crackerjack 0.91.2__tar.gz → 0.91.3__tar.gz

{crackerjack-0.91.2 → crackerjack-0.91.3}/CHANGELOG.md

@@ -10,6 +10,22 @@ blocks_on: []
 topic: changelog
 ---
 
+## [0.91.3] - 2026-10-29
+
+### Performance
+
+- Run the Refurb hook with Mypy import traversal skipped
+
+### Documentation
+
+- changelog: Note the worktree-bucket fix in the registry resolver
+- plans: Plan for plan-index-sync delegating to the repo's renderer
+- plans: Scope the crackerjack action-kit adoption audit
+
+### Build
+
+- deps: Raise the mcp-common floor to 0.33.1 for the ownership API
+
 ## [0.91.2] - 2026-10-28
 
 ### Added
@@ -25,6 +41,7 @@ topic: changelog
 
 - deps: Keep the OTel SDK and exporter out of creosote's unused report
 - Resolve hardcoded home paths in scripts and cross-repo tests
+- Do not resolve a git worktree bucket as the projects root
 
 ### Build
 
@@ -35,6 +52,30 @@ topic: changelog
 
 ### Changed
 
+- perf(refurb): the refurb hook now runs with Mypy's import traversal
+  skipped (`--follow-imports=skip`). Refurb embeds Mypy, so Mypy's own
+  flags are its only speed lever: by default Mypy type-checks every
+  import transitively, and any dependency shipping a `py.typed` marker is
+  analyzed as if it were first-party source.
+
+  The effect depends on the repository's Mypy configuration. Where
+  `follow_imports` is left at the default, the scan drops from minutes to
+  seconds — mcp-common from 294s to 55s, mahavishnu from minutes to
+  about 75s. Where a repository's config already sets `follow_imports =
+  "skip"` (this repo's mypy.ini does), the flag is effectively a no-op; it
+  still makes the behaviour explicit rather than incidental, so a change
+  to mypy.ini cannot silently slow the hook back down.
+
+  This also changes what the hook reports. `--ignore-missing-imports`
+  suppresses the third-party "missing stub" failures that previously
+  failed the hook, and `--follow-imports=skip` means a rule whose answer
+  depends on a third-party library's default value may no longer fire —
+  FURB120 is the concrete case. The skipped set is a strict subset: no new
+  findings appear, and the default check set is unaffected.
+
+  A repository's own `[tool.refurb].mypy_args` is authoritative when
+  present — including when it is an empty list, which opts out.
+
 - deps: the OpenTelemetry SDK and the OTLP exporters are no longer declared
   here. mcp-common's `producer_telemetry` imports them, and mcp-common
   declares them, so they arrive transitively. The `mcp-common` floor moves

{crackerjack-0.91.2 → crackerjack-0.91.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: crackerjack
-Version: 0.91.2
+Version: 0.91.3
 Summary: Crackerjack Python project management tool
 Project-URL: documentation, https://github.com/lesleslie/crackerjack
 Project-URL: homepage, https://github.com/lesleslie/crackerjack
@@ -38,7 +38,7 @@ Requires-Dist: jinja2>=3.1.6
 Requires-Dist: keyring>=25.7.0
 Requires-Dist: libcst>=1.9.0
 Requires-Dist: linkcheckmd>=1.4.0
-Requires-Dist: mcp-common>=0.33.0
+Requires-Dist: mcp-common>=0.33.1
 Requires-Dist: mdformat-ruff>=0.1.3
 Requires-Dist: mdformat>=1.0.0
 Requires-Dist: numpy>=2.5.3

{crackerjack-0.91.2 → crackerjack-0.91.3}/crackerjack/adapters/refactor/refurb.py

@@ -14,6 +14,7 @@ from crackerjack.adapters._tool_adapter_base import (
     ToolExecutionResult,
     ToolIssue,
 )
+from crackerjack.config.refurb_args import build_refurb_mypy_args_for_file_list
 from crackerjack.models.adapter_metadata import AdapterStatus
 from crackerjack.models.qa_results import QACheckType
 
@@ -127,6 +128,33 @@ class RefurbAdapter(BaseToolAdapter):
         files_to_scan = files if files is not None else []
         cmd.extend([str(f) for f in files_to_scan])
 
