name: value
-        for name, value in os.environ.items()  # ruff: ignore[banned-api] -- intentionally sanitize Git hook routing.
-        if name in _GIT_SAFE_ENV
+        for name, value in os.environ.items()  # ruff: ignore[banned-api] -- staged hooks retain only Git's prospective index selection in addition to the closed environment.
+        if name in _GIT_SAFE_ENV or (staged and name == "GIT_INDEX_FILE")
     }
 
 

{code_standards-8.151.0 → code_standards-8.151.40}/src/sarj_standards/configs/cli-reference.v1.json

@@ -3316,6 +3316,6 @@
   },
   "program": "code-standards",
   "schemaVersion": 1,
-  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.151.0).",
-  "version": "8.151.0"
+  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.151.40).",
+  "version": "8.151.40"
 }

{code_standards-8.151.0 → code_standards-8.151.40}/src/sarj_standards/libs/linting/devops_tools.py

@@ -65,6 +65,9 @@ TOOLS: Final = MappingProxyType(
 )
 
 
+_VERSION_QUERY_TIMEOUTS: Final = MappingProxyType({"knip": 15})
+
+
 class NativeToolError(ValueError):
     pass
 
@@ -140,7 +143,12 @@ def _installed_tool(tool: NativeTool, *, root: Path, runner: ProcessExecutor, ma
 
 
 def _attest(tool: NativeTool, *, root: Path, runner: ProcessExecutor) -> NativeTool:
-    output = _version_output(_argv(tool, tool.version_args), root=root, runner=runner)
+    output = _version_output(
+        _argv(tool, tool.version_args),
+        root=root,
+        runner=runner,
+        timeout_seconds=_VERSION_QUERY_TIMEOUTS.get(tool.name, 5),
+    )
     actual = _version(tool, output.stderr if tool.version_stderr else output.stdout)
     if output.returncode or actual != tool.version:
         msg = f"{tool.name} {actual} is installed; exact version {tool.version} is required"
@@ -148,9 +156,11 @@ def _attest(tool: NativeTool, *, root: Path, runner: ProcessExecutor) -> NativeT
     return tool
 
 
-def _version_output(argv: Sequence[str], *, root: Path, runner: ProcessExecutor) -> ProcessOutput:
+def _version_output(
+    argv: Sequence[str], *, root: Path, runner: ProcessExecutor, timeout_seconds: float = 5
+) -> ProcessOutput:
     try:
-        return runner.run(process_request(argv, cwd=root, timeout_seconds=5))
+        return runner.run(process_request(argv, cwd=root, timeout_seconds=timeout_seconds))
     except subprocess.TimeoutExpired as error:
         msg = f"{Path(argv[0]).name} query timed out after {error.timeout} seconds"
         raise NativeToolError(msg) from error