+        # NOTE: this adapter scans an explicit *file* list, so it must NOT
+        # inherit the package-wide speed flags (--follow-imports=skip; see
+        # crackerjack/config/refurb_args.py). That flag suits a whole-package
+        # scan, where sibling modules stay in the Mypy build set and their
+        # types remain precise; a file list leaves them outside it, so their
+        # types degrade to Any and type-aware rules silently stop firing --
+        # verified: on a single-file scan FURB123 stops being reported while
+        # FURB173 still is.
+        #
+        # The repository's own flags are carried over and only follow_imports
+        # is forced to "normal". Omitting the flags entirely is not enough:
+        # Refurb reads [tool.refurb].mypy_args from pyproject.toml when no
+        # Mypy args are given on the command line, so the repository config
+        # would otherwise supply the skip flag anyway. Carrying the rest over
+        # matters too -- dropping --ignore-missing-imports would make Mypy
+        # report an unresolved import for an optional dependency that is
+        # absent from the venv. That import error is not a blocker, so
+        # Refurb drops it; but a blocker Mypy error (a syntax error, a
+        # "Duplicate module named" complaint, a rejected command line) is
+        # surfaced by Refurb as its own error with exit code 1, and the tool
+        # adapter treats "exit 1 with output" as success, so the check would
+        # report "No issues found" while Mypy had actually failed.
+        #
+        # The separator goes last: Refurb forwards everything after it to
+        # Mypy, so its own flags and the source targets must stay before it.
+        cmd.extend(build_refurb_mypy_args_for_file_list(Path.cwd()))
+
         logger.info(
             "Built Refurb command",
             extra={
@@ -153,12 +181,27 @@ class RefurbAdapter(BaseToolAdapter):
         logger.debug("Parsing Refurb text output", extra={"line_count": len(lines)})
 
         for line in lines:
-            if "[FURB" not in line:
+            if "[FURB" in line:
+                issue = self._parse_refurb_line(line)
+                if issue:
+                    issues.append(issue)
                 continue
 
-            issue = self._parse_refurb_line(line)
-            if issue:
-                issues.append(issue)
+            # Refurb reports its own errors on stdout with a "refurb: "
+            # prefix -- including the Mypy errors it surfaces, such as a
+            # syntax error, a "Duplicate module named" complaint or a
+            # rejected command line. Without this, such a run produces no
+            # parseable issues and the adapter reports "No issues found":
+            # a clean verdict for a scan that never actually ran.
+            if line.startswith("refurb:"):
+                issues.append(
+                    ToolIssue(
+                        file_path=Path.cwd(),
+                        message=line.strip(),
+                        code="REFURB_ERROR",
+                        severity="error",
+                    )
+                )
 
         logger.info(
             "Parsed Refurb output",

{crackerjack-0.91.2 → crackerjack-0.91.3}/crackerjack/config/hooks.py

@@ -61,6 +61,13 @@ class HookDefinition:
     config_path: Path | None = None
     security_level: SecurityLevel = SecurityLevel.MEDIUM
     accepts_file_paths: bool = False
+    # When True the hook's base command already carries its own source
+    # target, so build_command must NOT append a file list on top of it.
+    # Mypy-backed tools need this: passing both a package directory and a
+    # file inside it makes mypy report "Duplicate module named", and a
+    # file-only scan drops the sibling modules from the build set, so
+    # type-aware rules lose their type information. Refurb sets this.
+    scans_own_target: bool = False
     disabled: bool = False
     run_schedule: str | None = None
     allow_unsafe_fixes: bool = False
@@ -83,15 +90,27 @@ class HookDefinition:
         return self._direct_cmd_cache
 
     def build_command(self, files: list[Path] | None = None) -> list[str]:
-
-        base_cmd = self.get_command()
-
-        if files and self.accepts_file_paths:
-            base_cmd.extend([str(f) for f in files])
+        # Copy the cached list: get_command() returns the cache itself, and
+        # these HookDefinition objects are module-level singletons, so
+        # mutating it would leak this call's targets into every later call.
+        base_cmd = self.get_command().copy()
+
+        if files and self.accepts_file_paths and not self.scans_own_target:
+            targets = [str(f) for f in files]
+        elif self.scans_own_target:
+            # The base command already names the source target; adding a
+            # file list would either duplicate the module (mypy) or narrow
+            # the scan and lose type precision.
+            targets = []
         else:
-            base_cmd.append("crackerjack/")
+            targets = ["crackerjack/"]
 
-        return base_cmd
+        # Refurb forwards everything after "--" to Mypy, so source targets
+        # have to be inserted BEFORE the separator. Mypy's positional is
+        # nargs="*": a path after "--" is reported as an unrecognized
+        # argument and the hook fails with zero findings.
+        separator = base_cmd.index("--") if "--" in base_cmd else len(base_cmd)
+        return base_cmd[:separator] + targets + base_cmd[separator:]
 
 
 @dataclass
@@ -346,6 +365,7 @@ COMPREHENSIVE_HOOKS = [
         auto_run=True,
         security_level=SecurityLevel.MEDIUM,
         accepts_file_paths=True,
+        scans_own_target=True,
     ),
     HookDefinition(
         name="creosote",

crackerjack-0.91.3/crackerjack/config/refurb_args.py

@@ -0,0 +1,189 @@
+"""Resolve the Mypy flags Crackerjack passes to Refurb for a target repo.
+
+Refurb drives Mypy internally -- Mypy is a hard dependency rather than a
+pluggable backend (``refurb/main.py`` imports ``mypy.build.build`` and
+``mypy.main.process_options`` directly) -- so Mypy's own flags are the only
+speed lever available. Pyright or ``ty`` cannot be substituted.
+
+By default Mypy follows imports transitively (``follow_imports = "normal"``),
+so every dependency shipping a ``py.typed`` marker is analyzed as if it were
+first-party source. On the Bodai repos that meant roughly 8,100 modules
+analyzed to lint ~120 files, costing 120s to 670s per hook run -- warm cache
+included, because Refurb forces fine-grained incremental mode on, which does
+not help while the whole third-party graph is re-verified each time.
+
+``--follow-imports=skip`` leaves imported modules unanalyzed (``Any``). The
+scanned package's own modules stay in Mypy's build set, so their types stay
+precise and rules that depend on in-package types still fire. What is lost
+is anything whose "correct" answer comes from a *third-party* library's
+default value: FURB120 (redundant default argument) compares the argument
+against the callee's default, and a skipped library has no default to
+compare against. Measured on mcp-common, ``--enable-all`` drops from 30
+findings to 21 -- the skipped set is a strict subset, no new findings, and
+the repository's default check set is unaffected.
+
+The effect depends on the repository's Mypy configuration. Where
+``follow_imports`` is left at the default, the scan drops from minutes to
+seconds -- mcp-common from 294s to 55s, mahavishnu from minutes to about
+75s. Where a repository's config already sets ``follow_imports = "skip"``
+(crackerjack's own mypy.ini does), the flag is effectively a no-op: it
+still makes the behaviour explicit rather than incidental, so a change to
+mypy.ini cannot silently slow the hook back down.
+
+**These flags are only safe for package-wide scans.** A scan of an explicit
+*file* list puts no sibling modules in Mypy's build set, so their types
+degrade to ``Any`` too and type-aware rules silently stop firing: on a
+single-file scan FURB123 stopped being reported while FURB173 still was.
+Callers that scan file lists must not add these flags -- see
+``adapters/refactor/refurb.py``, which carries the repository's own flags
+with ``follow_imports`` forced back to ``normal``.
+
+Refurb *replaces* the config-file ``mypy_args`` when flags are supplied on the
+command line (``refurb/settings.py``: ``mypy_args=new.mypy_args or
+old.mypy_args``). Passing flags on the command line would therefore silently
+discard a repository's own ``[tool.refurb].mypy_args``. So the repository's
+config is read here and passed through: when a repository configures
+``mypy_args`` at all, its value is authoritative -- including when it is
+explicitly empty, which is how a repository opts out of the speed flags.
+Crackerjack's defaults apply only to repositories that do not configure
+Refurb.
+
+The flags are emitted after a ``--`` separator, which is how Refurb forwards
+arguments to Mypy. Source targets must therefore be placed *before* that
+separator: Mypy's positional is ``nargs="*"``, so a path after ``--`` is
+reported as an unrecognized argument and the hook fails with zero findings.
+"""
+
+from __future__ import annotations
+
+import tomllib
+from collections.abc import Sequence
+from pathlib import Path
+
+DEFAULT_REFURB_MYPY_ARGS: tuple[str, ...] = (
+    "--follow-imports=skip",
+    "--ignore-missing-imports",
+)
+
+
+def read_repo_refurb_mypy_args(repo_root: Path | str | None) -> list[str] | None:
+    """Read ``[tool.refurb].mypy_args`` from a repository's pyproject.toml.
+
+    Returns ``None`` when the repository does not configure the setting (so
+    the caller can fall back to its own defaults), and a list -- possibly
+    empty -- when it does. An explicitly empty list is meaningful: it is how
+    a repository opts out of the speed flags.
+
+    A missing or unparsable pyproject.toml is treated as "not configured"
+    rather than an error, so a repository that does not use Refurb simply
+    inherits the defaults.
+    """
+    root = Path.cwd() if repo_root is None else Path(repo_root)
+    try:
+        with (root / "pyproject.toml").open("rb") as handle:
+            data = tomllib.load(handle)
+    except OSError, tomllib.TOMLDecodeError:
+        return None
+    tool = data.get("tool")
+    if not isinstance(tool, dict):
+        return None
+    refurb = tool.get("refurb")
+    if not isinstance(refurb, dict):
+        return None
+    raw = refurb.get("mypy_args")
+    if not isinstance(raw, list):
+        return None
+    return [str(item) for item in raw]
+
+
+def resolve_refurb_mypy_args(
+    repo_root: Path | str | None,
+    defaults: Sequence[str] | None = None,
+) -> list[str]:
+    """Resolve the Mypy flags Refurb should receive for a repository.
+
+    The repository's own ``[tool.refurb].mypy_args`` wins when present.
+    Otherwise the supplied defaults (or the module defaults) apply.
+    """
+    repo = read_repo_refurb_mypy_args(repo_root)
+    if repo is not None:
+        return repo
+    return list(DEFAULT_REFURB_MYPY_ARGS if defaults is None else defaults)
+
+
+def build_refurb_mypy_args(
+    repo_root: Path | str | None,
+    defaults: Sequence[str] | None = None,
+) -> list[str]:
+    """Return the ``--``-prefixed argument tail for a Refurb invocation."""
+    args = resolve_refurb_mypy_args(repo_root, defaults)
+    if not args:
+        return []
+    return ["--", *args]
+
+
+def resolve_refurb_mypy_args_for_file_list(
+    repo_root: Path | str | None,
+    defaults: Sequence[str] | None = None,
+) -> list[str]:
+    """Mypy flags for a scan of an explicit file list.
+
+    A file-list scan needs ``--follow-imports=normal``: skipping imports
+    leaves the sibling modules outside Mypy's build set, so their types
+    degrade to ``Any`` and type-aware rules silently stop firing.
+
+    Everything else the repository configured is preserved. In particular
+    ``--ignore-missing-imports`` has to survive: dropping it makes Mypy
+    report an unresolved import for an optional dependency that is absent
+    from the venv. That import error is not a blocker, so Refurb drops it
+    -- but the general case still bites: a *blocker* Mypy error (a syntax
+    error, a "Duplicate module named" complaint, a rejected command line)
+    is surfaced by Refurb as its own error with exit code 1, and the tool
+    adapter treats "exit 1 with output" as success, so the check would
+    report "No issues found" while Mypy had actually failed.
+
+    Only ``follow_imports`` is overridden. Mypy parses its config file
+    first and lets command-line args override it, so the rest of the
+    repository's list has to be carried over explicitly; Refurb likewise
+    replaces the config file's ``mypy_args`` with the command-line value
+    rather than merging them.
+
+    Both spellings of the flag are recognised -- ``--follow-imports=skip``
+    and the space-separated ``--follow-imports skip`` -- because Mypy
+    accepts either and argparse keeps the last occurrence. Recognising only
+    the ``=`` form would let a repository's own ``skip`` survive and
+    silently degrade the file-list scan.
+    """
+    args = resolve_refurb_mypy_args(repo_root, defaults).copy()
+    forced: list[str] = []
+    kept: list[str] = []
+    skip_next = False
+    for arg in args:
+        if skip_next:
+            # The value belonging to a space-separated --follow-imports.
+            skip_next = False
+            continue
+        if arg == "--follow-imports":
+            if not forced:
+                forced.append("--follow-imports=normal")
+            skip_next = True
+            continue
+        if arg.startswith("--follow-imports="):
+            if not forced:
+                forced.append("--follow-imports=normal")
+            continue
+        kept.append(arg)
+    if not forced:
+        forced.append("--follow-imports=normal")
+    return [*forced, *kept]
+
+
+def build_refurb_mypy_args_for_file_list(
+    repo_root: Path | str | None,
+    defaults: Sequence[str] | None = None,
+) -> list[str]:
+    """``--``-prefixed Mypy tail for a scan of an explicit file list."""
+    args = resolve_refurb_mypy_args_for_file_list(repo_root, defaults)
+    if not args:
+        return []
+    return ["--", *args]

{crackerjack-0.91.2 → crackerjack-0.91.3}/crackerjack/config/tool_commands.py

@@ -7,6 +7,7 @@ from functools import lru_cache
 from pathlib import Path
 
 from crackerjack.config.per_file_ignores import build_inline_per_file_ignores
+from crackerjack.config.refurb_args import build_refurb_mypy_args
 from crackerjack.config.settings import HookSettings
 
 
@@ -355,6 +356,14 @@ def get_tool_command(
 
     if verbose and hook_name == "ty":
         cmd.append("--verbose")
+
+    # Refurb has no pluggable type checker, so Mypy's own flags are its only
+    # speed lever. They are appended after "--" (Refurb forwards everything
+    # past that separator to Mypy) and taken from the repository's own
+    # [tool.refurb].mypy_args, which Refurb would otherwise discard.
+    if hook_name == "refurb":
+        cmd.extend(build_refurb_mypy_args(pkg_path))
+
     return cmd
 
 

{crackerjack-0.91.2 → crackerjack-0.91.3}/crackerjack/core/preflight.py

@@ -11,6 +11,7 @@ from pathlib import Path
 
 from pydantic import BaseModel
 
+from crackerjack.config.refurb_args import build_refurb_mypy_args
 from crackerjack.config.settings import HookSettings
 from crackerjack.services.git_cleanup_service import (
     DirtyWorkingTreeError,
@@ -262,7 +263,11 @@ class PreflightFixer:
             # directory instead, falling back to the repo root when no
             # subdirectory can be identified (matches the legacy behaviour).
             target = self._resolve_package_target()
-            return ["uv", "run", "refurb", str(target)]
+            cmd = ["uv", "run", "refurb", str(target)]
+            # Same Mypy flags as the comprehensive hook: without them
+            # Refurb type-checks the whole third-party dependency graph.
+            cmd.extend(build_refurb_mypy_args(self._pkg_path))
+            return cmd
         return []
 
     def _resolve_package_target(self) -> Path:

{crackerjack-0.91.2 → crackerjack-0.91.3}/crackerjack/executors/cached_hook_executor.py

@@ -255,12 +255,17 @@ class CachedHookExecutor:
         return self.cache.cleanup_all()
 
     def _get_tool_version(self, tool_name: str) -> str | None:
+        # These strings are cache-key epochs, not upstream versions: bump the
+        # entry whenever the hook's effective behaviour changes so stale
+        # cached results are not reused. refurb moved to 1.18.0 when the hook
+        # started passing Mypy flags (--follow-imports=skip), which changes
+        # which findings Refurb reports.
         version_mapping = {
             "pyright": "1.1.0",
             "bandit": "1.7.5",
             "vulture": "2.7.0",
             "complexipy": "0.13.0",
-            "refurb": "1.17.0",
+            "refurb": "1.18.0",
             "ruff": "0.1.0",
             "gitleaks": "8.18.0",
         }